augure 0.1.0

data/home/runner/work/augure/augure/packs/fastbin_hook.yml

@@ -0,0 +1,45 @@
+technique: fastbin_hook
+author: Gregory Epp
+source: https://github.com/shellphint/how2heap (fastbin dup into hooks)
+
+rules:
+  - id: app_fastbin_hook
+    head: [applicable, fastbin_hook]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, allocator, tcache]
+      - [cmp, glibc_minor, lt, 34]
+
+kb:
+  - id: fastbin_hook_001
+    technique: fastbin_hook
+    description: >
+      Fastbin dup with a forged fd pointing near __malloc_hook /
+      __free_hook (size-aligned); the next malloc of that bin returns
+      the hook. __free_hook died in glibc 2.34.
+    chain: [fastbin_dup, fd_forge, hook_alloc]
+    unlocks: [arb_write]
+    success_rate: 0.40
+
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.40
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syslog
+    signature: "double free on same size class then rapid controlled-size allocations"
+    note: "the fastbin poisoning sequence"
+  - channel: crash
+    signature: "execution redirected into the heap or a fake fd target"
+    note: "the hook firing into attacker memory"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068

data/home/runner/work/augure/augure/packs/got_partial_overwrite.yml

@@ -0,0 +1,45 @@
+technique: got_partial_overwrite
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/io-file/got-hijack/
+
+rules:
+  - id: app_got_partial_overwrite
+    head: [applicable, got_partial_overwrite]
+    conditions:
+      - [fact, relro, partial]
+      - [fact, got_overwrite_target, true]
+
+kb:
+  - id: got_partial_overwrite_001
+    technique: got_partial_overwrite
+    description: >
+      Partial RELRO leaves the GOT writable: overwrite only the low
+      bytes of a resolved entry so the imported function lands on a
+      nearby win path. Two bytes beat a leak when PIE keeps the page
+      fixed.
+    chain: [low_bytes_overwrite, reimport_call]
+    unlocks: [shell]
+    success_rate: 0.50
+
+mcts:
+  requires: []
+  provides: [shell]
+  terminal: true
+  success: 0.50
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "partial write to a GOT page after a stack overflow"
+    note: "the GOT edit itself (write to a mapping that should be read-only under full RELRO)"
+  - channel: crash
+    signature: "unexpected control transfer through a PLT stub"
+    note: "the hijacked call"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068

data/home/runner/work/augure/augure/packs/got_partial_overwrite_deref.yml

@@ -0,0 +1,39 @@
+technique: got_partial_overwrite_deref
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/io-file/got-hijack/
+
+rules:
+  - id: app_got_partial_overwrite_deref
+    head: [applicable, got_partial_overwrite_deref]
+    conditions:
+      - [fact, relro, partial]
+      - [fact, got_overwrite_target, true]
+      - [fact, has_reg_control, true]
+
+kb:
+  - id: got_partial_overwrite_deref_001
+    technique: got_partial_overwrite_deref
+    description: >
+      The partial-GOT write with register control: overwrite the low
+      bytes of a resolved entry AND steer its argument registers - the
+      one-byte move that turns an arbitrary call into an arbitrary call
+      with your argument.
+    chain: [low_bytes_overwrite, reg_seed, reimport_call]
+    unlocks: [shell]
+    success_rate: 0.45
+
+mcts:
+  requires: []
+  provides: [shell]
+  terminal: true
+  success: 0.45
+
+priors: [6, 14]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "the same partial GOT write plus gadget-sourced register setup"
+    note: "the deref variant's chain"

