pwn 0.4.602 → 0.4.604

data/bin/pwn_sast

@@ -0,0 +1,183 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'pwn'
+require 'optparse'
+require 'htmlentities'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-uGITURI', '--uri-source-root=GITURI', '<Required - HTTP URI of Git Repo Scanned e.g. https://github.com/0dayInc/pwn/tree/master>') do |u|
+    opts[:uri_source_root] = u
+  end
+
+  options.on('-dDIR', '--dir-path=DIR', '<Optional - Report Output Directory (Defaults to ".")>') do |d|
+    opts[:dir_path] = d
+  end
+
+  options.on('-tTHREADS', '--max-threads=THREADS', '<Optional # Test Cases to Run Simultaneously (Default 25)>') do |t|
+    opts[:max_threads] = t
+  end
+
+  options.on('-TCASE', '--test-cases=CASE', '<Optional Comma-Delimited Test Cases to Invoke (-l for List)>') do |c|
+    opts[:chosen_test_cases] = c
+  end
+
+  options.on('-l', '--[no-]list-test-cases', '<Optional List Available Test Cases to Invoke and Exit>') do |l|
+    opts[:list_test_cases] = l
+  end
+
+  options.on('-nREPORTNAME', '--report-name=REPORTNAME', '<Optional Report Name (Defaults to, "File.basename(Dir.pwd)")>') do |n|
+    opts[:report_name] = n
+  end
+
+  options.on('-s', '--[no-]start-reporting-server', '<Optional - Start Simple HTTP Server for Reporting>') do |s|
+    opts[:start_reporting_server] = s
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  pwn_provider = 'ruby-gem'
+  pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.keys.select { |s| s == 'PWN_PROVIDER' }.any?
+
+  green = "\e[32m"
+  end_of_color = "\e[0m"
+
+  dir_path = opts[:dir_path]
+  dir_path ||= '.'
+
+  uri_source_root = opts[:uri_source_root].to_s.scrub
+
+  max_threads = opts[:max_threads]
+  max_threads ||= 25
+
+  chosen_test_cases = opts[:chosen_test_cases]
+  list_test_cases = opts[:list_test_cases]
+
+  report_name = opts[:report_name]
+  report_name ||= File.basename(Dir.pwd)
+
+  start_reporting_server = opts[:start_reporting_server]
+
+  # Define Test Cases to Run & Start Thread Pool
+  if chosen_test_cases && !list_test_cases
+    test_cases = chosen_test_cases.to_s.scrub.chomp.strip.delete("\s").split(',').map(&:to_sym)
+  else
+    test_cases = %i[
+      AMQPConnectAsGuest
+      ApacheFileSystemUtilAPI
+      AWS
+      BannedFunctionCallsC
+      Base64
+      BeefHook
+      CmdExecutionJava
+      CmdExecutionPython
+      CmdExecutionRuby
+      CmdExecutionScala
+      CSRF
+      DeserialJava
+      Emoticon
+      Eval
+      Factory
+      HTTPAuthorizationHeader
+      InnerHTML
+      Keystore
+      LocationHash
+      Log4J
+      Logger
+      OuterHTML
+      Password
+      PHPInputMechanisms
+      PHPTypeJuggling
+      PomVersion
+      Port
+      PrivateKey
+      Redirect
+      ReDOS
+      Shell
+      Signature
+      SQL
+      SSL
+      Sudo
+      TaskTag
+      ThrowErrors
+      Token
+      Version
+      WindowLocationHash
+    ]
+  end
+
+  if list_test_cases
+    test_cases.each { |tc| puts "#{green}#{tc}#{end_of_color}" }
+    exit
+  end
+
+  raise "ERROR: Invalid Directory #{dir_path}" unless File.directory?(dir_path)
+
+  results_hash = {
+    report_name: HTMLEntities.new.encode(
+      report_name.to_s.scrub.strip.chomp
+    ),
+    data: []
+  }
+
+  mutex = Mutex.new
+
+  PWN::Plugins::ThreadPool.fill(
+    enumerable_array: test_cases,
+    max_threads: max_threads
+  ) do |test_case|
+    sca_arr = PWN::SAST.const_get(
+      test_case.to_s.scrub
+    ).scan(
+      dir_path: dir_path,
+      git_repo_root_uri: uri_source_root
+    )
+
+    sca_arr.each do |hash_line|
+      mutex.synchronize do
+        results_hash[:data].push(hash_line)
+      end
+    end
+  end
+
+  # Generate HTML Report
+  print "#{$PROGRAM_NAME} Generating Report..."
+  PWN::Reports::SAST.generate(
+    dir_path: dir_path,
+    results_hash: results_hash
+  )
+  puts 'complete.'
+
+  # Start Simple HTTP Server (If Requested)
+  if start_reporting_server
+    listen_port = Random.rand(1_025..65_535).to_s
+
+    if pwn_provider == 'docker'
+      listen_ip = '0.0.0.0'
+    else
+      listen_ip = '127.0.0.1'
+    end
+
+    puts "For Scan Results Navigate to: http://127.0.0.1:#{listen_port}/pwn_scan_git_source.html"
+    Dir.chdir(dir_path)
+    system(
+      'pwn_simple_http_server',
+      '-i',
+      listen_ip,
+      '-p',
+      listen_port
+    )
+  end
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+end

