pwn 0.4.476 → 0.4.477

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ef8af0c110613df805e43c7194ba3c2583c7e18b1d6c0a214f693a3d8b5d8f8
-  data.tar.gz: 646b090115b4f9180d26f14222d1fea8ad57b31b083e38ae71ffeaa44aa62273
+  metadata.gz: 12b3517ec1a98f073c21f689d8f0812da237bd0d2715956afe5de02e69a1c9f9
+  data.tar.gz: e7a84eaaee6639f4241bd08a0ceee50745f55f89cd348744fb2daa7e5881017a
 SHA512:
-  metadata.gz: cab4b7f4c5a4e4c1b03a4f2d79ab502a9a4472589631485b3022ef59396d75b143f4c58b9e82a78f508f00cabe4108f218edc95483f67ae992f31f3965d5d4e5
-  data.tar.gz: 2fc157515f103b9869314c6fead5d88c5de7464e472ef2555e29d97f38558f0c2962ec4ac7166e7d8654e2be75bdbf85e08ee3d09f18e4c186c6c96959b8c51a
+  metadata.gz: 25c56b798321a8fdf4c840b99ccf3c09819eb9493fea94305d5dd7a3425284b423155e741e7c5329a9af1f0c0b14831779a8e1238fcde5503514b7dcbd130d91
+  data.tar.gz: 830e16467f649042771d4ebe0fb8318af2abdc4ed8ab7cf7771c110c020569ebe2ff6c4be28d719e3ab00a0ffe834b004836b723e11ad0acaf17df7c87aef32c

data/Gemfile

@@ -59,7 +59,7 @@ gem 'rex', '2.0.13'
 gem 'rmagick', '4.2.5'
 gem 'rspec', '3.11.0'
 gem 'rtesseract', '3.1.2'
-gem 'rubocop', '1.30.0'
+gem 'rubocop', '1.30.1'
 gem 'rubocop-rake', '0.6.0'
 gem 'rubocop-rspec', '2.11.1'
 gem 'ruby-audio', '1.6.1'
@@ -70,7 +70,7 @@ gem 'savon', '2.12.1'
 gem 'selenium-devtools', '0.102.0'
 gem 'serialport', '1.3.2'
 gem 'sinatra', '2.2.0'
-gem 'slack-ruby-client', '1.0.0'
+gem 'slack-ruby-client', '1.1.0'
 gem 'socksify', '1.7.1'
 gem 'spreadsheet', '1.3.0'
 gem 'sqlite3', '1.4.2'

data/README.md

@@ -37,7 +37,7 @@ $ rvm use ruby-3.1.2@pwn
 $ rvm list gemsets
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.476]:001 >>> PWN.help
+pwn[v0.4.477]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.1.2@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.4.476]:001 >>> PWN.help
+pwn[v0.4.477]:001 >>> PWN.help
 ```
 
 

data/bin/pwn_serial_msr206

@@ -15,7 +15,7 @@ OptionParser.new do |options|
     opts[:block_dev] = d
   end
 
-  options.on('-bBAUD', '--baud=BAUD', '<Optional - (defaults to 9600)>') do |b|
+  options.on('-bBAUD', '--baud=BAUD', '<Optional - (defaults to 9_600)>') do |b|
     opts[:baud] = b
   end
 
@@ -31,7 +31,7 @@ OptionParser.new do |options|
     opts[:parity] = p
   end
 
-  options.on('-fFLOWCTRL', '--flow-control=FLOWCTRL', '<Optional - none||hard||soft (defaults to none)>') do |f|
+  options.on('-fFLOWCTRL', '--flow-control=FLOWCTRL', '<Optional - none||hard||soft (defaults to soft)>') do |f|
     opts[:flow_control] = f
   end
 end.parse!
