pwn 0.5.301 → 0.5.302

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccbfcfff8dc15fb9976418982c7d3f0c302fc210c57019587ad20b7c5f5dfe54
-  data.tar.gz: 602f258ba2304490e060fb36927164278680da8dfcd381ade3bb121277349b1a
+  metadata.gz: f1fbd47d7c9374e09b1e1d6478921b0e06074db6ba2a9397d4cc4c2ce002dc37
+  data.tar.gz: 7439dd249821d50724cd0170bf12aad128e7fef806a7ff690edcbfec9cb21534
 SHA512:
-  metadata.gz: 0bb149c10dd9dd0d27051d05aef4493f66413f2e0a0641112158d4a4808f24a930224dd0fc42598a8cbaa846f3d0064351a2a5791632db1d5413d9afcb37659c
-  data.tar.gz: c2f60d489791334c2914a7e4ae122b623ef2e96de2bc9e9db7d025b381f612f3f8e5f8ecbf8f70835a12d19236f28a78c689df90cfdd03da2bbf924662276cc9
+  metadata.gz: b53a71b82e5693e00de4ab453594e46c405cff6ff55eff71962ad6ea25f8d0dec2ec27706ca6826d215e15aa62fb9a268b6fba53aeff5961fc3d488222c388e8
+  data.tar.gz: 4a4719c806c9637161d7dfcbade0e0d7a4366525b9224b00217a5527d55cbff32fad3aa96b9576aa0ceeda392cf58db542f71d49fd9168ad95533db8af0f1eb6

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.301]:001 >>> PWN.help
+pwn[v0.5.302]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.301]:001 >>> PWN.help
+pwn[v0.5.302]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.301]:001 >>> PWN.help
+pwn[v0.5.302]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/jira_server.rb

@@ -82,10 +82,15 @@ module PWN
           raise @@logger.error("Unsupported HTTP Method #{http_method} for #{self} Plugin")
         end
 
-        jira_response = response if response.is_a?(RestClient::Response) && response.code == 204
-        jira_response = JSON.parse(response, symbolize_names: true) if response.is_a?(RestClient::Response) && response.code != 204
+        case response.code
+        when 201, 204
+          response = { http_response_code: response.code }
+        else
+          response = JSON.parse(response, symbolize_names: true) if response.is_a?(RestClient::Response)
+          response[:http_response_code] = response.code if response.is_a?(RestClient::Response)
+        end
 
-        jira_response
+        response
       rescue RestClient::ExceptionWithResponse => e
         if e.response
           puts "HTTP BASE URL: #{base_api_uri}"
@@ -219,7 +224,8 @@ module PWN
       #   description: 'optional - description of the issue',
       #   epic_name: 'optional - name of the epic',
       #   additional_fields: 'optional - additional fields to set in the issue (e.g. labels, components, custom fields, etc.)'
-      #   attachment: 'optional - attachment path to upload to the issue (e.g. "/path/to/file1.txt")'
+      #   attachments: 'optional - array of attachment paths to upload to the issue (e.g. ["/tmp/file1.txt", "/tmp/file2.txt"])',
+      #   comment: 'optional - comment to add to the issue (e.g. "This is a comment")'
       # )
 
       public_class_method def self.create_issue(opts = {})
@@ -243,7 +249,10 @@ module PWN
         additional_fields = opts[:additional_fields] ||= { fields: {} }
         raise 'ERROR: additional_fields Hash must contain a :fields key that is also a Hash.' unless additional_fields.is_a?(Hash) && additional_fields.key?(:fields) && additional_fields[:fields].is_a?(Hash)
 
-        attachment = opts[:attachment]
+        attachments = opts[:attachments] ||= []
+        raise 'ERROR: attachments must be an Array.' unless attachments.is_a?(Array)
+
+        comment = opts[:comment]
 
         all_fields = get_all_fields(base_api_uri: base_api_uri, token: token)
         epic_name_field_key = all_fields.find { |field| field[:name] == 'Epic Name' }[:id]
@@ -274,21 +283,39 @@ module PWN
           http_body: http_body
         )
 
