pwn 0.4.333

data/Vagrantfile

@@ -0,0 +1,250 @@
+# frozen_string_literal: true
+
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+require 'yaml'
+require 'pathname'
+
+API_VERSION = '2'
+pwn_root = Pathname.new(__FILE__).realpath.expand_path.parent
+vagrant_gui = ENV['VAGRANT_GUI'] if ENV['VAGRANT_GUI']
+pwn_provider = ENV['PWN_PROVIDER'] if ENV['PWN_PROVIDER']
+runtime_userland = 'vagrant_rsync_userland_configs.lst'
+template_userland = "#{pwn_root}/vagrant_rsync_userland_template.lst"
+
+if pwn_provider == 'docker'
+  docker_container_target = ENV['DOCKER_CONTAINER_TARGET'] if ENV['DOCKER_CONTAINER_TARGET']
+  docker_create_args = [
+    '--interactive',
+    '--tty'
+  ]
+
+  case docker_container_target
+  when 'docker_pwn_prototyper'
+    docker_container_image = '0dayinc/pwn_prototyper'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'echo PWN.help | pwn && pwn'
+    ]
+  when 'docker_pwn_fuzz_net_app_proto'
+    docker_container_image = '0dayinc/pwn_fuzz_net_app_proto'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_fuzz_net_app_proto; bash'
+    ]
+  when 'docker_pwn_transparent_browser'
+    docker_container_image = '0dayinc/pwn_transparent_browser'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'echo PWN::Plugins::TransparentBrowser.help | pwn && pwn'
+    ]
+  when 'docker_pwn_sast'
+    docker_container_image = '0dayinc/pwn_sast'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_sast; bash'
+    ]
+  when 'docker_pwn_www_checkip'
+    docker_container_image = '0dayinc/pwn_www_checkip'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_www_checkip -h; bash'
+    ]
+  else
+    raise "Unknown DOCKER_CONTAINER_TARGET: #{docker_container_target}"
+  end
+
+  Vagrant.configure(API_VERSION) do |config|
+    # config.ssh.username = 'root'
+    config.vm.define docker_container_target do
+      config.vm.synced_folder('.', '/vagrant', disabled: true)
+      config.vm.provider :docker do |d|
+        d.name = docker_container_target
+        d.image = docker_container_image
+        d.create_args = docker_create_args
+        d.cmd = docker_cmd
+        d.volumes = ['/tmp:/tmp']
+        # d.has_ssh = true
+      end
+    end
+  end
+else
+  puts 'GUI ENABLED.' if vagrant_gui
+
+  Vagrant.configure(API_VERSION) do |config|
+    config.vm.box = 'pwn/kali_rolling'
+    config.ssh.username = 'admin'
+
+    r = Random.new
+    ssh_port = r.rand(1_025...65_535)
+    config.vm.network 'forwarded_port', guest: 22, host: ssh_port, id: 'ssh', auto_correct: true
+
+    config.vm.synced_folder(
+      '.',
+      '/opt/pwn',
+      type: 'rsync',
+      rsync__args: [
+        '--progress',
+        "--rsync-path='/usr/bin/sudo rsync'",
+        '--archive',
+        '--delete',
+        '-compress',
+        '--recursive',
+        '--files-from=vagrant_rsync_third_party.lst',
+        '--ignore-missing-args'
+      ]
+    )
+
+    File.open(runtime_userland, 'w') do |f|
+      File.readlines(template_userland).each do |line|
+        f.puts "etc/userland/#{pwn_provider}/#{line.chomp}"
+      end
+    end
+
+    config.vm.synced_folder(
+      '.',
+      '/opt/pwn',
+      type: 'rsync',
+      rsync__args: [
+        '--progress',
+        "--rsync-path='/usr/bin/sudo rsync'",
+        '--archive',
+        '--delete',
+        '-compress',
+        '--recursive',
+        "--files-from=#{runtime_userland}",