@@ -68,6 +68,13 @@ begin
     cmd: :simulate_power_cycle_warm_reset
   )
 
+  # Unsure if this switches the protocol from USI0 to USI1
+  # exec_resp = PWN::Plugins::MSR206.exec(
+  #   msr206_obj: msr206_obj,
+  #   cmd: :proto_usi1
+  # )
+  # puts exec_resp.inspect
+
   # TODO: Parse Binary Bits to Derive Readable Configuration
   # e.g. 'Read & Write All Three Tracks' if binary_resp == '11101111'
   # Probably better to split each bit and then evaluate
@@ -87,7 +94,7 @@ begin
     msr206_obj: msr206_obj,
     cmd: :configuration_request
   )
-  puts "Configuration Bits: #{exec_resp[:binary].first}"
+  puts "Configuration Bits: #{exec_resp[:binary].first.reverse}"
 
   exec_resp = PWN::Plugins::MSR206.exec(
     msr206_obj: msr206_obj,
@@ -121,14 +128,14 @@ begin
     when :R
       menu_msg = 'READY TO READ - PLEASE SWIPE CARD'
       # Read Card
-      track_data = PWN::Plugins::MSR206.wait_for_swipe(
+      track_data = PWN::Plugins::MSR206.read_card(
         msr206_obj: msr206_obj,
         type: :arm_to_read
       )
     when :C
       menu_msg = 'READY TO COPY - PLEASE SWIPE ORIGINAL CARD'
       # Read Original Card
-      track_data = PWN::Plugins::MSR206.wait_for_swipe(
+      track_data = PWN::Plugins::MSR206.read_card(
         msr206_obj: msr206_obj,
         type: :arm_to_read
       )
@@ -139,7 +146,7 @@ begin
     when :E
       menu_msg = 'READY TO EDIT - PLEASE SWIPE TARGET CARD'
       # Read Target Card
-      track_data = PWN::Plugins::MSR206.wait_for_swipe(
+      track_data = PWN::Plugins::MSR206.read_card(
         msr206_obj: msr206_obj,
         type: :arm_to_read
       )
@@ -149,8 +156,8 @@ begin
       # read edited card to verify successful write
     when :B
       menu_msg = 'READY TO BACKUP - PLEASE SWIPE CARD'
-      # Read Card
-      track_data = PWN::Plugins::MSR206.wait_for_swipe(
+      # Read Card to Backup
+      track_data = PWN::Plugins::MSR206.read_card(
         msr206_obj: msr206_obj,
         type: :arm_to_read
       )

data/lib/pwn/plugins/msr206.rb

@@ -12,7 +12,7 @@ module PWN
       #   data_bits: 'optional - (defaults to 8)',
       #   stop_bits: 'optional - (defaults to 1)',
       #   parity: 'optional - :even|:mark|:odd|:space|:none (defaults to :none),'
-      #   flow_control: 'optional - :none||:hard||:soft (defaults to :none)'
+      #   flow_control: 'optional - :none|:hard|:soft (defaults to :soft)'
       # )
 
       public_class_method def self.connect(opts = {})
@@ -22,7 +22,7 @@ module PWN
         opts[:data_bits] = 8 unless opts[:data_bits]
         opts[:stop_bits] = 1 unless opts[:stop_bits]
         opts[:parity] = :none unless opts[:parity]
-        opts[:flow_control] = :none unless opts[:flow_control]
+        opts[:flow_control] = :soft unless opts[:flow_control]
         msr206_obj = PWN::Plugins::Serial.connect(opts)
       rescue StandardError => e
         disconnect(msr206_obj: msr206_obj) unless msr206_obj.nil?