-        if attachment
-          raise "ERROR: #{attachment} not found." unless File.exist?(attachment)
+        if attachments.any?
+          issue = issue_resp[:key]
+
+          attachments.each do |attachment|
+            raise "ERROR: #{attachment} not found." unless File.exist?(attachment)
+
+            http_body = {
+              multipart: true,
+              file: File.new(attachment, 'rb')
+            }
+
+            rest_call(
+              http_method: :post,
+              base_api_uri: base_api_uri,
+              token: token,
+              rest_call: "issue/#{issue}/attachments",
+              http_body: http_body
+            )
+          end
+        end
 
+        if comment
           issue = issue_resp[:key]
 
           http_body = {
-            multipart: true,
-            file: File.new(attachment, 'rb')
+            body: comment
           }
 
           rest_call(
             http_method: :post,
             base_api_uri: base_api_uri,
             token: token,
-            rest_call: "issue/#{issue}/attachments",
+            rest_call: "issue/#{issue}/comment",
             http_body: http_body
           )
         end
@@ -303,7 +330,7 @@ module PWN
       #   base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
       #   token: 'required - personal access token',
       #   fields: 'required - fields to update in the issue (e.g. summary, description, labels, components, custom fields, etc.)',
-      #   attachment: 'optional - attachment path to upload to the issue (e.g. "/path/to/file1.txt")'
+      #   attachments: 'optional - array of attachment paths to upload to the issue (e.g. ["/tmp/file1.txt", "/tmp/file2.txt"])',
       # )
 
       public_class_method def self.update_issue(opts = {})
@@ -319,7 +346,8 @@ module PWN
         fields = opts[:fields] ||= { fields: {} }
         raise 'ERROR: fields Hash must contain a :fields key that is also a Hash.' unless fields.is_a?(Hash) && fields.key?(:fields) && fields[:fields].is_a?(Hash)
 
-        attachment = opts[:attachment]
+        attachments = opts[:attachments] ||= []
+        raise 'ERROR: attachments must be an Array.' unless attachments.is_a?(Array)
 
         http_body = fields
 
@@ -331,24 +359,81 @@ module PWN
           http_body: http_body
         )
 
-        if attachment
-          raise "ERROR: #{attachment} not found." unless File.exist?(attachment)
+        if attachments.any?
+          attachments.each do |attachment|
+            raise "ERROR: #{attachment} not found." unless File.exist?(attachment)
+
+            http_body = {
+              multipart: true,
+              file: File.new(attachment, 'rb')
+            }
+
+            rest_call(
+              http_method: :post,
+              base_api_uri: base_api_uri,
+              token: token,
+              rest_call: "issue/#{issue}/attachments",
+              http_body: http_body
+            )
+          end
+        end
 
-          http_body = {
-            multipart: true,
-            file: File.new(attachment, 'rb')
-          }
+        issue_resp
+      rescue StandardError => e
+        raise e
+      end
 