+        '--ignore-missing-args'
+      ]
+    )
+
+    # Load UserLand Configs for Respective Provider
+    case pwn_provider
+    when 'aws'
+      config_path = './etc/userland/aws/vagrant.yaml'
+    when 'virtualbox'
+      config_path = './etc/userland/virtualbox/vagrant.yaml'
+      # config.vm.network('public_network')
+    when 'vmware'
+      config_path = './etc/userland/vmware/vagrant.yaml'
+      # config.vm.network('public_network')
+    else
+      # This is needed when vagrant ssh is executed
+      config_path = ''
+    end
+
+    if File.exist?(config_path)
+      yaml_config = YAML.load_file(config_path)
+
+      hostname = yaml_config['hostname']
+      config.vm.hostname = hostname
+
+      config.vm.provider :virtualbox do |vb, _override|
+        if pwn_provider == 'virtualbox'
+          vb.gui = false
+          vb.gui = true if vagrant_gui == 'true'
+
+          vb.customize ['modifyvm', :id, '--clipboard', 'bidirectional']
+          vb.customize ['modifyvm', :id, '--draganddrop', 'bidirectional']
+          vb.customize ['modifyvm', :id, '--cpus', yaml_config['cpus']]
+          vb.customize ['modifyvm', :id, '--memory', yaml_config['memory']]
+          # disk_mb = yaml_config['diskMB']
+          # TODO: resize vmdk based on /pwn/etc/userland/vmware/vagrant.yaml
+        end
+      end
+
+      %i[vmware_fusion vmware_workstation].each do |vmware_provider|
+        config.vm.provider vmware_provider do |vm, _override|
+          # Workaround until https://github.com/hashicorp/vagrant/issues/10730 is resolved
+          vm.ssh_info_public = true
+          vm.whitelist_verified = true
+          if pwn_provider == 'vmware'
+            if vagrant_gui == 'true'
+              vm.gui = true
+            else
+              vm.gui = false
+            end
+            # vagrant_vmware_license = yaml_config['vagrant_vmware_license']
+            vm.vmx['numvcpus'] = yaml_config['cpus']
+            vm.vmx['memsize'] = yaml_config['memory']
+            vm.vmx['vhv.enable'] = 'true'
+            # disk_mb = yaml_config['diskMB']
+            # TODO: resize vmdk based on /pwn/etc/userland/vmware/vagrant.yaml
+          end
+        end
+      end
+
+      config.vm.provider :aws do |aws, override|
+        if pwn_provider == 'aws'
+          override.vm.box = 'dummy'
+
+          # aws_init_script = "#!/bin/bash\necho \"Updating FQDN: #{hostname}\"\ncat /etc/hosts | grep \"#{hostname}\" || sudo sed 's/127.0.0.1/127.0.0.1 #{hostname}/g' -i /etc/hosts\nhostname | grep \"#{hostname}\" || sudo hostname \"#{hostname}\"\nsudo sed -i -e 's/^Defaults.*requiretty/# Defaults requiretty/g' /etc/sudoers\necho 'Defaults:admin !requiretty' >> /etc/sudoers"
+
+          aws.access_key_id = yaml_config['access_key_id']
+          aws.secret_access_key = yaml_config['secret_access_key']
+          aws.session_token = yaml_config['session_token']
+          aws.keypair_name = yaml_config['keypair_name']
+
+          case yaml_config['region']
+          when 'us-east-1'
+            aws.ami = 'ami-02eb1a4c830533086'
+          when 'us-east-2'
+            aws.ami = 'ami-0ec0b569397da65f4'
+          when 'us-west-1'
+            aws.ami = 'ami-0485cc5cdb2c13dd9'
+          when 'us-west-2'
+            aws.ami = 'ami-0a3b38548723847de'
+          else
+            raise "Error: #{yaml_config['region']} not supported."