@@ -34,6 +34,8 @@ module PWN
       public_class_method def self.list_cmds
         # Returns an Array of Symbols
         cmds = %i[
+          proto_usi0
+          proto_usi1
           version_report
           simulate_power_cycle_warm_reset
           configuration_request
@@ -319,7 +321,7 @@ module PWN
         binary_byte_arr = []
         if raw_byte_arr
           raw_byte_arr.first.split.each do |byte_str|
-            binary_byte_arr.push([byte_str].pack('H*').unpack1('B*').reverse)
+            binary_byte_arr.push([byte_str].pack('H*').unpack1('B*'))
           end
         end
 
@@ -336,6 +338,7 @@ module PWN
       private_class_method def self.parse_responses(opts = {})
         msr206_obj = opts[:msr206_obj]
         cmd = opts[:cmd]
+        cmd_bytes = opts[:cmd_bytes]
 
         keep_parsing_responses = true
         next_response_detected = false
@@ -343,22 +346,28 @@ module PWN
         response[:cmd] = cmd
         response[:cmd] ||= :na
 
+        if cmd_bytes.instance_of?(Array)
+          response[:cmd_bytes] = opts[:cmd_bytes].map do |base10_int|
+            "0x#{base10_int.to_s(16).rjust(2, '0')}"
+          end
+        end
+        response[:cmd_bytes] ||= :na
+
         raw_byte_arr = []
-        a_cmd_r_len = 0
-        last_a_cmd_r_len = 0
+        raw_byte_arr_len = 0
+        last_raw_byte_arr_len = 0
 
         parsed_cmd_resp_arr = []
-        bytes_in_cmd_resp = 0
         cmd_resp = ''
 
         while keep_parsing_responses
           until next_response_detected
+            last_raw_byte_arr_len = raw_byte_arr_len
             raw_byte_arr = PWN::Plugins::Serial.response(serial_obj: msr206_obj)
             cmd_resp = raw_byte_arr.last
-            bytes_in_cmd_resp = cmd_resp.split.length if cmd_resp
-            a_cmd_r_len = raw_byte_arr.length
+            raw_byte_arr_len = raw_byte_arr.length
 
-            next_response_detected = true if a_cmd_r_len > last_a_cmd_r_len
+            next_response_detected = true if raw_byte_arr_len > last_raw_byte_arr_len
           end
 
           case cmd_resp
@@ -393,11 +402,11 @@ module PWN
           when '7E'
             response[:msg] = :command_not_supported_by_hardware
           else
-            response[:msg] = :na
+            response[:msg] = :data
           end
 
           next_response_detected = false
-          last_a_cmd_r_len = a_cmd_r_len
+          last_raw_byte_arr_len = raw_byte_arr_len
           keep_parsing_responses = false
         end
 
@@ -421,10 +430,15 @@ module PWN
       public_class_method def self.exec(opts = {})
         msr206_obj = opts[:msr206_obj]
         cmd = opts[:cmd].to_s.scrub.strip.chomp
-        params = opts[:params].to_s.scrub.strip.chomp
+        params = opts[:params]
+        raise 'ERROR: params argument must be a byte array (e.g. [0x41]).' if params && !params.instance_of?(Array)
 
         params_bytes = []
         case cmd.to_sym
+        when :proto_usi0
+          cmd_bytes = [0x55, 0x53, 0x49, 0x30]
+        when :proto_usi1
+          cmd_bytes = [0x55, 0x53, 0x49, 0x31]
         when :resume_transmission_to_host
           cmd_bytes = [0x11]
         when :pause_transmission_to_host
@@ -459,11 +473,11 @@ module PWN
           cmd_bytes = [0x42]
         when :load_iso_std_data_for_writing_track3
           cmd_bytes = [0x43]
-        when :tx_custom_data_forward_track1, :load_custom_data_for_writing_track1
+        when :load_custom_data_for_writing_track1
           cmd_bytes = [0x45]
-        when :tx_custom_data_forward_track2, :load_custom_data_for_writing_track2
+        when :load_custom_data_for_writing_track2
           cmd_bytes = [0x46]
-        when :tx_custom_data_forward_track3, :load_custom_data_for_writing_track3
+        when :load_custom_data_for_writing_track3
           cmd_bytes = [0x47]
         when :tx_error_data
           cmd_bytes = [0x49]
@@ -485,6 +499,12 @@ module PWN
           cmd_bytes = [0x52]
         when :tx_iso_std_data_track3
           cmd_bytes = [0x53]
+        when :tx_custom_data_forward_track1
+          cmd_bytes = [0x55]
+        when :tx_custom_data_forward_track2
+          cmd_bytes = [0x56]
+        when :tx_custom_data_forward_track3
+          cmd_bytes = [0x57]
         when :tx_passbook_data
           cmd_bytes = [0x58]
         when :arm_to_write_no_raw
@@ -532,7 +552,7 @@ module PWN
         end
 