data/bin/pwn_serial_check_voicemail

@@ -0,0 +1,66 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'optparse'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-vNUM', '--voicemail_num=num', '<Required - Number to Voicemail Service>') do |num|
+    opts[:voicemail_num] = num
+  end
+  options.on('-pPIN', '--voicemail_pin=PIN', '<Optional - Voicemail Pin (Prompts if Ommitted>') do |pin|
+    opts[:voicemail_pin] = pin
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+voicemail_num = opts[:voicemail_num].to_s.scrub.strip.chomp.delete('-').delete('.').to_i
+
+if opts[:voicemail_pin].nil?
+  voicemail_pin = PWN::Plugins::AuthenticationHelper.mask_password.to_s.scrub
+else
+  voicemail_pin = opts[:voicemail_pin].to_s.scrub
+end
+
+serial_obj = PWN::Plugins::Serial.connect
+
+PWN::Plugins::Serial.request(
+  serial_obj: serial_obj,
+  payload: "ATDT#{voicemail_num};\r\n"
+)
+
+# TODO: Loop until data received indicates call picked up instead of sleep
+sleep 13
+
+voicemail_pin.each_char do |pin_char|
+  PWN::Plugins::Serial.request(
+    serial_obj: serial_obj,
+    payload: "AT+VTS=#{pin_char}\r\n"
+  )
+end
+
+PWN::Plugins::Serial.request(
+  serial_obj: serial_obj,
+  payload: "AT+VTS=#\r\n"
+)
+
+PWN::Plugins::Serial.request(
+  serial_obj: serial_obj,
+  payload: "AT+CHUP;\r\n"
+)
+
+session_data = PWN::Plugins::Serial.dump_session_data
+puts '~' * 200
+puts session_data
+puts '~' * 200
+
+PWN::Plugins::Serial.disconnect(serial_obj: serial_obj)