+          end
+
+          aws.block_device_mapping = yaml_config['block_device_mapping']
+          aws.region = yaml_config['region']
+          aws.monitoring = yaml_config['monitoring']
+          aws.elastic_ip = yaml_config['elastic_ip']
+          aws.associate_public_ip = yaml_config['associate_public_ip']
+          aws.private_ip_address = yaml_config['private_ip_address']
+          aws.subnet_id = yaml_config['subnet_id']
+          aws.instance_type = yaml_config['instance_type']
+          aws.iam_instance_profile_name = yaml_config['iam_instance_profile_name']
+          aws.security_groups = yaml_config['security_groups']
+          aws.tags = yaml_config['tags']
+          # Hack for dealing w/ images that require a pty when using sudo and changing hostname
+          # aws.user_data = aws_init_script
+
+          override.ssh.username = 'admin'
+          override.ssh.private_key_path = yaml_config['ssh_private_key_path']
+          override.dns.record_sets = yaml_config['record_sets']
+        end
+      end
+
+      # Set PWN_PROVIDER for Guest Deployment
+      config.vm.provision :shell, inline: "echo \"export PWN_ROOT='#{pwn_root}'\" > /etc/profile.d/pwn_envs.sh"
+      config.vm.provision :shell, inline: "echo \"export PWN_PROVIDER='#{pwn_provider}'\" >> /etc/profile.d/pwn_envs.sh"
+      # Provision Software Based on UserLand Configurations w/in vagrant_rsync_userland_configs.lst
+      # After PWN Box has Booted
+      config.vm.provision :shell, path: './vagrant/provisioners/init_env.sh', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/kali_customize.rb', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/pwn.sh', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/postgres.sh', args: hostname, privileged: false
+      # AWS EC2 Storage is handled via EBS Volumes
+      unless pwn_provider == 'aws'
+        config.vm.provision :shell, path: './vagrant/provisioners/userland_fdisk.sh', args: hostname, privileged: false
+        config.vm.provision :reload
+        config.vm.provision :shell, path: './vagrant/provisioners/userland_lvm.sh', args: hostname, privileged: false
+      end
+      config.vm.provision :shell, path: './vagrant/provisioners/metasploit.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/openvas.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/burpsuite_pro.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/jenkins.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/apache2.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/jenkins_ssh-keygen.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/post_install.sh', privileged: false
+    end
+  end
+end
+File.unlink(runtime_userland) if File.exist?(runtime_userland)

data/bin/pwn

@@ -0,0 +1,74 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'pry'
+require 'tty-prompt'
+require 'tty-reader'
+
+begin
+  # TODO: Remove once this feature is available in mainline
+  class Pry
+    # Overwrite Pry::History.push method in History class to get duplicate history entries
+    # in order to properly replay automation in this prototyping driver
+    class History
+      def push(line)
+        return line if line.empty? || invalid_readline_line?(line)
+
+        begin
+          last_line = @history[-1]
+        rescue IndexError
+          last_line = nil
+        end
+
+        # return line if line == last_line
+
+        @history << line
+        @history_line_count += 1
+        @saver.call(line) if !should_ignore?(line) &&
+                             Pry.config.history_save
+
+        line
+      end
+      alias << push
+    end
+  end
+
+  cli = Pry
+
+  cli.config.hooks.add_hook(:before_eval, :autocomplete) do
+    prompt = TTY::Prompt.new
+    reader = TTY::Reader.new
+    reader.on(:keypress) { |key_event| prompt(key_event) }
+  end
+
+  cli::Commands.create_command 'toggle-pager' do
+    description 'Toggle less on returned objects surpassing the terminal.'