         # If parameters to a command are set, append them.
-        cmd_bytes += params_bytes unless params_bytes.empty?
+        cmd_bytes += params if params
         # Execute the command.
         PWN::Plugins::Serial.request(
           serial_obj: msr206_obj,
@@ -543,7 +563,8 @@ module PWN
         # Return an array of hashes.
         parse_responses(
           msr206_obj: msr206_obj,
-          cmd: cmd.to_sym
+          cmd: cmd.to_sym,
+          cmd_bytes: cmd_bytes
         )
       rescue StandardError => e
         raise e
@@ -553,25 +574,16 @@ module PWN
       end
 
       # Supported Method Parameters::
-      # PWN::Plugins::MSR206.wait_for_swipe(
+      # wait_for_swipe(
       #   msr206_obj: 'required - msr206_obj returned from #connect method'
-      #   type: 'required - swipe type'
+      #   type: 'required - swipe type :arm_to_read || :arm_to_read_w_speed_prompts || :arm_to_write_no_raw || :arm_to_write_with_raw || :arm_to_write_with_raw_speed_prompts',
+      #   encoding: required - :iso || :iso_alt || :raw'
       # )
 
-      public_class_method def self.wait_for_swipe(opts = {})
+      private_class_method def self.wait_for_swipe(opts = {})
         msr206_obj = opts[:msr206_obj]
         type = opts[:type].to_s.scrub.strip.chomp.to_sym
-        types_arr = %i[
-          arm_to_read
-          arm_to_read_w_speed_prompts
-          arm_to_write_no_raw
-          arm_to_write_with_raw
-          arm_to_write_with_raw_speed_prompts
-        ]
-
-        raise "ERROR Unsupported type in #wait_for_swipe - #{type}. Valid types:\n#{types_arr}" unless types_arr.include?(type)
-
-        track_data = {}
+        encoding = opts[:encoding].to_s.scrub.strip.chomp.to_sym
 
         exec_resp = exec(
           msr206_obj: msr206_obj,
@@ -583,11 +595,6 @@ module PWN
           cmd: :yellow_off
         )
 
-        exec_resp = PWN::Plugins::MSR206.exec(
-          msr206_obj: msr206_obj,
-          cmd: type
-        )
-
         exec_resp = exec(
           msr206_obj: msr206_obj,
           cmd: :green_on
@@ -595,77 +602,110 @@ module PWN
 
         exec_resp = PWN::Plugins::MSR206.exec(
           msr206_obj: msr206_obj,
-          cmd: :card_edge_detect
+          cmd: type
         )
 
         print 'Ready.  Please Swipe Card Now:'
         loop do
           exec_resp = parse_responses(
             msr206_obj: msr206_obj,
-            cmd: :card_edge_detect
+            cmd: type
           )
 
           break if exec_resp[:msg] == :ack_command_completed
         end
 
-        puts "\n*** ISO Track Format: Standard #{'*' * 17}"
-        print 'TRACK 1 >>> '
-        exec_resp = exec(
-          msr206_obj: msr206_obj,
-          cmd: :tx_iso_std_data_track1
-        )
-        puts exec_resp[:decoded]
-        puts exec_resp.inspect
-        track_data[:track1] = exec_resp
-
-        # (1..3).each do |n|
-        #   print ">> Track 1 (ALT DATA) ISO Track Format: #{n}\n"
-        #   exec_resp = exec(
-        #     msr206_obj: msr206_obj,
-        #     cmd: :alt_tx_iso_std_data_track1,
-        #     params: [n.to_s]
-        #   )
-        #   puts exec_resp.inspect
-        # end
-
-        print "\nTRACK 2 >>> "
-        exec_resp = exec(
-          msr206_obj: msr206_obj,
-          cmd: :tx_iso_std_data_track2
-        )
-        puts exec_resp[:decoded]
-        puts exec_resp.inspect
-        track_data[:track2] = exec_resp
-
-        # (1..3).each do |n|