data/bin/pwn_serial_msr206

@@ -0,0 +1,175 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'pwn'
+require 'optparse'
+require 'json'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-dDEV', '--block-dev=DEV', '<Optional - MSR206 block device path (defaults to /dev/ttyUSB0)>') do |d|
+    opts[:block_dev] = d
+  end
+
+  options.on('-bBAUD', '--baud=BAUD', '<Optional - (defaults to 9_600)>') do |b|
+    opts[:baud] = b
+  end
+
+  options.on('-DDATABITS', '--data-bits=DATABITS', '<Optional - (defaults to 8)>') do |d|
+    opts[:data_bits] = d
+  end
+
+  options.on('-sSTOPBITS', '--stop-bits=STOPBITS', '<Optional - (defaults to 1)>') do |s|
+    opts[:stop_bits] = s
+  end
+
+  options.on('-pPARITY', '--parity=PARITY', '<Optional - even|mark|odd|space|none (defaults to none)>') do |p|
+    opts[:parity] = p
+  end
+
+  options.on('-fFLOWCTRL', '--flow-control=FLOWCTRL', '<Optional - none||hard||soft (defaults to soft)>') do |f|
+    opts[:flow_control] = f
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  block_dev = opts[:block_dev] if File.exist?(opts[:block_dev])
+  baud = opts[:baud]
+  data_bits = opts[:data_bits]
+  stop_bits = opts[:stop_bits]
+  parity = opts[:parity]
+  flow_control = opts[:flow_control]
+
+  msr206_obj = PWN::Plugins::MSR206.connect(
+    block_dev: block_dev,
+    baud: baud,
+    data_bits: data_bits,
+    stop_bits: stop_bits,
+    parity: parity,
+    flow_control: flow_control
+  )
+
+  puts "- Welcome to #{File.basename($PROGRAM_NAME)} -"
+  puts "Connected via: #{block_dev} @ #{msr206_obj[:serial_conn].modem_params}"
+  puts "Flow Control: #{msr206_obj[:serial_conn].flow_control}"
+  puts "Signals: #{msr206_obj[:serial_conn].signals}"
+
+  exec_resp = PWN::Plugins::MSR206.exec(
+    msr206_obj: msr206_obj,
+    cmd: :simulate_power_cycle_warm_reset
+  )
+
+  # Unsure if this switches the protocol from USI0 to USI1
+  # exec_resp = PWN::Plugins::MSR206.exec(
+  #   msr206_obj: msr206_obj,
+  #   cmd: :proto_usi1
+  # )
+  # puts exec_resp.inspect
+
+  config_hash = PWN::Plugins::MSR206.get_config(
+    msr206_obj: msr206_obj
+  )
+  puts "Configuration: #{config_hash.inspect}"
+
+  exec_resp = PWN::Plugins::MSR206.exec(
+    msr206_obj: msr206_obj,
+    cmd: :version_report
+  )
+  puts "Firmware Version: #{exec_resp[:decoded]}"
+
+  # Main Menu
+  menu_msg = ''
+  loop do
+    unless menu_msg.include?('ERROR')
+      exec_resp = PWN::Plugins::MSR206.exec(
+        msr206_obj: msr206_obj,
+        cmd: :green_flash
+      )
+    end
+
+    puts "\n>> MAIN MENU OPTIONS:"
+    puts '[(R)ead Card]'
+    puts '[(B)ackup Card]'
+    puts '[(C)opy Card]'
+    puts '[(L)oad Card from File]'
+    puts '[(W)arm Reset]'
+    puts '[(Q)uit]'
+    puts menu_msg
+    print 'MAIN MENU OPTION >>> '
+    menu_msg = ''
+    option = gets.scrub.chomp.strip.upcase.to_sym
+
+    case option
+    when :R
+      menu_msg = 'READ CARD'
+      track_data = PWN::Plugins::MSR206.read_card(
+        msr206_obj: msr206_obj
+      )
+    when :B
+      menu_msg = 'BACKUP CARD TO FILE'
+      track_data = PWN::Plugins::MSR206.backup_card(
+        msr206_obj: msr206_obj
+      )
+    when :C
+      menu_msg = 'COPY CARD'
+      track_data = PWN::Plugins::MSR206.copy_card(
+        msr206_obj: msr206_obj
+      )
+    when :L
+      menu_msg = 'LOAD FROM FILE'
+      track_data = PWN::Plugins::MSR206.load_card_from_file(
+        msr206_obj: msr206_obj
+      )
+    when :W
+      menu_msg = 'WARM RESET'
+      exec_resp = PWN::Plugins::MSR206.exec(
+        msr206_obj: msr206_obj,
+        cmd: :simulate_power_cycle_warm_reset
+      )
+    when :Q
+      exit
+    else
+      menu_msg = '****** ERROR: Invalid Menu Option Selected ******'
+      exec_resp = PWN::Plugins::MSR206.exec(
+        msr206_obj: msr206_obj,
+        cmd: :green_off
+      )
+
+      exec_resp = PWN::Plugins::MSR206.exec(
+        msr206_obj: msr206_obj,
+        cmd: :yellow_flash
+      )
+    end
+  end
+rescue StandardError => e
+  raise e
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+ensure
+  # Lights Off
+  exec_resp = PWN::Plugins::MSR206.exec(
+    msr206_obj: msr206_obj,
+    cmd: :green_off
+  )
+
+  exec_resp = PWN::Plugins::MSR206.exec(
+    msr206_obj: msr206_obj,
+    cmd: :yellow_off
+  )
+
+  exec_resp = PWN::Plugins::MSR206.exec(
+    msr206_obj: msr206_obj,
+    cmd: :red_off
+  )
+
+  msr206_obj = PWN::Plugins::MSR206.disconnect(msr206_obj: msr206_obj) if msr206_obj
+end

data/bin/pwn_serial_qualcomm_commands

@@ -0,0 +1,16 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+serial_obj = PWN::Plugins::Serial.connect
+
+PWN::Plugins::Serial.request(
+  serial_obj: serial_obj,
+  payload: "AT+CLAC\r\n"
+)
+
+session_data = PWN::Plugins::Serial.dump_session_data
+puts session_data
+
+PWN::Plugins::Serial.disconnect(serial_obj: serial_obj)