data/home/runner/work/augure/augure/packs/house_botcake.yml

@@ -0,0 +1,38 @@
+technique: house_botcake
+author: Gregory Epp
+source: https://github.com/shellphint/how2heap (house_of_botcake)
+
+rules:
+  - id: app_house_botcake
+    head: [applicable, house_botcake]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, allocator, tcache]
+      - [cmp, glibc_minor, ge, 29]
+
+kb:
+  - id: house_botcake_001
+    technique: house_botcake
+    description: >
+      Tcache-era consolidation overlap: fill the tcache, force a
+      consolidated chunk into the unsorted bin, double-take it through
+      the tcache. The modern answer to double-free after the tcache key.
+    chain: [tcache_fill, consolidate, double_take]
+    unlocks: [arb_write]
+    success_rate: 0.45
+
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.45
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "7 tcache fills then a double free across unsorted/tcache boundary"
+    note: "the consolidation window the technique requires"

data/home/runner/work/augure/augure/packs/house_force.yml

@@ -0,0 +1,37 @@
+technique: house_force
+author: Gregory Epp
+source: https://github.com/shellphint/how2heap (house_of_force)
+
+rules:
+  - id: app_house_force
+    head: [applicable, house_force]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, allocator, dlmalloc]
+
+kb:
+  - id: house_force_001
+    technique: house_force
+    description: >
+      Overwrite the top chunk size with a huge value; the next malloc
+      returns a chunk overlapping any address. Killed by the top-chunk
+      sanity check in glibc 2.29; dlmalloc-era targets only.
+    chain: [top_size_overwrite, next_malloc_overlap, fnptr_takeover]
+    unlocks: [arb_write]
+    success_rate: 0.35
+
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.35
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "a huge malloc size passed to a fixed buffer-controlled value"
+    note: "the topchunk extension"

data/home/runner/work/augure/augure/packs/house_of_apple2.yml

@@ -0,0 +1,45 @@
+technique: house_of_apple2
+author: Gregory Epp
+source: https://github.com/ROPgadget - the _IO_wfile_jumps era (roderick01)
+
+rules:
+  - id: app_house_of_apple2
+    head: [applicable, house_of_apple2]
+    conditions:
+      - [fact, vuln, heap]
+      - [cmp, glibc_minor, ge, 34]
+
+kb:
+  - id: house_of_apple2_001
+    technique: house_of_apple2
+    description: >
+      glibc 2.34 killed the classic hooks; the FILE structure survived.
+      House of Apple 2 walks _IO_wfile_overflow's vtable path to
+      _IO_wfile_jumps, turning a forged FILE into an arbitrary call -
+      the modern FSOP answer to the hookless age.
+    chain: [file_forge, wfile_jumps, wide_vtable_call]
+    unlocks: [arb_call]
+    success_rate: 0.30
+
+mcts:
+  requires: []
+  provides: [arb_call]
+  terminal: true
+  success: 0.30
+
+priors: [5, 15]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "FILE structure writes into _IO_list_all territory (heap chunks at unusual sizes)"
+    note: "the fake FILE being groomed"
+  - channel: crash
+    signature: "abort inside _IO_flush_all_lockp with attacker-controlled pointers"
+    note: "the wide-character exit path firing"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068

data/home/runner/work/augure/augure/packs/house_orange.yml

@@ -0,0 +1,38 @@
+technique: house_orange
+author: Gregory Epp
+source: https://github.com/shellphint/how2heap (house_of_orange)
+
+rules:
+  - id: app_house_orange
+    head: [applicable, house_orange]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, function_pointer_on_heap, true]
+      - [cmp, glibc_minor, lt, 26]
+
+kb:
+  - id: house_orange_001
+    technique: house_orange
+    description: >
+      No free needed: shrink the top chunk through a heap extension,
+      free it into the unsorted bin, then forge the _IO_list_all path
+      to a fake FILE structure. Dead above glibc 2.25 (vtable checks).
+    chain: [top_extend, unsorted_free, file_struct_forge]
+    unlocks: [arb_write]
+    success_rate: 0.30
+
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.30
+
+priors: [7, 13]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "abort in _IO_flush_all with a fake vtable pointer"
+    note: "the classic FSOP exit"

