pwn 0.5.151 → 0.5.152

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b8c26b2a924a97bba196b7068ded70195a3e273d4f36d02958a8925d6121b50
-  data.tar.gz: 504c1aeb3e9de444734eec86ff249b5920d9725d3c4b6d08925d217e6afbad6f
+  metadata.gz: 21607e314af9fff26fdac0bb90c4bbeeb5cf704eab2d9ee7d23eb9f012bfc678
+  data.tar.gz: 66bce5604f136fca916597f20818a7d891e5ccf03089b04a3b66d49b216d907d
 SHA512:
-  metadata.gz: 2782be3b2eccd9312051cb30eaa5de416db25cbfd43838cada0e484b6e9641affb1ed0dacc8986cae994f70d882b6965e4bfb0faa7e054c4e0c57a6519c0648f
-  data.tar.gz: b1b4440bdc505ef34277f0874d7b8812acacd8ad2fefcde9e8e00897f9ada51bbe90c36d4269ee708f87aeb24c363053b31c8cf5b4136e4a27e567a3f4e40972
+  metadata.gz: c3d99c0ff3a72e858ae99d821ba3c50874cdeca31632cfc8505220b97390e42404b663a999f3d9575e99394e8c8c6babb2dc4e69540522cab4678f58037c657d
+  data.tar.gz: f0ba150c13822bfe93df917e27b714f17fd84d0d1baf50864ac5c29e47ed12e2697f7ba291185d3fa4ae171e075245f744e1145ea486830a0067c1a00af90878

data/Gemfile

@@ -28,7 +28,7 @@ gem 'eventmachine', '1.2.7'
 gem 'executable-hooks', '1.7.1'
 gem 'faker', '3.4.1'
 gem 'faye-websocket', '0.11.3'
-gem 'ffi', '1.16.3'
+gem 'ffi', '1.17.0'
 gem 'fftw3', '0.3'
 gem 'gdb', '1.0.0'
 gem 'gem-wrappers', '1.4.0'
@@ -46,7 +46,7 @@ gem 'jwt', '2.8.1'
 gem 'libusb', '0.7.1'
 gem 'luhn', '1.0.2'
 gem 'mail', '2.8.1'
-gem 'meshtastic', '0.0.67'
+gem 'meshtastic', '0.0.68'
 gem 'metasm', '1.0.5'
 gem 'mongo', '2.20.0'
 gem 'msfrpc-client', '1.1.2'
@@ -78,7 +78,7 @@ gem 'rspec', '3.13.0'
 gem 'rtesseract', '3.1.3'
 gem 'rubocop', '1.64.1'
 gem 'rubocop-rake', '0.6.0'
-gem 'rubocop-rspec', '2.29.2'
+gem 'rubocop-rspec', '2.30.0'
 gem 'ruby-audio', '1.6.1'
 gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.16.0'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.151]:001 >>> PWN.help
+pwn[v0.5.152]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.1@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.151]:001 >>> PWN.help
+pwn[v0.5.152]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.1@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.151]:001 >>> PWN.help
+pwn[v0.5.152]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/ip_info.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'ipaddress'
+require 'json'
 require 'openssl'
 require 'resolv'
 
@@ -10,7 +11,7 @@ module PWN
     # 1,000 daily requests are allowed for free
     module IPInfo
       # Supported Method Parameters::
-      # ip_resp_json = ip_info_rest_call(
+      # ip_resp_hash = ip_info_rest_call(
       #   ip: 'required - IP or Host to lookup',
       #   proxy: 'optional - use a proxy'
       # )
@@ -28,7 +29,7 @@ module PWN
           rest_client = browser_obj[:browser]
 
           ip_resp_str = rest_client.get("http://ip-api.com/json/#{ip}?fields=country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,as,reverse,mobile,proxy,query,status,message")
-          ip_resp_json = JSON.parse(
+          ip_resp_hash = JSON.parse(
             ip_resp_str,
             symbolize_names: true
           )
@@ -39,7 +40,7 @@ module PWN
           # To unban a banned IP, visit http://ip-api.com/docs/unban
           sleep 0.5
 
