pwn 0.5.426 → 0.5.428

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6bbdb81c1c0df4969edc99d219a625265fa48d5af722628a2a77d3ead2741cb
-  data.tar.gz: 68e09e473021b7b574074f737c066e06cc0276171eb74f99f9c8495f34a8825d
+  metadata.gz: cb4a896d76b2eff5600f7e7464227b6223a4287e4cd4e6fba7a60df29d40bc64
+  data.tar.gz: 93dbd97045e6ac60c4a46446bb8c681629ab462186092657e4f75bdb975eb7c9
 SHA512:
-  metadata.gz: 3e279405371694e5d6c602a869662fab95ebdd18f7b207734a6023a4c0d2d98a3ddf903f03f150d966c14fbb02a7e9dda36ad8eef77850eacebf870179c5ff56
-  data.tar.gz: e832fd158b5427c267e6240d8c7473d766ce1a9fdc53c5ff3353e08933cc4f3c2e2cc45a93f6b270092d6b38e1ccacc2d4a437fdc7983c201c71cb68dcc978d5
+  metadata.gz: 50aaa55f8d403788d10610c52a877bc99494678c0606b9d83fcdf623470faae899bfa6e095e0de4114832575184308d5a9303d0b5f1f15d0038f3e13b5c9e1b1
+  data.tar.gz: fdc901980719c87ac59a14e247f352074271ed8b43572bdbd446462fb621e772db5cb065c117c07b55c68caee5bd559094e536c5316c958af8fcab1f5f7ad602

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.426]:001 >>> PWN.help
+pwn[v0.5.428]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.426]:001 >>> PWN.help
+pwn[v0.5.428]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.426]:001 >>> PWN.help
+pwn[v0.5.428]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/repl.rb

@@ -18,7 +18,11 @@ module PWN
         mode = opts[:mode]
 
         proc do |_target_self, _nest_level, pi|
-          PWN::Plugins::Vault.refresh_config_for_repl(opts) if Pry.config.refresh_config
+          if Pry.config.refresh
+            # puts "Refreshing PWN env via #{opts[:yaml_config_path]}"
+            opts[:pi] = pi
+            PWN::Plugins::Vault.refresh_config_for_repl(opts)
+          end
 
           pi.config.pwn_repl_line += 1
           line_pad = format(
@@ -34,8 +38,8 @@ module PWN
           dchars = "\001\e[33m\002***\001\e[0m\002" if mode == :splat
 
           if pi.config.pwn_asm
-            arch = pi.config.pwn_asm_arch ||= PWN::Plugins::DetectOS.arch
-            endian = pi.config.pwn_asm_endian ||= PWN::Plugins::DetectOS.endian
+            arch = pi.config.pwn[:asm][:arch] ||= PWN::Plugins::DetectOS.arch
+            endian = pi.config.pwn[:asm][:endian] ||= PWN::Plugins::DetectOS.endian
 
             pi.config.prompt_name = "pwn.asm:#{arch}/#{endian}"
             name = "\001\e[1m\002\001\e[37m\002#{pi.config.prompt_name}\001\e[0m\002"
@@ -44,10 +48,10 @@ module PWN
           end
 
           if pi.config.pwn_ai
-            ai_engine = pi.config.pwn_ai_engine
-            model = pi.config.pwn_ai_model
-            system_role_content = pi.config.pwn_ai_system_role_content
-            temp = pi.config.pwn_ai_temp
+            ai_engine = pi.config.pwn[:ai_engine]
+            model = pi.config.pwn[ai_engine][:model]
+            system_role_content = pi.config.pwn[ai_engine][:system_role_content]
+            temp = pi.config.pwn[ai_engine][:temp]
             pname = "pwn.ai:#{ai_engine}"
             pname = "pwn.ai:#{ai_engine}/#{model}" if model
             pname = "pwn.ai:#{ai_engine}/#{model}.SPEAK" if pi.config.pwn_ai_speak
@@ -173,10 +177,10 @@ module PWN
 
             reply = nil
             response_history = nil
-            shared_chan = pi.config.pwn_irc[:shared_chan]
+            shared_chan = pi.config.pwn[:irc][:shared_chan]
             mem_chan = '#mem'
-            ai_agents = pi.config.pwn_irc[:ai_agent_nicks]
-            ai_agents_arr = pi.config.pwn_irc[:ai_agent_nicks].keys
+            ai_agents = pi.config.pwn[:irc][:ai_agent_nicks]
+            ai_agents_arr = pi.config.pwn[:irc][:ai_agent_nicks].keys
             total_ai_agents = ai_agents_arr.length
             mutex = Mutex.new
             PWN::Plugins::ThreadPool.fill(
@@ -302,15 +306,12 @@ module PWN
                         next unless dm_agent == nick
 