data/home/runner/work/augure/augure/packs/jop.yml

@@ -0,0 +1,39 @@
+technique: jop
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/medium-rop/ (JOP/COP)
+
+rules:
+  - id: app_jop
+    head: [applicable, jop]
+    conditions:
+      - [fact, vuln, sof]
+      - [fact, nx, true]
+      - [fact, has_reg_control, true]
+      - [fact, has_pivot_gadget, true]
+
+kb:
+  - id: jop_001
+    technique: jop
+    description: >
+      Jump-oriented programming: the dispatcher is a jmp fed by a
+      controlled register - the shape CET-era defenses leave standing
+      when they watch returns. The facts name the dispatch gadget.
+    chain: [dispatcher_hunt, register_seed, dispatch_chain]
+    unlocks: [reg_control]
+    success_rate: 0.35
+
+mcts:
+  requires: []
+  provides: [reg_control]
+  terminal: true
+  success: 0.35
+
+priors: [6, 14]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "control transfer through rip-relative jmp sequences in .text"
+    note: "the JOP dispatch loop"

data/home/runner/work/augure/augure/packs/large_bin_attack.yml

@@ -0,0 +1,39 @@
+technique: large_bin_attack
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/heap/ptmalloc2/large-bin-attack/
+
+rules:
+  - id: app_large_bin_attack
+    head: [applicable, large_bin_attack]
+    conditions:
+      - [fact, vuln, heap]
+      - [fact, allocator, tcache]
+      - [cmp, glibc_minor, ge, 26]
+
+kb:
+  - id: large_bin_attack_001
+    technique: large_bin_attack
+    description: >
+      A forged bk_nextsize/bk in the large-bin insertion writes two
+      chosen addresses over the target - the unsorted-bin write's big
+      sibling, alive in every modern glibc. Two writes, unknown values,
+      one target each.
+    chain: [large_bin_entry, forged_pointers, double_write]
+    unlocks: [arb_write]
+    success_rate: 0.35
+
+mcts:
+  requires: []
+  provides: [arb_write]
+  terminal: true
+  success: 0.35
+
+priors: [6, 14]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "unsorted bin scans with attacker-controlled bk writes (the two-chunk dance)"
+    note: "the largebin fd/bk corruption"

data/home/runner/work/augure/augure/packs/one_gadget.yml

@@ -0,0 +1,38 @@
+technique: one_gadget
+author: Gregory Epp
+source: https://github.com/david942j/one_gadget
+
+rules:
+  - id: app_one_gadget
+    head: [applicable, one_gadget]
+    conditions:
+      - [fact, libc_present, true]
+      - [fact, nx, true]
+
+kb:
+  - id: one_gadget_001
+    technique: one_gadget
+    description: >
+      A single libc address that execs /bin/sh when its register
+      constraints hold at the call site. Cheaper than a chain once the
+      base is known - the constraints (rsp alignment, null registers)
+      are the whole gamble.
+    chain: [constraint_check, base_apply, exec_sh]
+    unlocks: [shell]
+    success_rate: 0.50
+
+mcts:
+  requires: [libc_base]
+  provides: [shell]
+  terminal: true
+  success: 0.50
+
+priors: [5, 15]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "execution into libc internals without a prior leak-print"
+    note: "a one_gadget constraint path"

