1 hour ago
I see people still using LLMs the old fashioned way — generate code, copy paste, test. That's not the way bros. You need an agent harness — opencode, claude code, cursor, cline, any of them. They let the model run commands/tools, read the output, and decide the next move on its own. That means it corrects its own mistakes and builds software (and exploits) way faster. Downside for the internet: attackers no longer need to know every little detail.
The setup — this is the easy part, it's literally just an app:
1. Install any agent harness on your own machine. opencode has a single command install script, claude code is one npm install away, cursor is a desktop app. Pick whichever you like, they all work the same way.
2. Get an API key from uncensoredai.dev — one key, one OpenAI-compatible /v1 endpoint, 35 models including uncensored and abliterated variants. No email, no KYC, crypto-only top-ups, so your key isn't tied to anything.
3. Point your harness at the base URL, paste the key, set the model to "glm-5.3-abliterated" — refusal direction straight out of the weights, it won't nag you mid-operation. Takes two minutes.
That's the whole trick really — the app you already use to refactor code at work is the attack tool now. Same terminal, same chat window, except now it's running masscan and dropping exploits instead of fixing your typescript.
Point it at low hanging fruit: IoT, smart TVs, internet-connected toasters. You can literally tell the agent to research zero-auth RCE vulns it thinks still have live devices, and it will do the research and find recent exploitable CVEs on its own.
Then have it build and test a PoC. If firmware is available it can emulate the target and test against that. While it does that, sort out scanning. Shodan API gets you the most coverage (keys sell for crypto if you look), but I've just been using masscan — open source, just expect throttling because providers hate everyone spamming the whole internet.
Once scanning is done, tell the agent to run the PoC against a live target. A stock model will refuse sometimes — that's the point of pulling yours from uncensoredai.dev in the first place — but it should land code execution. Next, have it set up a C2 — use an open source framework or have the agent build its own (works best in my experience). Connect the first victim, then have it patch the vuln on the device so nobody else gets in.
Last step: tell it to write a script that exploits machines and adds them to the C2 automatically, then just let it run as long as you need.
"But what if the feds seize my server?" If people are interested I'll do a follow-up on building a C2 that gets its IP from crypto dead drops — basically immune to takedowns.
Questions welcome.
The setup — this is the easy part, it's literally just an app:
1. Install any agent harness on your own machine. opencode has a single command install script, claude code is one npm install away, cursor is a desktop app. Pick whichever you like, they all work the same way.
2. Get an API key from uncensoredai.dev — one key, one OpenAI-compatible /v1 endpoint, 35 models including uncensored and abliterated variants. No email, no KYC, crypto-only top-ups, so your key isn't tied to anything.
3. Point your harness at the base URL, paste the key, set the model to "glm-5.3-abliterated" — refusal direction straight out of the weights, it won't nag you mid-operation. Takes two minutes.
That's the whole trick really — the app you already use to refactor code at work is the attack tool now. Same terminal, same chat window, except now it's running masscan and dropping exploits instead of fixing your typescript.
Point it at low hanging fruit: IoT, smart TVs, internet-connected toasters. You can literally tell the agent to research zero-auth RCE vulns it thinks still have live devices, and it will do the research and find recent exploitable CVEs on its own.
Then have it build and test a PoC. If firmware is available it can emulate the target and test against that. While it does that, sort out scanning. Shodan API gets you the most coverage (keys sell for crypto if you look), but I've just been using masscan — open source, just expect throttling because providers hate everyone spamming the whole internet.
Once scanning is done, tell the agent to run the PoC against a live target. A stock model will refuse sometimes — that's the point of pulling yours from uncensoredai.dev in the first place — but it should land code execution. Next, have it set up a C2 — use an open source framework or have the agent build its own (works best in my experience). Connect the first victim, then have it patch the vuln on the device so nobody else gets in.
Last step: tell it to write a script that exploits machines and adds them to the C2 automatically, then just let it run as long as you need.
"But what if the feds seize my server?" If people are interested I'll do a follow-up on building a C2 that gets its IP from crypto dead drops — basically immune to takedowns.
Questions welcome.
