VITRIOL

Visita Interiora Terrae Rectificando Invenies Occultum Lapidem "Visit the interior of the earth, and by rectifying, you will find the hidden stone." — Tabula Smaragdina, Hermes Trismegistus

The alchemists sought transformation through what already existed in nature. This toolkit applies the same principle to offensive security: Living off the Land — using only what the system already provides to move, persist, enumerate, and exfiltrate. No external binaries. No dropped tools. No noise.

Every script maps to a MITRE ATT&CK technique and follows a consistent interface.

Legal notice: This toolkit is intended for authorized penetration testing, CTF competitions, and security research only. Never run these scripts against systems you do not own or have explicit written permission to test.

---

Philosophy

On any Linux system you'll find Bash, /dev/tcp, curl, sed, grep, find, awk and nslookup. That's enough to run a full engagement — from initial recon to exfiltration — without dropping a single binary.

VITRIOL is the executable counterpart to references like GTFOBins and LOLBAS: not just a catalogue of techniques, but parameterized, reusable scripts ready to run.

---

Requirements

• Bash 5.x (bash --version)
• Standard Linux userland (tested on Debian/Ubuntu and RHEL/CentOS minimal installs)
• No root required unless noted per script

---

Modules

Module	Description	ATT&CK Tactics
recon/	Network and host discovery without standard recon tools	Discovery
web/	HTTP enumeration, crawling, fuzzing, and brute force	Reconnaissance, Credential Access
postex/	Local privilege escalation paths and credential hunting	Privilege Escalation, Credential Access
lateral/	Lateral movement and file transfer via native channels	Lateral Movement
persist/	Persistence via cron and shell configuration	Persistence
exfil/	Data exfiltration over DNS, TCP, and HTTP	Exfiltration

---

Quick Start

git clone https://github.com/Fennek115/Vitriol.git
cd vitriol

# Network scan — discover live hosts and open ports using /dev/tcp/
bash toolkit/recon/tcp_scan.sh 192.168.56

# Web fuzzer — find paths returning interesting HTTP codes
bash toolkit/web/fuzzer.sh http://192.168.56.96 wordlist.txt

Each script prints usage when called with -h or without required arguments.

---

Script Interface Contract

All scripts in this toolkit follow the same conventions:

• Accept -h for help
• Write errors and usage to stderr
• Exit 0 on success, 1 on usage error, 2 on runtime error
• Color output: green [+] for hits, yellow [*] for info, red [-] for errors

---

MITRE ATT&CK Coverage

Script	Technique ID	Technique Name
recon/tcp_scan.sh	T1046	Network Service Discovery
web/fuzzer.sh	T1595.003	Active Scanning: Wordlist Scanning
web/crawler.sh	T1595.003	Active Scanning: Wordlist Scanning
web/cewl_gen.sh	T1589	Gather Victim Identity Information
web/brute_login.sh	T1110.001	Brute Force: Password Guessing
postex/suid_check.sh	T1548.001	Abuse Elevation Control: Setuid/Setgid
postex/cred_hunt.sh	T1552.001	Unsecured Credentials: Credentials in Files
postex/proc_enum.sh	T1057	Process Discovery
postex/ssh_harvest.sh	T1552.004	Unsecured Credentials: Private Keys
lateral/tcp_transfer.sh	T1570	Lateral Tool Transfer
persist/cron_persist.sh	T1053.003	Scheduled Task/Job: Cron
persist/bashrc_backdoor.sh	T1546.004	Event Triggered Execution: Unix Shell Config
exfil/dns_exfil.sh	T1048.003	Exfiltration Over Alternative Protocol: DNS
exfil/tcp_exfil.sh	T1048	Exfiltration Over C2 Channel
exfil/http_exfil.sh	T1048.002	Exfiltration Over Web Service

---

Background

Scripts evolved from hands-on LotL labs built on top of the Bash Scripting Profesional course by sec2john.