data/bin/pwn_serial_son_micro_sm132_rfid

@@ -0,0 +1,132 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'pwn'
+require 'optparse'
+require 'json'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-dDEV', '--block-dev=DEV', '<Optional - SonMicroRFID block device path (defaults to /dev/ttyUSB0)>') do |d|
+    opts[:block_dev] = d
+  end
+
+  options.on('-bBAUD', '--baud=BAUD', '<Optional - (defaults to 19_200)>') do |b|
+    opts[:baud] = b
+  end
+
+  options.on('-DDATABITS', '--data-bits=DATABITS', '<Optional - (defaults to 8)>') do |d|
+    opts[:data_bits] = d
+  end
+
+  options.on('-sSTOPBITS', '--stop-bits=STOPBITS', '<Optional - (defaults to 1)>') do |s|
+    opts[:stop_bits] = s
+  end
+
+  options.on('-pPARITY', '--parity=PARITY', '<Optional - even|mark|odd|space|none (defaults to none)>') do |p|
+    opts[:parity] = p
+  end
+
+  options.on('-fFLOWCTRL', '--flow-control=FLOWCTRL', '<Optional - none||hard||soft (defaults to none)>') do |f|
+    opts[:flow_control] = f
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  block_dev = opts[:block_dev] if File.exist?(opts[:block_dev])
+  baud = opts[:baud]
+  data_bits = opts[:data_bits]
+  stop_bits = opts[:stop_bits]
+  parity = opts[:parity]
+  flow_control = opts[:flow_control]
+
+  son_micro_rfid_obj = PWN::Plugins::SonMicroRFID.connect(
+    block_dev: block_dev,
+    baud: baud,
+    data_bits: data_bits,
+    stop_bits: stop_bits,
+    parity: parity,
+    flow_control: flow_control
+  )
+
+  puts "- Welcome to #{File.basename($PROGRAM_NAME)} -"
+  puts "Connected via: #{block_dev} @ #{son_micro_rfid_obj[:serial_conn].modem_params}"
+  puts "Flow Control: #{son_micro_rfid_obj[:serial_conn].flow_control}"
+  puts "Signals: #{son_micro_rfid_obj[:serial_conn].signals}"
+
+  exec_resp = PWN::Plugins::SonMicroRFID.exec(
+    son_micro_rfid_obj: son_micro_rfid_obj,
+    cmd: :firmware
+  )
+
+  firmware_decoded = ''
+  exec_resp.last[:hex_resp].split.each do |byte_str|
+    firmware_decoded += [byte_str].pack('H*')
+  end
+
+  puts "Firmware Version: #{firmware_decoded.scrub.strip.chomp}"
+
+  # Main Menu
+  menu_msg = ''
+  loop do
+    puts "\n>> MAIN MENU OPTIONS:"
+    puts '[(R)ead Card]'
+    puts '[(B)ackup Card]'
+    puts '[(C)opy Card]'
+    puts '[(L)oad Card from File]'
+    puts '[(W)arm Reset]'
+    puts '[(Q)uit]'
+    puts menu_msg
+    print 'MAIN MENU OPTION >>> '
+    menu_msg = ''
+    option = gets.scrub.chomp.strip.upcase.to_sym
+
+    case option
+    when :R
+      menu_msg = 'READ CARD'
+      rfid_data = PWN::Plugins::SonMicroRFID.read_card(
+        son_micro_rfid_obj: son_micro_rfid_obj
+      )
+    when :B
+      menu_msg = 'BACKUP CARD TO FILE'
+      rfid_data = PWN::Plugins::SonMicroRFID.backup_card(
+        son_micro_rfid_obj: son_micro_rfid_obj
+      )
+    when :C
+      menu_msg = 'COPY CARD'
+      rfid_data = PWN::Plugins::SonMicroRFID.copy_card(
+        son_micro_rfid_obj: son_micro_rfid_obj
+      )
+    when :L
+      menu_msg = 'LOAD FROM FILE'
+      rfid_data = PWN::Plugins::SonMicroRFID.load_card_from_file(
+        son_micro_rfid_obj: son_micro_rfid_obj
+      )
+    when :W
+      menu_msg = 'WARM RESET'
+      exec_resp = PWN::Plugins::SonMicroRFID.exec(
+        son_micro_rfid_obj: son_micro_rfid_obj,
+        cmd: :reset
+      )
+    when :Q
+      exit
+    else
+      menu_msg = '****** ERROR: Invalid Menu Option Selected ******'
+    end
+  end
+rescue StandardError => e
+  raise e
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+ensure
+  son_micro_rfid_obj = PWN::Plugins::SonMicroRFID.disconnect(son_micro_rfid_obj: son_micro_rfid_obj) if son_micro_rfid_obj
+end

