Acquire Exploit Behavior

Some Vendors or other Coordinated Vulnerability Disclosure (CVD) Participants might require a proof-of-concept exploit to accompany an incoming report for it to pass their validation checks. To that end, an Acquire Exploit Behavior Tree is shown below.

Notional external process

The process on this page is notional: it happens outside Vultron. Vultron records its outcome as a state change and does not automate the work itself.

Legacy design diagram

The diagram on this page reflects the simulator-era design from vultron/bt/ and may not match the current implementation in vultron/core/behaviors/. See the Behaviors Reference for auto-generated documentation from the current implementation.

No normative spec group

This behavior has no corresponding normative RMB, EMB, or CSB spec group in the Requirements Catalog.

---
title: Acquire Exploit Behavior Tree
---
flowchart LR
    fb["?"]
    have_exploit(["have exploit?"])
    fb --> have_exploit
    seq["→"]
    fb --> seq
    fb2["?"]
    seq --> fb2
    exp_priority(["exploit priority<br/>set?"])
    fb2 --> exp_priority
    eval_priority["evaluate<br/>priority"]
    fb2 --> eval_priority
    exp_desired(["exploit desired?"])
    seq --> exp_desired
    fb3["?"]
    seq --> fb3
    find_exploit["find exploit"]
    fb3 --> find_exploit
    dev_exploit["develop exploit"]
    fb3 --> dev_exploit
    pay_exploit["purchase exploit"]
    fb3 --> pay_exploit

The goal of this behavior is for the Participant to be in possession of an exploit.

If the Participant does not already have one, the main acquisition sequence is triggered. The sequence begins by ensuring that the exploit acquisition activity has sufficient priority to continue. If it does, the Participant has one of three options to choose from: they can find one somewhere else, develop it themselves, or pay someone for the privilege.

The overall behavior returns Success when either an exploit is acquired or when one is not desired and is therefore deferred. It can fail in the scenario where an exploit is desired but not acquired.