+
+    def process
+      _pry_.config.pager ? _pry_.config.pager = false : _pry_.config.pager = true
+    end
+  end
+
+  # Custom Main & Wait (Multi-Line) Prompts
+  title = "\001\e[1m\002\001\e[31m\002pwn\001\e[0m\002" # Bold Red
+  version = "\001\e[36m\002v#{PWN::VERSION}\001\e[0m\002" # Cyan
+  arrow = "\001\e[32m\002>>>\001\e[0m\002" # Green
+  splat = "\001\e[33m\002***\001\e[0m\002" # Yellow
+
+  prompt = [
+    proc do |_target_self, _nest_level, pry|
+      line_pad = format('%0.3d', pry.input_ring.size)
+      line_count = "\001\e[34m\002#{line_pad}\001\e[0m\002" # Blue
+      "#{title}[#{version}]:#{line_count} #{arrow} ".to_s.scrub
+    end,
+    proc do |_target_self, _nest_level, pry|
+      line_pad = format('%0.3d', pry.input_ring.size)
+      line_count = "\001\e[34m\002#{line_pad}\001\e[0m\002" # Blue
+      "#{title}[#{version}]:#{line_count} #{splat} ".to_s.scrub
+    end
+  ]
+  cli.start(self, prompt: Pry::Prompt.new(:pwn, 'PWN_PROTOTYPING_DRIVER', prompt))
+rescue StandardError => e
+  raise e
+end

data/bin/pwn_android_war_dialer

@@ -0,0 +1,137 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+require 'waveform'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-fFROM', '--from=FROM', '<Required - Dial Range from (Beginning Number)>') do |f|
+    opts[:from_num] = f
+  end
+
+  options.on('-tTO', '--to=TO', '<Required - Dial Range to (Ending Number)>') do |t|
+    opts[:to_num] = t
+  end
+
+  options.on('-sSEC', '--seconds-to-record=SEC', '<Required - Seconds to Record >') do |s|
+    opts[:seconds_to_record] = s
+  end
+
+  options.on('-aADB', '--adb-path=ADB', '<Required - Path to ADB (Android Debug Bridge)>') do |adb|
+    opts[:adb_bin] = adb
+  end
+
+  options.on('-SSOX', '--sox-path=SOX', '<Required - Path to SoX Binary, the Swiss Army knife of Audio>') do |sox|
+    opts[:sox_bin] = sox
+  end
+
+  options.on('-wWAV', '--wav-archive-dir=WAV', '<Required - Directory Path to Store WAV Files>') do |wav|
+    opts[:wav_archive] = wav
+  end
+
+  options.on('-r', '--[no-]randomize', '<Optional - Randomize Number Range (Defaults to false)>') do |r|
+    opts[:randomize] = r
+  end
+
+  options.on('-dSEC', '--delay-between-calls=SEC', '<Optional - Seconds to Delay Between Calls (Defaults to 0)>') do |d|
+    opts[:seconds_to_delay_between_calls] = d
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+# Required Flag Variables
+from_num = opts[:from_num].to_s.scrub.strip.chomp.delete('(').delete(')').delete('-').delete('.').delete('+').to_i
+to_num = opts[:to_num].to_s.scrub.strip.chomp.delete('(').delete(')').delete('-').delete('.').delete('+').to_i
+seconds_to_record = opts[:seconds_to_record].to_i
+adb_bin = opts[:adb_bin] if File.exist?(opts[:adb_bin].to_s.scrub.strip.chomp)
+sox_bin = opts[:sox_bin] if File.exist?(opts[:sox_bin].to_s.scrub.strip.chomp)
+wav_archive = opts[:wav_archive].to_s.scrub.strip.chomp if Dir.exist?(opts[:wav_archive].to_s.scrub.strip.chomp)
+waveform_bin = 'waveform'
+
+# Optional Flag Variables
+randomize = opts[:randomize]
+seconds_to_delay_between_calls = opts[:seconds_to_delay_between_calls].to_i
+
+# Colors!
+red = "\e[31m"
+green = "\e[32m"
+yellow = "\e[33m"
+cayan = "\e[36m"
+end_of_color = "\e[0m"
+
+raise 'ERROR: --from value must be <= --to value' if from_num > to_num
+
+begin
+  $stdout.sync = true
+  range = []
+  # Prepare the targets for assessment
+  (from_num..to_num).each { |number| range.push(number) }
+
+  # Randomize targets if applicable
+  range.shuffle! if randomize
+
+  range.each do |target_num|
+    start_timestamp = Time.now.strftime('%Y-%m-%d.%H.%M.%S')
+    puts "#{green}#{start_timestamp} >>>#{end_of_color} #{yellow}dialing #{target_num}#{end_of_color}"
+    PWN::Plugins::Android.adb_sh(
+      adb_path: adb_bin,
+      command: "am start -a android.intent.action.CALL -d tel:'#{target_num}'"
+    )
+
+    # Record Call
+    pid_to_kill = 0
+    wav_file = "#{wav_archive}/#{target_num}-#{start_timestamp}.wav"
+    sox_params = "-d #{wav_file} trim 0 #{seconds_to_record}"
+
+    puts red
+    puts "Recording Duration: #{seconds_to_record}s"
+    system(sox_bin, sox_params)
+    puts 'Complete.'