-        #   print ">> Track 2 (ALT DATA) ISO Track Format: #{n}\n"
-        #   exec_resp = exec(
-        #     msr206_obj: msr206_obj,
-        #     cmd: :alt_tx_iso_std_data_track2,
-        #     params: [n.to_s]
-        #   )
-        #   puts exec_resp.inspect
-        # end
-
-        print "\nTRACK 3 >>> "
-        exec_resp = exec(
-          msr206_obj: msr206_obj,
-          cmd: :tx_iso_std_data_track3
-        )
-        puts exec_resp[:decoded]
-        puts exec_resp.inspect
-        track_data[:track3] = exec_resp
-
-        # (1..3).each do |n|
-        #   print ">> Track 3 (ALT DATA) ISO Track Format: #{n}\n"
-        #   exec_resp = exec(
-        #     msr206_obj: msr206_obj,
-        #     cmd: :alt_tx_iso_std_data_track3,
-        #     params: [n.to_s]
-        #   )
-        #   puts exec_resp.inspect
-        # end
-        track_data
+        track_data_arr = []
+
+        case type
+        when :arm_to_read,
+             :arm_to_read_w_speed_prompts
+
+          if encoding == :iso
+            cmds_arr = %i[
+              tx_iso_std_data_track1
+              tx_iso_std_data_track2
+              tx_iso_std_data_track3
+            ]
+            cmds_arr.each do |cmd|
+              puts "\n*** #{cmd.to_s.gsub('_', ' ').upcase} #{'*' * 17}"
+              exec_resp = exec(
+                msr206_obj: msr206_obj,
+                cmd: cmd
+              )
+              puts exec_resp[:decoded]
+              puts exec_resp.inspect
+              track_data_arr.push(exec_resp)
+            end
+          end
+
+          if encoding == :iso_alt
+            cmds_arr = %i[
+              alt_tx_iso_std_data_track1
+              alt_tx_iso_std_data_track2
+              alt_tx_iso_std_data_track3
+            ]
+
+            cmds_arr.each do |cmd|
+              params_arr = [0x31, 0x32, 0x33]
+              params_arr.each do |param|
+                puts "\n*** #{cmd.to_s.gsub('_', ' ').upcase} #{'*' * 17}"
+                exec_resp = exec(
+                  msr206_obj: msr206_obj,
+                  cmd: cmd,
+                  params: [param]
+                )
+                puts exec_resp[:decoded]
+                puts exec_resp.inspect
+                track_data_arr.push(exec_resp)
+              end
+            end
+          end
+
+          if encoding == :raw
+            cmds_arr = %i[
+              tx_custom_data_forward_track1
+              tx_custom_data_forward_track2
+              tx_custom_data_forward_track3
+            ]
+
+            cmds_arr.each do |cmd|
+              params_arr = [0x33, 0x34, 0x35, 0x36, 0x37]
+              params_arr.each do |param|
+                puts "\n*** #{cmd.to_s.gsub('_', ' ').upcase} #{'*' * 17}"
+                # 2 byte command
+                exec_resp = exec(
+                  msr206_obj: msr206_obj,
+                  cmd: cmd,
+                  params: [param]
+                )
+                puts exec_resp[:decoded]
+                puts exec_resp.inspect
+                track_data_arr.push(exec_resp)
+
+                # 3 byte command
+                exec_resp = exec(
+                  msr206_obj: msr206_obj,
+                  cmd: cmd,
+                  params: [0x5f] + [param]
+                )
+                puts exec_resp[:decoded]
+                puts exec_resp.inspect
+                track_data_arr.push(exec_resp)
+              end
+            end
+          end
+        when :arm_to_write_no_raw,
+             :arm_to_write_with_raw,