-          rest_call(
-            http_method: :post,
-            base_api_uri: base_api_uri,
-            token: token,
-            rest_call: "issue/#{issue}/attachments",
-            http_body: http_body
-          )
+      # Supported Method Parameters::
+      # issue_resp = PWN::Plugins::JiraServer.issue_comment(
+      #   base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
+      #   token: 'required - personal access token',
+      #   issue: 'required - issue to delete (e.g. Bug, Issue, Story, or Epic ID)',
+      #   comment_action: 'required - action to perform on the issue comment (e.g. :delete, :add, :update - Defaults to :add)',
+      #   comment_id: 'optional - comment ID to delete or update (e.g. 10000)',
+      #   comment: 'optional - comment to add or update in the issue (e.g. "This is a comment")'
+      # )
+
+      public_class_method def self.issue_comment(opts = {})
+        base_api_uri = opts[:base_api_uri]
+
+        token = opts[:token]
+        token ||= PWN::Plugins::AuthenticationHelper.mask_password(
+          prompt: 'Personal Access Token'
+        )
+
+        issue = opts[:issue]
+        raise 'ERROR: issue cannot be nil.' if issue.nil?
+
+        comment_action = opts[:comment_action] ||= :add
+        raise 'ERROR: comment_action must be one of :delete, :add, or :update.' unless %i[delete add update].include?(comment_action)
+
+        comment_id = opts[:comment_id]
+        raise 'ERROR: comment_id cannot be nil when comment_action is :delete or :update.' unless %i[delete update].include?(comment_action) || comment_id.nil?
+
+        comment = opts[:comment].to_s.scrub
+
+        case comment_action
+        when :add
+          http_method = :post
+          rest_call = "issue/#{issue}/comment"
+          http_body = { body: comment }
+        when :delete
+          http_method = :delete
+          rest_call = "issue/#{issue}/comment/#{comment_id}"
+          http_body = nil
+        when :update
+          http_method = :put
+          rest_call = "issue/#{issue}/comment/#{comment_id}"
+          http_body = { body: comment }
         end
 
-        issue_resp
+        rest_call(
+          http_method: http_method,
+          base_api_uri: base_api_uri,
+          token: token,
+          rest_call: rest_call,
+          http_body: http_body
+        )
       rescue StandardError => e
         raise e
       end
@@ -369,7 +454,6 @@ module PWN
         )
 
         issue = opts[:issue]
-
         raise 'ERROR: issue cannot be nil.' if issue.nil?
 
         rest_call(
@@ -382,6 +466,34 @@ module PWN
         raise e
       end
 
+      # Supported Method Parameters::
+      # issue_resp = PWN::Plugins::JiraServer.delete_attachment(
+      #   base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
+      #   token: 'required - personal access token',
+      #   id: 'required - attachment ID to delete (e.g. 10000) found in #get_issue method'
+      # )
+
+      public_class_method def self.delete_attachment(opts = {})
+        base_api_uri = opts[:base_api_uri]
+
+        token = opts[:token]
+        token ||= PWN::Plugins::AuthenticationHelper.mask_password(
+          prompt: 'Personal Access Token'
+        )
+
+        id = opts[:id]
+        raise 'ERROR: attachment_id cannot be nil.' if id.nil?
+
+        rest_call(
+          http_method: :delete,
+          base_api_uri: base_api_uri,
+          token: token,
+          rest_call: "attachment/#{id}"
+        )
+      rescue StandardError => e
+        raise e
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -433,12 +545,27 @@ module PWN
             attachment: 'optional - attachment path to upload to the issue (e.g. \"/path/to/file1.txt\")'
           )
 
+          issue_resp = #{self}.issue_comment(
+            base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
+            token: 'required - personal access token',
+            issue: 'required - issue to comment on (e.g. Bug, Issue, Story, or Epic ID)',
+            comment_action: 'required - action to perform on the issue comment (e.g. :delete, :add, :update - Defaults to :add)',
+            comment_id: 'optional - comment ID to delete or update (e.g. 10000)',
+            comment: 'optional - comment to add or update in the issue (e.g. \"This is a comment\")'
+          )
+
           issue_resp = #{self}.delete_issue(
             base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
             token: 'required - personal access token',
             issue: 'required - issue to delete (e.g. Bug, Issue, Story, or Epic ID)'
           )
 
+          issue_resp = #{self}.delete_attachment(
+            base_api_uri: 'required - base URI for Jira (e.g. https:/jira.corp.com/rest/api/latest)',
+            token: 'required - personal access token',
+            id: 'required - attachment ID to delete (e.g. 10000) found in #get_issue method'
+          )
+
           **********************************************************************
           * For more information on the Jira Server REST API, see:
           * https://developer.atlassian.com/server/jira/platform/rest-apis/

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.301'
+  VERSION = '0.5.302'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.301
+  version: 0.5.302
 platform: ruby
 authors:
 - 0day Inc.