+    puts end_of_color
+
+    ending_timestamp = Time.now.strftime('%Y-%m-%d.%H.%M.%S')
+    print "#{yellow}#{ending_timestamp} >>> #{end_of_color}"
+    PWN::Plugins::Android.adb_sh(
+      adb_path: adb_bin,
+      command: 'input keyevent KEYCODE_ENDCALL'
+    )
+    puts "#{green}hung up #{target_num}#{end_of_color}"
+
+    puts cayan
+    puts 'Generating Audio Spectrogram...'
+    sox_params = "#{wav_file} -n spectrogram -o #{wav_file}-spectrogram.png -d #{seconds_to_record}"
+    system(sox_bin, sox_params)
+    puts 'Generating Audio Waveform...'
+    waveform_params = "-c '#FF0000' -b '#000000' -F #{wav_file} #{wav_file}-waveform.png"
+    system(waveform_bin, waveform_params)
+    puts 'Complete.'
+    puts end_of_color
+
+    if seconds_to_delay_between_calls.positive? # Greater than 0
+      (1..seconds_to_delay_between_calls).reverse_each do |countdown|
+        print "#{red}delay #{seconds_to_delay_between_calls}s until next call: #{format('%-9.9s', countdown)}#{end_of_color}"
+        print "\r"
+        sleep 1
+      end
+      puts "\n#{green}waking up \\o/#{end_of_color}"
+    end
+    puts "\n\n\n"
+  end
+rescue StandardError => e
+  raise e.message
+ensure
+  PWN::Plugins::Android.adb_sh(
+    adb_path: adb_bin,
+    command: 'input keyevent KEYCODE_ENDCALL'
+  )
+end

data/bin/pwn_arachni

@@ -0,0 +1,132 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-tTARGET', '--target_url=TARGET', '<Required - Target URI to Scan>') do |t|
+    opts[:target_url] = t
+  end
+
+  options.on('-oDIR', '--report_output_dir=DIR', '<Required - Output Directory for Results Generation>') do |o|
+    opts[:output_dir] = o
+  end
+
+  options.on('-bTYPE', '--browser_type=TYPE', '<Optional - Browser Type <firefox|chrome|headless> (Defaults to chrome)>') do |b|
+    opts[:browser_type] = b
+  end
+
+  options.on('-IINST', '--navigation_instruct=INST', '<Optional - Path to Navigation Instructions (e.g. Auth w/ Target - see /pwn/etc/arachni/navigation.instruct.EXAMPLE)>') do |i|
+    opts[:navigation_instruct] = i
+  end
+
+  options.on('-pPROXY', '--proxy=PROXY', '<Optional - Proxy SCHEME://ADDRESS:PORT>') do |p|
+    opts[:proxy] = p
+  end
+
+  options.on('-xTYPE', '--proxy-type=TYPE', '<Optional - Proxy Type (See arachni --help)>') do |x|
+    opts[:proxy_type] = x
+  end
+
+  options.on('-ePATTERN', '--exclude-pattern=PATTERN', '<Optional - Exclude comma-delimited resources whose URL matches pattern>') do |e|
+    opts[:exclude_pattern] = e
+  end
+
+  options.on('-d', '--[no-]deep', '<Optional - Enable Deep Scanning (Much Longer to Complete)>') do |d|
+    opts[:deep_scan] = d
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  logger = PWN::Plugins::PWNLogger.create
+
+  target_url = opts[:target_url].to_s.scrub
+  output_dir = opts[:output_dir].to_s.scrub if Dir.exist?(opts[:output_dir].to_s.scrub)
+  if opts[:browser_type].nil?