data/bin/pwn_shodan_search

@@ -0,0 +1,79 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: false
+
+require 'pwn'
+require 'optparse'
+require 'yaml'
+require 'json'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+
+  options.on('-cYAML', '--config-yaml=YAML', '<Required - YAML config containing api_key from Shodan.io>') do |y|
+    opts[:yaml] = y
+  end
+
+  options.on('-qFILE', '--query-file=FILE', '<Required - File containing one Shodan.io query string per line>') do |q|
+    opts[:query_file] = q
+  end
+
+  options.on('-oFILE', '--output-results-file=FILE', '<Optional - Defaults to /tmp/shodan-results-Time.now.strftime("%y-%m-%d.%H:%M:%S").txt>') do |o|
+    opts[:output_results_file] = o
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+begin
+  yaml_file = opts[:yaml].to_s
+  raise "ERROR: #{yaml_file} does not exist." unless File.exist?(yaml_file)
+
+  yaml = YAML.load_file(yaml_file, symbolize_names: true)
+
+  api_key = yaml[:api_key]
+
+  query_file = opts[:query_file].to_s
+  raise "ERROR: #{query_file} does not exist." unless File.exist?(query_file)
+
+  queries = File.readlines(query_file)
+
+  timestamp = Time.now.strftime('%Y-%m-%d.%H:%M:%S')
+  query_results_file = opts[:output_results_file]
+  query_results_file ||= "/tmp/shodan-results-#{timestamp}"
+
+  raw_query_results_file = "#{query_results_file}-RAW.json"
+  raw_results_arr = []
+  File.open(query_results_file, 'w') do |f|
+    queries.each do |query_line|
+      query = query_line.chomp
+      print "QUERY: '#{query}'"
+      f.puts("QUERY: '#{query}'")
+      search_results = PWN::Plugins::Shodan.search(
+        api_key: api_key,
+        query: query
+      )
+      puts " >>> Matches: #{search_results[:total]}"
+
+      raw_results = {}
+      raw_results[:query] = query
+      raw_results[:results] = search_results
+      raw_results_arr.push(raw_results)
+
+      search_results[:matches].select do |m|
+        f.puts "ORG: #{m[:org]} | PUBIP: #{m[:ip_str]} #{'*' * 36}"
+        f.puts "Product: #{m[:product]}"
+        f.puts "TCP Port: #{m[:port]}"
+        f.puts "Data: #{m[:data]}\n\n\n"
+      end
+    end
+  end
+  File.write(raw_query_results_file, JSON.pretty_generate(raw_results_arr))
+rescue SystemExit, Interrupt
+  puts "\nGoodbye."
+end

data/bin/pwn_simple_http_server

@@ -0,0 +1,57 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'optparse'
+
+opts = {}
+OptionParser.new do |options|
+  options.banner = "USAGE:
+    #{$PROGRAM_NAME} [opts]
+  "
+  options.on('-iIP', '--bind-ip=IP', '<Optional - HTTP Bind IP to Listen> (Defaults to Localhost)') do |i|
+    opts[:bind_ip] = i
+  end
+
+  options.on('-pPORT', '--port=PORT', '<Optional - HTTP Port to Listen (Defaults to 3333)>') do |p|
+    opts[:port] = p
+  end
+end.parse!
+
+if opts.empty?
+  puts `#{$PROGRAM_NAME} --help`
+  exit 1
+end
+
+if opts[:bind_ip]
+  bind_ip = opts[:bind_ip]
+else
+  bind_ip = '127.0.0.1'
+end
+
+if opts[:port]
+  port = opts[:port].to_i
+else
+  port = 3333
+end
+
+begin
+  system(
+    'thin',
+    'start',
+    '--adapter',
+    'file',
+    '--address',
+    bind_ip,
+    '--port',
+    port.to_s,
+    '--threaded',
+    '--debug'
+  )
+rescue RuntimeError
+  puts "WARNING: Service Already Listening on TCP #{port}..."
+  port = Random.rand(1_025..65_535)
+  puts "Listen on #{bind_ip}:#{port}..."
+  retry
+rescue SystemExit, Interrupt
+  puts "\n#{File.basename($PROGRAM_NAME)} terminated."
+end