+             :arm_to_write_with_raw_speed_prompts
+
+          cmds_arr = %i[
+          ]
+        else
+          raise "ERROR Unsupported type in #wait_for_swipe - #{type}"
+        end
+
+        track_data_arr
       rescue StandardError => e
         raise e
       ensure
@@ -675,6 +715,47 @@ module PWN
         )
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::MSR206.read_card(
+      #   msr206_obj: 'required - msr206_obj returned from #connect method'
+      #   type: 'required - swipe type :arm_to_read || :arm_to_read_w_speed_prompts || :arm_to_write_no_raw || :arm_to_write_with_raw || :arm_to_write_with_raw_speed_prompts',
+      # )
+
+      public_class_method def self.read_card(opts = {})
+        msr206_obj = opts[:msr206_obj]
+        type = opts[:type].to_s.scrub.strip.chomp.to_sym
+
+        encoding = :waiting_for_selection
+        loop do
+          puts "\nENCODING OPTIONS:"
+          puts '[(I)SO Standard]'
+          puts '[(A)LT ISO Standard]'
+          puts '[(R)aw]'
+          print 'ENCODING TYPE >>> '
+          encoding_choice = gets.scrub.chomp.strip.upcase.to_sym
+
+          case encoding_choice
+          when :I
+            encoding = :iso
+            break
+          when :A
+            encoding = :iso_alt
+            break
+          when :R
+            encoding = :raw
+            break
+          end
+        end
+
+        wait_for_swipe(
+          msr206_obj: msr206_obj,
+          type: type,
+          encoding: encoding
+        )
+      rescue StandardError => e
+        raise e
+      end
+
       # Supported Method Parameters::
       # PWN::Plugins::MSR206.disconnect(
       #   msr206_obj: 'required - msr206_obj returned from #connect method'
@@ -706,7 +787,7 @@ module PWN
             data_bits: 'optional (defaults to 8)',
             stop_bits: 'optional (defaults to 1)',
             parity: 'optional - :even|:mark|:odd|:space|:none (defaults to :none),'
-            flow_control: 'optional - :none||:hard||:soft (defaults to :none)'
+            flow_control: 'optional - :none|:hard|:soft (defaults to :none)'
           )
 
           cmds = #{self}.list_cmds

data/lib/pwn/plugins/serial.rb

@@ -44,7 +44,7 @@ module PWN
                       opts[:stop_bits].to_i
                     end
 
-        case opts[:parity]
+        case opts[:parity].to_s.to_sym
         when :even
           parity = SerialPort::EVEN
         when :mark
@@ -57,7 +57,7 @@ module PWN
           parity = SerialPort::NONE
         end
 
-        case opts[:flow_control]
+        case opts[:flow_control].to_s.to_sym
         when :hard
           flow_control = SerialPort::HARD
         when :soft

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.4.476'
+  VERSION = '0.4.477'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.4.476
+  version: 0.4.477
 platform: ruby
 authors:
 - 0day Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-06-04 00:00:00.000000000 Z
+date: 2022-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -674,14 +674,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.30.0
+        version: 1.30.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.30.0
+        version: 1.30.1
 - !ruby/object:Gem::Dependency
   name: rubocop-rake
   requirement: !ruby/object:Gem::Requirement
@@ -828,14 +828,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.1.0
 - !ruby/object:Gem::Dependency
   name: socksify
   requirement: !ruby/object:Gem::Requirement