data/home/runner/work/augure/augure/packs/orw.yml

@@ -0,0 +1,55 @@
+technique: orw
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/sandbox/seccomp/c-sandbox-escape/
+
+rules:
+  # sibling rules share the head: the OR the DSL expresses by
+  # splitting (the provenance carries every firing - engine B3).
+  # nx false: the stub rides the executable stack (the lab's case);
+  # nx true: the ROP path needs a syscall gadget in the binary.
+  - id: app_orw_stack
+    head: [applicable, orw]
+    conditions:
+      - [fact, seccomp, true]
+      - [fact, nx, false]
+  - id: app_orw_rop
+    head: [applicable, orw]
+    conditions:
+      - [fact, seccomp, true]
+      - [fact, nx, true]
+      - [fact, has_syscall_gadget, true]
+
+kb:
+  - id: orw_001
+    technique: orw
+    description: >
+      seccomp blocks execve: the open/read/write chain reads the flag
+      without ever spawning a shell. The chain needs the syscall gadget
+      the profiler already hunts, and every gadget the facts carry.
+    chain: [open_flag, read_fd, write_stdout]
+    unlocks: [flag_read]
+    success_rate: 0.45
+
+mcts:
+  requires: []
+  provides: [flag_read]
+  terminal: true
+  success: 0.45
+
+priors: [6, 14]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "open+read+write syscall sequence without execve, on a filtered process"
+    note: "THE orw chain: execve blocked, orw the only path"
+  - channel: crash
+    signature: "SIGSYS (bad system call) following an execve attempt"
+    note: "the filter doing its job - the operator probed execve"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1083
+  - T1056

data/home/runner/work/augure/augure/packs/ret2csu_v2.yml

@@ -0,0 +1,55 @@
+# Canonique: le modele de technique pack pour agents et operateurs.
+# Structure, vocabulaire et limites: voir docs/pack-format.md.
+technique: ret2csu_v2
+author: Gregory Epp
+source: https://ropemporium.com/challenge/ret2csu.html
+
+rules:
+  - id: app_ret2csu_v2
+    head: [applicable, ret2csu_v2]
+    conditions:
+      - [fact, vuln, sof]
+      - [fact, nx, true]
+      - [match, gadget, 0, csu]
+
+kb:
+  - id: ret2csu_v2_001
+    technique: ret2csu_v2
+    description: >
+      __libc_csu_init universal gadget populates rdx/rsi/rdi in
+      gadget-sparse binaries; the popper and mov gadgets enable
+      controlled multi-argument calls.
+    chain: [csu_popper, csu_mov, target_fn]
+    unlocks: [libc_base]
+    success_rate: 0.75
+
+mcts:
+  requires: []
+  provides: [libc_base]
+  terminal: false
+  success: 0.70
+
+priors: [14, 6]
+
+# The assembly order, resolved by lictor's builder from the facts: the
+# csu popper sets rbx=0, rbp=1, r12=fn@got, r13=arg2, r14=arg1, r15=arg0
+# then csu_mov issues mov rdx,r13 / mov rsi,r14 / mov edi,r15d / call
+# [r12+rbx*8]; 7 junk qwords fall through the second pop; the chain
+# ends on the technique that follows (leak:main keeps the process
+# alive). The arg values here are the canonical puts(puts@got) leak;
+# an operator edits the consts for their call.
+build:
+  technique: ret2csu_v2
+  layout:
+    - [padding, measured_offset]
+    - [chain, "gadget:csu_popper", "const:0", "const:1", "got_addr:puts",
+       "const:8", "got_addr:puts", "const:1", "gadget:csu_mov",
+       "const:0", "const:0", "const:0", "const:0", "const:0", "const:0", "const:0"]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "call through __libc_csu_init gadget territory on a gadget-poor binary"
+    note: "the csu chain issuing calls"

data/home/runner/work/augure/augure/packs/ret2dlresolve_x86.yml

@@ -0,0 +1,39 @@
+technique: ret2dlresolve_x86
+author: Gregory Epp
+source: https://ropemporium.com/challenge/ret2dlresolve.html
+
+rules:
+  - id: app_ret2dlresolve_x86
+    head: [applicable, ret2dlresolve_x86]
+    conditions:
+      - [fact, dt_lazy, true]
+      - [fact, reloc_writable, true]
+      - [fact, pie, false]
+
+kb:
+  - id: ret2dlresolve_x86_001
+    technique: ret2dlresolve_x86
+    description: >
+      The 32-bit flavor of lazy-binding abuse: forge a fake
+      Rel/Sym/string triple at a known address and let _dl_runtime_resolve
+      fetch system() out of thin air. No leak, no libc needed - the
+      index arithmetic is the whole craft.
+    chain: [fake_reloc, fake_sym, resolve_system]
+    unlocks: [shell]
+    success_rate: 0.45
+
+mcts:
+  requires: []
+  provides: [shell]
+  terminal: true
+  success: 0.45
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "relocation resolution against a forged reloc index"
+    note: "the dlresolve structure"

