lictor 0.4.0

data/lib/lictor/trail.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+
+module Lictor
+  # Append-only JSONL trail: one line per event, timestamped. An engagement
+  # you cannot replay is an engagement you cannot defend. (SQLite/sequel
+  # comes when queries are actually needed; JSONL is the honest v1.)
+  class Trail
+    def initialize(path)
+      @path = path
+    end
+
+    def record(event)
+      line = JSON.generate(event.merge(timestamp: Time.now.utc.iso8601))
+      # 0600 at creation: the record of offensive operations is private
+      # from birth (existing files keep the operator's perms)
+      File.open(@path, "a", 0o600) { |f| f.puts(line) }
+      self
+    end
+
+    def events
+      File.readlines(@path).map { |l| JSON.parse(l) }
+    rescue Errno::ENOENT
+      []
+    end
+
+    # Plan and outcome events grouped per run, in run order.
+    def runs
+      grouped = {}
+      events.each do |event|
+        run = grouped[event["run"]] ||= {run: event["run"], outcomes: []}
+        case event["type"]
+        when "plan"
+          run.merge!(event.slice("mode", "selected", "applicable", "explain",
+            "facts_file", "profiled", "priors_adapted")
+                         .transform_keys(&:to_sym))
+        when "profile"
+          run[:profiled] = event["binary"]
+        when "outcome"
+          run[:outcomes] << {technique: event["technique"], success: event["success"],
+                             executed: event["executed"] || false}
+        when "scan"
+          run[:scanned] = event["target"]
+        when "fuzz"
+          run[:fuzzed] = event["binary"]
+          run[:crashes] = event["crashes"]
+        when "triage"
+          run[:triage] = {signal: event["signal"], control: event["control"]}
+        when "rule_install"
+          run[:taught] = event["technique"]
+        when "acquire"
+          run[:acquired] = event["binary"]
+        when "build"
+          run[:built] = {technique: event["technique"], offset: event["offset"],
+                         ret: event["ret"], size: event["size"], out: event["out"]}
+        when "scaffold"
+          run[:scaffolded] = event["file"]
+        when "harvest"
+          run[:harvested] = event["addresses"]
+        when "verify"
+          run[:verified] = event["remote_crashed"]
+        when "suggest"
+          run[:suggested] = event["added"]
+        when "leak"
+          run[:leaked] = event["addresses"]
+        when "measure"
+          run[:measured] = {sink: event["sink"], offset: event["offset"], source: event["source"]}
+        when "pack_draft"
+          run[:drafted] = event["technique"]
+        end
+      end
+      grouped.values
+    end
+  end
+end

data/lib/lictor/tube.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "socket"
+
+module Lictor
+  class TubeError < StandardError; end
+
+  # The ONE TCP implementation behind the banner readers (harvest,
+  # verify): connect, read_until (EOF/reset/deadline/limit), write,
+  # reset tracking, close. The run channel stays the ronin subprocess
+  # (ADR 0001's honest boundary).
+  # UDP, TLS and HTTP-aware delivery become flavors of the same seam
+  # (ADR lictor 0001). The timeout/deadline semantics live here, once.
+  class Tube
+    attr_reader :reset_seen
+
+    def self.tcp(host, port, timeout: 5)
+      sock = Socket.tcp(host, port.to_i, connect_timeout: timeout)
+      new(sock, deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
+    rescue SystemCallError => e
+      raise TubeError, "connect #{host}:#{port} failed: #{e.message}"
+    end
+
+    def initialize(sock, deadline:)
+      @sock = sock
+      @deadline = deadline
+      @reset_seen = false
+    end
+
+    # Read until the connection dies (EOF or reset), the deadline or the
+    # limit; returns everything captured. A reset is recorded, not
+    # raised: the callers' crash heuristics need the distinction.
+    def read_bytes(limit: 512)
+      reply = +""
+      loop do
+        break if reply.bytesize >= limit
+        break if Process.clock_gettime(Process::CLOCK_MONOTONIC) > @deadline
+
+        chunk = @sock.read_nonblock(limit - reply.bytesize, exception: false)
+        case chunk
+        # nil: read_nonblock(exception: false) signals EOF as nil, "" as
+        # a truly empty read - both mean the socket will yield no more
+        when "", nil then break
+        when :wait_readable
+          break unless IO.select([@sock], nil, nil, 0.5)
+        else
+          reply << chunk
+        end
+      end
+      reply
+    rescue Errno::ECONNRESET, Errno::EPIPE
+      @reset_seen = true
+      reply
+    end
+
+    def gets(delim = "\n", wait: 2)
+      @sock.wait_readable(wait) ? @sock.gets(delim) : nil
+    end
+
+    def write(data)
+      @sock.write(data)
+      self
+    rescue Errno::EPIPE, Errno::ECONNRESET
+      @reset_seen = true
+      self
+    end
+
+    def close
+      @sock.close unless @sock.closed?
+    rescue IOError, Errno::ENOTCONN
+      nil
+    end
+
+    def reset? = @reset_seen
+  end
+end