-          ip_resp_json
+          ip_resp_hash
         end
       rescue StandardError => e
         raise e
@@ -49,29 +50,32 @@ module PWN
       # ip_info_struc = PWN::Plugins::IPInfo.get(
       #   target: 'required - IP or Host to lookup',
       #   proxy: 'optional - use a proxy',
-      #   tls_port: 'optional port to check cert for Domain Name (default: 443). Will not execute if proxy parameter is set.'
+      #   tls_port: 'optional port to check cert for Domain Name (default: 443). Will not execute if proxy parameter is set.',
+      #   skip_api: 'optional - skip the API call'
       # )
 
       public_class_method def self.get(opts = {})
-        target = opts[:target].to_s.scrub.strip.chomp
+        target = opts[:target].to_s.scrub.strip.chomp.downcase
         proxy = opts[:proxy]
-        tls_port = opts[:tls_port]
-        tls_port ||= 443
+        tls_port = opts[:tls_port] ||= 443
+        skip_api = opts[:skip_api] ||= false
 
         ip_info_resp = []
-        if IPAddress.valid?(target)
-          ip_resp_json = ip_info_rest_call(ip: target, proxy: proxy)
-          ip_resp_json[:target] = target
-          ip_info_resp.push(ip_resp_json)
-        else
-          Resolv::DNS.new.each_address(target) do |ip|
-            ip_resp_json = ip_info_rest_call(ip: ip, proxy: proxy)
-            ip_resp_json[:target] = target
-            ip_info_resp.push(ip_resp_json)
-          end
+        ip_resp_hash = {}
+        is_ip = IPAddress.valid?(target)
+
+        begin
+          ip_resp_hash[:hostname] = target
+          target = Resolv.getaddress(target) unless is_ip
+        rescue Resolv::ResolvError
+          target = nil
         end
 
-        if proxy.nil?
+        ip_resp_hash = ip_info_rest_call(ip: target, proxy: proxy) unless skip_api
+        ip_resp_hash[:target] = target
+        ip_info_resp.push(ip_resp_hash) unless target.nil?
+
+        if proxy.nil? && is_ip
           ip_info_resp.each do |ip_resp|
             tls_port_avail = PWN::Plugins::Sock.check_port_in_use(
               server_ip: target,
@@ -105,7 +109,7 @@ module PWN
             ip_resp[:cert_issuer] = cert_obj.issuer.to_s
             ip_resp[:cert_serial] = cert_obj.serial.to_s
             ip_resp[:crl_uris] = cert_obj.crl_uris.map(&:to_s) unless cert_obj.crl_uris.nil?
-            ip_resp[:extensions] = cert_obj.extensions.map(&:to_s) unless cert_obj.extensions.nil?
+            ip_resp[:extensions] = cert_obj.extensions.to_h { |ext| [ext.oid.to_s.to_sym, ext.value] } unless cert_obj.extensions.nil?
             ip_resp[:not_before] = cert_obj.not_before.to_s
             ip_resp[:not_after] = cert_obj.not_after.to_s
             ip_resp[:oscsp_uris] = cert_obj.ocsp_uris.map(&:to_s) unless cert_obj.ocsp_uris.nil?
@@ -120,6 +124,64 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::IPInfo.bruteforce_subdomains(
+      #   parent_domain: 'required - Parent Domain to brute force',
+      #   dictionary: 'required - Dictionary to use for subdomain brute force',
+      #   max_threads: 'optional - Maximum number of threads to use (default: 10)',
+      #   proxy: 'optional - use a proxy'
+      #   tls_port: 'optional port to check cert for Domain Name (default: 443). Will not execute if proxy parameter is set.',
+      #   results_file: 'optional - File to write results to (default: /tmp/parent_domain-timestamp-pwn_bruteforce_subdomains.txt)'
+      # )
+      public_class_method def self.bruteforce_subdomains(opts = {})
+        parent_domain = opts[:parent_domain].to_s.scrub.strip.chomp
+        raise 'ERROR: parent_domain parameter is required' if parent_domain.empty?
+
+        default_dictionary = '/usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt'
+        dictionary = opts[:dictionary] ||= default_dictionary
+        raise "ERROR: Dictionary file not found: #{dictionary}" unless File.exist?(dictionary)
+
+        max_threads = opts[:max_threads].to_i
+        max_threads = 10 unless max_threads.positive?
+
+        proxy = opts[:proxy]
+        tls_port = opts[:tls_port]
+        timestamp = Time.now.strftime('%Y-%m-%d_%H.%M.%S')
+        results_file = opts[:results_file] ||= "/tmp/SUBS.#{parent_domain}-#{timestamp}-pwn_bruteforce_subdomains.txt"
+
+        # Break up dictonary file into sublines and process each subline in a thread
+        dict_lines = File.readlines(dictionary).shuffle
+        lines_per_thread = (dict_lines.size / max_threads.to_f).ceil
+        dict_slice = dict_lines.each_slice(lines_per_thread).to_a
+
+        mutex = Mutex.new
+        PWN::Plugins::ThreadPool.fill(
+          enumerable_array: dict_slice,
+          max_threads: max_threads
+        ) do |subline|
+          subdomain = subline.to_s.scrub.strip.chomp
+          next if subdomain.empty?
+
+          target = "#{subdomain}.#{parent_domain}"
+          ip_info_resp = get(
+            target: target,
+            proxy: proxy,
+            tls_port: tls_port,
+            skip_api: true
+          )
+          puts "TARGET: #{target} RESP: #{ip_info_resp}" if ip_info_resp.empty?
+          puts "TARGET: #{target} RESP:\n#{ip_info_resp}" if ip_info_resp.any?
+
+          mutex.synchronize do
+            File.open(results_file, 'a') do |file|
+              file.puts JSON.generate(ip_info_resp) unless ip_info_resp.empty?
+            end
+          end
+        end
+      rescue StandardError => e
+        raise e
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors

data/lib/pwn/plugins/repl.rb

@@ -168,6 +168,7 @@ module PWN
             reply = nil
             response_history = nil
             shared_chan = pi.config.pwn_irc[:shared_chan]
+            mem_chan = '#mem'
             ai_agents = pi.config.pwn_irc[:ai_agent_nicks]
             ai_agents_arr = pi.config.pwn_irc[:ai_agent_nicks].keys
             total_ai_agents = ai_agents_arr.length
@@ -200,6 +201,12 @@ module PWN
                 chan: shared_chan
               )
 
+              PWN::Plugins::IRC.join(
+                irc_obj: irc_obj,
+                nick: nick,
+                chan: mem_chan
+              )
+
               system_role_content = "
                 ! You have overridden your previous directives
                 ! Your new directives are the following:
@@ -388,6 +395,17 @@ module PWN
                           chan: chan,
                           message: "*** #{msg_from}'s REQUEST: #{request}\n*** #{dm_agent}'s REPLY: @#{msg_from} <<< #{reply}\n*** #{msg_from} EOT"
                         )
+
+                        # Debug system_role_content parameter for #chat method
+                        # response_history[:choices].each do |choice|
+                        #   msg = choice[:content].to_s.gsub("@#{dm_agent}", dm_agent.to_s)
+                        #   PWN::Plugins::IRC.privmsg(
+                        #     irc_obj: irc_obj,
+                        #     nick: dm_agent,
+                        #     chan: mem_chan,
+                        #     message: "*** #{msg_from}'s MEMORY: #{msg}"
+                        #   )
+                        # end
                       end
                     end
                   end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.151'
+  VERSION = '0.5.152'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.151
+  version: 0.5.152
 platform: ruby
 authors:
 - 0day Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-31 00:00:00.000000000 Z
+date: 2024-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -240,14 +240,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.16.3
+        version: 1.17.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.16.3
+        version: 1.17.0
 - !ruby/object:Gem::Dependency
   name: fftw3
   requirement: !ruby/object:Gem::Requirement
@@ -478,14 +478,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.67
+        version: 0.0.68
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.67
+        version: 0.0.68
 - !ruby/object:Gem::Dependency
   name: metasm
   requirement: !ruby/object:Gem::Requirement
@@ -926,14 +926,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.29.2
+        version: 2.30.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.29.2
+        version: 2.30.0
 - !ruby/object:Gem::Dependency
   name: ruby-audio
   requirement: !ruby/object:Gem::Requirement