data/home/runner/work/augure/augure/packs/ret2partial_overwrite.yml

@@ -0,0 +1,38 @@
+technique: ret2partial_overwrite
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/partial-overwrite/
+
+rules:
+  - id: app_ret2partial_overwrite
+    head: [applicable, ret2partial_overwrite]
+    conditions:
+      - [fact, pie, true]
+      - [fact, vuln, sof]
+      - [fact, canary, false]
+
+kb:
+  - id: ret2partial_overwrite_001
+    technique: ret2partial_overwrite
+    description: >
+      PIE randomizes pages, not the low 12 bits: overwrite only the
+      saved return address's low bytes to hop onto a nearby gadget or
+      function. No leak needed when the canary is absent.
+    chain: [low_bytes_ret_overwrite, page_hop]
+    unlocks: [reg_control]
+    success_rate: 0.40
+
+mcts:
+  requires: []
+  provides: [reg_control]
+  terminal: true
+  success: 0.40
+
+priors: [8, 12]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "low-byte-only return addresses (single NUL write) on a PIE target"
+    note: "the partial overwrite probes"

data/home/runner/work/augure/augure/packs/ret2vdso.yml

@@ -0,0 +1,39 @@
+technique: ret2vdso
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/advanced-rop/ret2vdso/
+
+rules:
+  - id: app_ret2vdso
+    head: [applicable, ret2vdso]
+    conditions:
+      - [fact, vuln, sof]
+      - [fact, nx, true]
+      - [fact, pie, true]
+
+kb:
+  - id: ret2vdso_001
+    technique: ret2vdso
+    description: >
+      The vDSO is mapped at a near-static offset for the process's
+      lifetime: gadgets in it survive PIE randomization of the main
+      image. A syscall-bearing page the loader itself mapped - scarce
+      gadgets, but exactly where the main binary has none.
+    chain: [vdso_base_establish, gadget_hunt, syscall_hop]
+    unlocks: [reg_control]
+    success_rate: 0.30
+
+mcts:
+  requires: []
+  provides: [reg_control]
+  terminal: true
+  success: 0.30
+
+priors: [5, 15]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: crash
+    signature: "control into the vDSO mapping"
+    note: "the vDSO landing"

data/home/runner/work/augure/augure/packs/setcontext_srop.yml

@@ -0,0 +1,46 @@
+technique: setcontext_srop
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/advanced-rop/srop/
+
+rules:
+  - id: app_setcontext_srop
+    head: [applicable, setcontext_srop]
+    conditions:
+      - [fact, libc_present, true]
+      - [fact, sigreturn_frame, true]
+      - [fact, has_syscall_gadget, true]
+
+kb:
+  - id: setcontext_srop_001
+    technique: setcontext_srop
+    description: >
+      The sigreturn path has two doors: the classic SROP frame and the
+      setcontext gadget (offset +53/+61 in modern glibc) that loads a
+      full register state from a controlled ucontext. Same primitive,
+      fewer gadgets, no mprotect needed.
+    chain: [frame_or_ucontext, setcontext_load, syscall_shell]
+    unlocks: [shell]
+    success_rate: 0.45
+
+mcts:
+  requires: [libc_base]
+  provides: [shell]
+  terminal: true
+  success: 0.45
+
+priors: [7, 13]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: syscall
+    signature: "rt_sigreturn issued far from a real signal (the frame pivot)"
+    note: "the SROP frame being restored"
+  - channel: crash
+    signature: "register sets that never came from a signal delivery"
+    note: "the forged context"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068