data/lib/lictor/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Lictor
+  VERSION = '0.4.0'
+end

data/lib/lictor.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require_relative "lictor/version"
+require_relative "lictor/config"
+require_relative "lictor/acquisition"
+require_relative "lictor/recon"
+require_relative "lictor/scanner"
+require_relative "lictor/profiler"
+require_relative "lictor/handoff"
+require_relative "lictor/technique_packs"
+require_relative "lictor/suggestion"
+require_relative "lictor/payload_builder" # lazy-loads metasm (the profiler) on first build
+require_relative "lictor/exploit_scaffold"
+require_relative "lictor/pack_draft"
+require_relative "lictor/tube"
+require_relative "lictor/harvest"
+require_relative "lictor/executor"
+require_relative "lictor/priors"
+require_relative "lictor/trail"
+require_relative "lictor/report"
+require_relative "lictor/targets"
+require_relative "lictor/run"
+
+module Lictor
+end

metadata

@@ -0,0 +1,101 @@
+--- !ruby/object:Gem::Specification
+name: lictor
+version: !ruby/object:Gem::Version
+  version: 0.4.0
+platform: ruby
+authors:
+- Gregory Epp
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: augure
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: ruby-nmap
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+description: 'Carries out the decisions augure judged: handoff by default, everything
+  trailed, the operator is the authorization. Scan, acquire, fuzz, verify, plan, build,
+  run, report. Lictor executes; it never decides.'
+email:
+- log0u7@users.noreply.github.com
+executables:
+- lictor
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- bin/lictor
+- lib/config/build_layouts.yml
+- lib/lictor.rb
+- lib/lictor/acquisition.rb
+- lib/lictor/config.rb
+- lib/lictor/executor.rb
+- lib/lictor/exploit_scaffold.rb
+- lib/lictor/handoff.rb
+- lib/lictor/harvest.rb
+- lib/lictor/pack_draft.rb
+- lib/lictor/payload_builder.rb
+- lib/lictor/priors.rb
+- lib/lictor/profiler.rb
+- lib/lictor/recon.rb
+- lib/lictor/report.rb
+- lib/lictor/run.rb
+- lib/lictor/scanner.rb
+- lib/lictor/suggestion.rb
+- lib/lictor/targets.rb
+- lib/lictor/technique_packs.rb
+- lib/lictor/templates/scaffold_exploit.rb.erb
+- lib/lictor/trail.rb
+- lib/lictor/tube.rb
+- lib/lictor/version.rb
+homepage: https://github.com/log0u7/lictor
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/log0u7/lictor
+  source_code_uri: https://github.com/log0u7/lictor
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.4'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: The orchestrator that carries out augure's judgments - handoff by default,
+  everything trailed.
+test_files: []