                         response_history = ai_agents[dm_agent.to_sym][:response_history]
-                        ai_engine = pi.config.pwn_ai_engine
-                        ai_base_uri = pi.config.pwn_ai_base_uri
-                        ai_key = pi.config.pwn_ai_key
-                        ai_key ||= ''
-                        ai_temp = pi.config.pwn_ai_temp
-
-                        model = pi.config.pwn_ai_model
-                        system_role_content = pi.config.pwn_ai_system_role_content
-                        temp = pi.config.pwn_ai_temp
+                        ai_engine = pi.config.pwn[:ai_engine]
+                        base_uri = pi.config.pwn[ai_engine][:base_uri]
+                        key = pi.config.pwn[ai_engine][:key] ||= ''
+                        temp = pi.config.pwn[ai_engine][:temp]
+                        model = pi.config.pwn[ai_engine][:model]
+                        system_role_content = pi.config.pwn[ai_engine][:system_role_content]
 
                         users_in_chan = PWN::Plugins::IRC.names(
                           irc_obj: irc_obj,
@@ -344,10 +345,10 @@ module PWN
                         case ai_engine
                         when :grok
                           response = PWN::AI::Grok.chat(
-                            base_uri: ai_base_uri,
-                            token: ai_key,
+                            base_uri: base_uri,
+                            token: key,
                             model: model,
-                            temp: ai_temp,
+                            temp: temp,
                             system_role_content: system_role_content,
                             request: request,
                             response_history: response_history,
@@ -355,10 +356,10 @@ module PWN
                           )
                         when :ollama
                           response = PWN::AI::Ollama.chat(
-                            base_uri: ai_base_uri,
-                            token: ai_key,
+                            base_uri: base_uri,
+                            token: key,
                             model: model,
-                            temp: ai_temp,
+                            temp: temp,
                             system_role_content: system_role_content,
                             request: request,
                             response_history: response_history,
@@ -366,10 +367,10 @@ module PWN
                           )
                         when :openai
                           response = PWN::AI::OpenAI.chat(
-                            base_uri: ai_base_uri,
-                            token: ai_key,
+                            base_uri: base_uri,
+                            token: key,
                             model: model,
-                            temp: ai_temp,
+                            temp: temp,
                             system_role_content: system_role_content,
                             request: request,
                             response_history: response_history,
@@ -434,7 +435,7 @@ module PWN
 
             # TODO: Use TLS for IRC Connections
             # Use an IRC nCurses CLI Client
-            ui_nick = pi.config.pwn_irc[:ui_nick]
+            ui_nick = pi.config.pwn[:irc][:ui_nick]
             join_channels = ai_agents_arr.map { |ai_chan| "##{ai_chan}" }.join(',')
 
             cmd0 = "/server add pwn #{host}/#{port} -notls"
@@ -538,10 +539,8 @@ module PWN
 
         # Initialize pwn.yaml Configuration using :before_session Hook
         Pry.config.hooks.add_hook(:before_session, :init_opts) do |_output, _binding, pi|
+          # puts "Refreshing PWN env via #{opts[:yaml_config_path]}"
           opts[:pi] = pi
-          Pry.config.yaml_config_path = opts[:yaml_config_path]
-          Pry.config.yaml_decryptor_path = opts[:yaml_decryptor_path]
-
           PWN::Plugins::Vault.refresh_config_for_repl(opts)
         end
 
@@ -549,8 +548,8 @@ module PWN
           if pi.config.pwn_asm && !request.chomp.empty?
             request = pi.input.line_buffer
 
-            arch = pi.config.pwn_asm_arch
-            endian = pi.config.pwn_asm_endian
+            arch = pi.config.pwn[:asm][:arch]
+            endian = pi.config.pwn[:asm][:endian]
 
