RubyGems - augure - Versions diffs - 0.1.0 - Mend

augure 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (58) hide show

data/home/runner/work/augure/augure/packs/uaf_tcache.yml ADDED Viewed

@@ -0,0 +1,45 @@
+technique: uaf_tcache
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/heap/ptmalloc2/use-after-free/
+rules:
+  - id: app_uaf_tcache
+    head: [applicable, uaf_tcache]
+    conditions:
+      - [fact, vuln, uaf]
+      - [fact, allocator, tcache]
+kb:
+  - id: uaf_tcache_001
+    technique: uaf_tcache
+    description: >
+      Use-after-free meets the tcache: the freed chunk's key and fd sit
+      in writable memory nobody cleared. A stale pointer into a fresh
+      allocation is the whole primitive - poisoning the tcache entry
+      finishes it.
+    chain: [free_after_use, stale_reference, tcache_poison]
+    unlocks: [arb_write]
+    success_rate: 0.45
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.45
+priors: [6, 14]
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "free followed by reuse WITHOUT an intervening allocation"
+    note: "the UAF window"
+  - channel: crash
+    signature: "call through a heap pointer after a free"
+    note: "the stale fn pointer firing"
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068

data/home/runner/work/augure/augure/packs/unsorted_bin_attack.yml ADDED Viewed

@@ -0,0 +1,38 @@
+technique: unsorted_bin_attack
+author: Gregory Epp
+source: https://github.com/shellphint/how2heap (unsorted_bin_attack)
+rules:
+  - id: app_unsorted_bin_attack
+    head: [applicable, unsorted_bin_attack]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, function_pointer_on_heap, true]
+      - [cmp, glibc_minor, lt, 26]
+kb:
+  - id: unsorted_bin_attack_001
+    technique: unsorted_bin_attack
+    description: >
+      Write the unsorted-bin head (a libc address) over an arbitrary
+      word via a forged bk on free. One write, unknown value - enough
+      for a global variable that gates a win path. Patched 2.26+.
+    chain: [forged_bk, unsorted_removal_write]
+    unlocks: [arb_write]
+    success_rate: 0.35
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.35
+priors: [7, 13]
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "unsorted-bin iteration writing a libc address into an attacker-chosen slot"
+    note: "the classic large-lib-pointer write"

metadata ADDED Viewed

@@ -0,0 +1,103 @@
+--- !ruby/object:Gem::Specification
+name: augure
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Gregory Epp
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Augure encodes exploitation technique selection as Datalog rules verified
+  by arithmetic and SMT checks, ranked by Beta-bandit priors and planned by MCTS.
+  Every decision is reproducible and explainable. Augure decides. It never executes.
+email:
+- log0u7@users.noreply.github.com
+executables:
+- augure
+- augure-benchmark
+extensions: []
+extra_rdoc_files: []
+files:
+- "/home/runner/work/augure/augure/docs/agent-snippet.md"
+- "/home/runner/work/augure/augure/docs/auditability.md"
+- "/home/runner/work/augure/augure/docs/build-format.md"
+- "/home/runner/work/augure/augure/docs/explanation-architecture.md"
+- "/home/runner/work/augure/augure/docs/how-to-swap-solver.md"
+- "/home/runner/work/augure/augure/docs/how-to-write-rules.md"
+- "/home/runner/work/augure/augure/docs/pack-format.md"
+- "/home/runner/work/augure/augure/docs/reference.md"
+- "/home/runner/work/augure/augure/docs/tutorial.md"
+- "/home/runner/work/augure/augure/examples/ret2win.facts"
+- "/home/runner/work/augure/augure/examples/split.facts"
+- "/home/runner/work/augure/augure/exe/augure"
+- "/home/runner/work/augure/augure/exe/augure-benchmark"
+- "/home/runner/work/augure/augure/lib/augure.rb"
+- "/home/runner/work/augure/augure/lib/augure/bandit.rb"
+- "/home/runner/work/augure/augure/lib/augure/coverage.rb"
+- "/home/runner/work/augure/augure/lib/augure/ctf_corpus.json"
+- "/home/runner/work/augure/augure/lib/augure/engine.rb"
+- "/home/runner/work/augure/augure/lib/augure/facts.rb"
+- "/home/runner/work/augure/augure/lib/augure/kb_corpus.json"
+- "/home/runner/work/augure/augure/lib/augure/knowledge_base.rb"
+- "/home/runner/work/augure/augure/lib/augure/mcts.rb"
+- "/home/runner/work/augure/augure/lib/augure/pack.rb"
+- "/home/runner/work/augure/augure/lib/augure/pack_loader.rb"
+- "/home/runner/work/augure/augure/lib/augure/parity.rb"
+- "/home/runner/work/augure/augure/lib/augure/pipeline.rb"
+- "/home/runner/work/augure/augure/lib/augure/priors.rb"
+- "/home/runner/work/augure/augure/lib/augure/rules.rb"
+- "/home/runner/work/augure/augure/lib/augure/smt_process.rb"
+- "/home/runner/work/augure/augure/lib/augure/verifier.rb"
+- "/home/runner/work/augure/augure/lib/augure/version.rb"
+- "/home/runner/work/augure/augure/packs/banner_leak.yml"
+- "/home/runner/work/augure/augure/packs/brop.yml"
+- "/home/runner/work/augure/augure/packs/fastbin_hook.yml"
+- "/home/runner/work/augure/augure/packs/got_partial_overwrite.yml"
+- "/home/runner/work/augure/augure/packs/got_partial_overwrite_deref.yml"
+- "/home/runner/work/augure/augure/packs/house_botcake.yml"
+- "/home/runner/work/augure/augure/packs/house_force.yml"
+- "/home/runner/work/augure/augure/packs/house_of_apple2.yml"
+- "/home/runner/work/augure/augure/packs/house_orange.yml"
+- "/home/runner/work/augure/augure/packs/jop.yml"
+- "/home/runner/work/augure/augure/packs/large_bin_attack.yml"
+- "/home/runner/work/augure/augure/packs/one_gadget.yml"
+- "/home/runner/work/augure/augure/packs/orw.yml"
+- "/home/runner/work/augure/augure/packs/ret2csu_v2.yml"
+- "/home/runner/work/augure/augure/packs/ret2dlresolve_x86.yml"
+- "/home/runner/work/augure/augure/packs/ret2partial_overwrite.yml"
+- "/home/runner/work/augure/augure/packs/ret2vdso.yml"
+- "/home/runner/work/augure/augure/packs/setcontext_srop.yml"
+- "/home/runner/work/augure/augure/packs/uaf_tcache.yml"
+- "/home/runner/work/augure/augure/packs/unsorted_bin_attack.yml"
+- CHANGELOG.md
+- LICENSE
+- README.md
+- exe/augure
+- exe/augure-benchmark
+homepage: https://github.com/log0u7/augure
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/log0u7/augure
+  source_code_uri: https://github.com/log0u7/augure
+  changelog_uri: https://github.com/log0u7/augure/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.4'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: 'Auditable exploitation decision layer: propose, verify, explain.'
+test_files: []