+    browser_type = :chrome
+  else
+    browser_type = opts[:browser_type].to_s.strip.chomp.scrub.to_sym
+  end
+  navigation_instruct = opts[:navigation_instruct].to_s.strip.chomp.scrub if File.exist?(opts[:navigation_instruct].to_s.strip.chomp.scrub)
+  proxy = opts[:proxy]
+  proxy_type = opts[:proxy_type]
+  exclude_pattern = opts[:exclude_pattern]
+  deep_scan = opts[:deep_scan]
+
+  raise 'ERROR: please use pwn_arachni_rest for REST Scanning.' if browser_type == :rest
+
+  browser = PWN::Plugins::TransparentBrowser.open(
+    browser_type: browser_type,
+    proxy: proxy
+  )
+
+  browser.goto(target_url)
+
+  if navigation_instruct
+    File.read(navigation_instruct).each_line do |instruction|
+      browser.instance_eval(instruction.to_s.scrub.strip.chomp)
+    end
+
+    # We should have an authenticated session by now in our browser object...
+    http_cookie_header = ''
+    browser.cookies.to_a.each_with_index do |this_symbolized_cookie_hash, index|
+      # Need to convert symbolized key names in browser.cookies.to_a[index]
+      # to strings for proper CGI::Cookie consumption
+      this_cookie = {}
+      this_symbolized_cookie_hash.each do |key, val|
+        this_cookie[key.to_s] = val
+      end
+
+      cgi_cookie_str = CGI::Cookie.new(this_cookie).to_s
+
+      if index.zero?
+        http_cookie_header = cgi_cookie_str
+      else
+        http_cookie_header = "#{http_cookie_header}, #{cgi_cookie_str}"
+      end
+    end
+  end
+
+  arachni_cmd_str = "arachni #{target_url} --audit-parameter-names"
+  arachni_cmd_str = "#{arachni_cmd_str} --output-debug"
+  arachni_cmd_str = "#{arachni_cmd_str} --checks=*"
+  arachni_cmd_str = "#{arachni_cmd_str} --audit-ui-inputs --audit-ui-forms"
+  arachni_cmd_str = "#{arachni_cmd_str} --audit-jsons --audit-xmls"
+  arachni_cmd_str = "#{arachni_cmd_str} --audit-links --audit-forms --audit-cookies"
+  arachni_cmd_str = "#{arachni_cmd_str} --report-save-path=#{output_dir}/arachni_results.afr"
+  arachni_cmd_str = "#{arachni_cmd_str} --http-proxy #{proxy}" if proxy
+  arachni_cmd_str = "#{arachni_cmd_str} --http-proxy-type #{proxy_type}" if proxy_type
+  arachni_cmd_str = "#{arachni_cmd_str} --http-cookie-string='#{http_cookie_header}'" if navigation_instruct
+  arachni_cmd_str = "#{arachni_cmd_str} --audit-headers --audit-with-both-methods --audit-cookies-extensively" if deep_scan
+
+  if exclude_pattern
+    exclude_pattern.to_s.split(',').each do |exclude_entry|
+      arachni_cmd_str = "#{arachni_cmd_str} --scope-exclude-pattern #{exclude_entry}"
+    end
+  end
+
+  # Kick off scan as defined by pwn_arachni flags
+  system("sudo /bin/bash --login -c \"#{arachni_cmd_str}\"")
+
+  # Report Scan Results
+  system("sudo /bin/bash --login -c \"arachni_reporter #{output_dir}/arachni_results.afr --reporter=html:outfile=#{output_dir}/arachni_results.html.zip\"")
+  system("sudo /bin/bash --login -c \"arachni_reporter #{output_dir}/arachni_results.afr --reporter=json:outfile=#{output_dir}/arachni_results.json\"")
+
+  # Unzip Results in Output Dir
+  system("sudo /bin/bash --login -c \"cd #{output_dir} && unzip -o arachni_results.html.zip\"")
+rescue StandardError, SystemExit, Interrupt => e
+  raise e
+ensure
+  browser = PWN::Plugins::TransparentBrowser.close(browser_obj: browser) unless browser.nil?
+end