             # Analyze request to determine if it should be processed as opcodes or asm.
             straight_hex = /^[a-fA-F0-9\s]+$/
@@ -586,29 +585,27 @@ module PWN
           if pi.config.pwn_ai && !request.chomp.empty?
             request = pi.input.line_buffer.to_s
             debug = pi.config.pwn_ai_debug
-            ai_engine = pi.config.pwn_ai_engine.to_s.to_sym
-            ai_key = pi.config.pwn_ai_key
-            ai_key ||= ''
-            if ai_key.empty?
-              ai_key = PWN::Plugins::AuthenticationHelper.mask_password(
+            ai_engine = pi.config.pwn[:ai_engine]
+            base_uri = pi.config.pwn[ai_engine][:base_uri]
+            key = pi.config.pwn[ai_engine][:key] ||= ''
+            if key.empty?
+              key = PWN::Plugins::AuthenticationHelper.mask_password(
                 prompt: 'pwn-ai Key'
               )
-              pi.config.pwn_ai_key = ai_key
+              pi.config.pwn[ai_engine][:key] = key
             end
 
             response_history = pi.config.pwn_ai_response_history
             speak_answer = pi.config.pwn_ai_speak
-            model = pi.config.pwn_ai_model
-            system_role_content = pi.config.pwn_ai_system_role_content
-            temp = pi.config.pwn_ai_temp
-
-            ai_base_uri = pi.config.pwn_ai_base_uri
+            model = pi.config.pwn[ai_engine][:model]
+            system_role_content = pi.config.pwn[ai_engine][:system_role_content]
+            temp = pi.config.pwn[ai_engine][:temp]
 
             case ai_engine
             when :grok
               response = PWN::AI::Grok.chat(
-                base_uri: ai_base_uri,
-                token: ai_key,
+                base_uri: base_uri,
+                token: key,
                 model: model,
                 system_role_content: system_role_content,
                 temp: temp,
@@ -619,8 +616,8 @@ module PWN
               )
             when :ollama
               response = PWN::AI::Ollama.chat(
-                base_uri: ai_base_uri,
-                token: ai_key,
+                base_uri: base_uri,
+                token: key,
                 model: model,
                 system_role_content: system_role_content,
                 temp: temp,
@@ -631,8 +628,8 @@ module PWN
               )
             when :openai
               response = PWN::AI::OpenAI.chat(
-                base_uri: ai_base_uri,
-                token: ai_key,
+                base_uri: base_uri,
+                token: key,
                 model: model,
                 system_role_content: system_role_content,
                 temp: temp,

data/lib/pwn/plugins/vault.rb

@@ -173,7 +173,7 @@ module PWN
         system(relative_editor, file)
 
         # If the Pry object exists, set refresh_config to true
-        Pry.config.refresh_config = true if defined?(Pry)
+        Pry.config.refresh = true if defined?(Pry)
 
         encrypt(
           file: file,
@@ -245,7 +245,8 @@ module PWN
 
         return false unless File.exist?(yaml_config_path)
 
-        pi = opts[:pi] ||= Pry
+        pi = opts[:pi]
+        raise 'ERROR: Pry instance is required.' if pi.nil?
 
         is_encrypted = PWN::Plugins::Vault.file_encrypted?(file: yaml_config_path)
 
@@ -270,52 +271,41 @@ module PWN
         else
           yaml_config = YAML.load_file(yaml_config_path, symbolize_names: true)
         end
-        pi.config.p = yaml_config
-        Pry.config.p = yaml_config
 
         valid_ai_engines = %i[
           grok
           openai
           ollama
         ]
-        ai_engine = yaml_config[:ai_engine].to_s.downcase.to_sym
 
+        # Convert ai_engine to symbol and downcase to ensure stability
+        yaml_config[:ai_engine] = yaml_config[:ai_engine].to_s.downcase.to_sym
+        pi.config.pwn = yaml_config
+        ai_engine = pi.config.pwn[:ai_engine]
         raise "ERROR: Unsupported AI Engine: #{ai_engine} in #{yaml_config_path}.  Supported AI Engines:\n#{valid_ai_engines.inspect}" unless valid_ai_engines.include?(ai_engine)
 
-        pi.config.pwn_ai_engine = ai_engine
-        Pry.config.pwn_ai_engine = ai_engine
-
-        pi.config.pwn_ai_base_uri = pi.config.p[ai_engine][:base_uri]
-        Pry.config.pwn_ai_base_uri = pi.config.pwn_ai_base_uri
-
-        pi.config.pwn_ai_key = pi.config.p[ai_engine][:key]
-        Pry.config.pwn_ai_key = pi.config.pwn_ai_key
-
-        pi.config.pwn_ai_model = pi.config.p[ai_engine][:model]
-        Pry.config.pwn_ai_model = pi.config.pwn_ai_model
-
-        pi.config.pwn_ai_system_role_content = pi.config.p[ai_engine][:system_role_content]
-        Pry.config.pwn_ai_system_role_content = pi.config.pwn_ai_system_role_content
-
-        pi.config.pwn_ai_temp = pi.config.p[ai_engine][:temp]
-        Pry.config.pwn_ai_temp = pi.config.pwn_ai_temp
-
-        pi.config.pwn_asm_arch = pi.config.p[:asm][:arch]
-        Pry.config.pwn_asm_arch = pi.config.pwn_asm_arch
-
-        pi.config.pwn_asm_endian = pi.config.p[:asm][:endian]
-        Pry.config.pwn_asm_endian = pi.config.pwn_asm_endian
-
-        pi.config.pwn_irc = pi.config.p[:irc]
-        Pry.config.pwn_irc = pi.config.pwn_irc
-
-        pi.config.pwn_hunter = pi.config.p[:hunter][:api_key]
-        Pry.config.pwn_hunter = pi.config.pwn_hunter
-
-        pi.config.pwn_shodan = pi.config.p[:shodan][:api_key]
-        Pry.config.pwn_shodan = pi.config.pwn_shodan
-
-        Pry.config.refresh_config = false
+        model = pi.config.pwn[ai_engine][:model]
+        system_role_content = pi.config.pwn[ai_engine][:system_role_content]
+
+        # Reset the ai response history for new configurations
+        pi.config.pwn_ai_response_history = {
+          id: '',
+          object: '',
+          model: model,
+          usage: {},
+          choices: [
+            {
+              role: 'system',
+              content: system_role_content
+            }
+          ]
+        }
+
+        # These two lines should be immutable for the session
+        pi.config.pwn[:yaml_config_path] = yaml_config_path
+        pi.config.pwn[:yaml_decryptor_path] = yaml_decryptor_path if is_encrypted
+
+        Pry.config.refresh = false
 
         true
       rescue StandardError => e

data/lib/pwn/reports/sast.rb

@@ -44,7 +44,7 @@ module PWN
           raise 'ERROR: AI Model is required for AI engine ollama.' if ai_engine == :ollama && ai_model.nil?
 
           ai_key = opts[:ai_key] ||= PWN::Plugins::AuthenticationHelper.mask_password(prompt: "#{ai_engine} Token")
-          ai_system_role_content = opts[:ai_system_role_content] ||= 'Confidence score of 0-10 this is vulnerable (0 being not vulnerable, moving upwards in confidence of exploitation). Provide additional context to assist penetration tester assessment.'
+          ai_system_role_content = opts[:ai_system_role_content] ||= 'Your sole purpose is to analyze source code snippets and generate an Exploit Prediction Scoring System (EPSS) score between 0% - 100%.  Just generate a score unless score is higher than 75% in which a code fic should also be included.'
           ai_temp = opts[:ai_temp] ||= 0.1
 
           puts "Analyzing source code using AI engine: #{ai_engine}\nModel: #{ai_model}\nSystem Role Content: #{ai_system_role_content}\nTemperature: #{ai_temp}"
@@ -64,12 +64,19 @@ module PWN
         spin.auto_spin
 
         results_hash[:data].each do |hash_line|
+          git_repo_root_uri = hash_line[:filename][:git_repo_root_uri]
+          filename = hash_line[:filename][:entry]
           hash_line[:line_no_and_contents].each do |src_detail|
             entry_count += 1
             percent_complete = (entry_count.to_f / total_entries * 100).round(2)
-            request = src_detail[:contents]
-            response = nil
             line_no = src_detail[:line_no]
+            source_code_snippet = src_detail[:contents]
+            request = {
+              scm_uri: "#{git_repo_root_uri}/#{filename}",
+              line: line_no,
+              source_code_snippet: source_code_snippet
+            }.to_json
+            response = nil
             author = src_detail[:author].to_s.scrub.chomp.strip
 
             case ai_engine

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.426'
+  VERSION = '0.5.428'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.426
+  version: 0.5.428
 platform: ruby
 authors:
 - 0day Inc.