pwn 0.5.444 → 0.5.446

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec6df63c1b99b28c53063a7a55160e3daf1b961fb5c9c65b13e522bb1011f54d
-  data.tar.gz: 384514b0c8e2fe6d11696a55e5e9fc04a3cf5af85218b6643a2009401da50188
+  metadata.gz: a44431b941955353c7b0926e584ee754f3ef4cf02a22590dddf0613e4436545e
+  data.tar.gz: d7f6286a33c71a051ac1f06e688c4e81974e0dbac83fca90834945df08e1de6a
 SHA512:
-  metadata.gz: 679c8b0262e600ae206e713ceec79d60de9ce91bf39b0eebb420c76316fd0cb7816a9bf96390bf5545e5c6063697809354fb52aa55aad962cd0b2c9c5373d123
-  data.tar.gz: f14604cb417bd26b745a4c311ed8614cc8ec3f13e07f622497efbb4037fda26ed767dc017ff2fa1e92eee4f47a731d4646ea76e05cf05628d4377a23e7cef460
+  metadata.gz: d7b633237440b907fa46d66526d80b403c5e30649aa8411d5e39d1dcabe24f7fe5db4010c120994daef10b5ff6ae61c28865d9327bfd27c29d2987add8bf6b07
+  data.tar.gz: 01f0763257fd3e7f8404d0d5d2eadb08b5a50c5eb539f8d2eed70fe104b2f54c6cca65c46c2da2a55152a5c6fed5ca2acfc7a497b55c1d9eaa02e412495bb039

data/.rubocop_todo.yml

@@ -1,6 +1,6 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2025-09-11 18:09:38 UTC using RuboCop version 1.80.2.
+# on 2025-10-08 18:25:54 UTC using RuboCop version 1.81.1.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@@ -13,7 +13,7 @@ Layout/TrailingWhitespace:
   Exclude:
     - 'lib/pwn/banner/radare2_ai.rb'
 
-# Offense count: 9
+# Offense count: 10
 # Configuration parameters: AllowedMethods, AllowedPatterns.
 Lint/NestedMethodDefinition:
   Exclude:
@@ -30,7 +30,7 @@ Lint/RedundantTypeConversion:
     - 'lib/pwn/plugins/jenkins.rb'
     - 'lib/pwn/plugins/repl.rb'
 
-# Offense count: 320
+# Offense count: 276
 # This cop supports safe autocorrection (--autocorrect).
 Lint/UselessAssignment:
   Enabled: false
@@ -60,13 +60,11 @@ Metrics/MethodLength:
   Exclude:
     - 'lib/pwn/banner/code_cave.rb'
 
-# Offense count: 3
+# Offense count: 1
 # Configuration parameters: CountComments, Max, CountAsOne.
 Metrics/ModuleLength:
   Exclude:
-    - 'lib/pwn/banner/code_cave.rb'
     - 'lib/pwn/plugins/android.rb'
-    - 'lib/pwn/plugins/msr206.rb'
 
 # Offense count: 2
 Naming/AccessorMethodName:
@@ -81,7 +79,7 @@ Style/Alias:
   Exclude:
     - 'lib/pwn/plugins/monkey_patch.rb'
 
-# Offense count: 163
+# Offense count: 119
 Style/ClassVars:
   Enabled: false
 
@@ -98,6 +96,13 @@ Style/ExplicitBlockArgument:
   Exclude:
     - 'lib/pwn/plugins/nmap_it.rb'
 
+# Offense count: 1
+# This cop supports safe autocorrection (--autocorrect).
+# Configuration parameters: MinBodyLength, AllowConsecutiveConditionals.
+Style/GuardClause:
+  Exclude:
+    - 'lib/pwn/plugins/monkey_patch.rb'
+
 # Offense count: 1
 # This cop supports safe autocorrection (--autocorrect).
 Style/IfUnlessModifier:
@@ -116,25 +121,14 @@ Style/MapIntoArray:
     - 'lib/pwn/plugins/char.rb'
     - 'lib/pwn/plugins/nexpose_vuln_scan.rb'
 
-# Offense count: 7
+# Offense count: 2
 # This cop supports safe autocorrection (--autocorrect).
 # Configuration parameters: AllowMethodComparison, ComparisonsThreshold.
 Style/MultipleComparison:
   Exclude:
-    - 'lib/pwn/sast/banned_function_calls_c.rb'
-    - 'lib/pwn/sast/cmd_execution_python.rb'
-    - 'lib/pwn/sast/cmd_execution_ruby.rb'
-    - 'lib/pwn/sast/deserial_java.rb'
-    - 'lib/pwn/sast/factory.rb'
     - 'lib/pwn/www/duckduckgo.rb'
     - 'lib/pwn/www/twitter.rb'
 
-# Offense count: 1
-# This cop supports safe autocorrection (--autocorrect).
-Style/RedundantAssignment:
-  Exclude:
-    - 'lib/pwn/plugins/zaproxy.rb'
-
 # Offense count: 1
 # This cop supports safe autocorrection (--autocorrect).
 Style/RedundantBegin:
@@ -149,24 +143,6 @@ Style/RedundantCondition:
   Exclude:
     - 'lib/pwn/plugins/packet.rb'
 
-# Offense count: 13
-# This cop supports safe autocorrection (--autocorrect).
-Style/RedundantParentheses:
-  Exclude:
-    - 'lib/pwn/sast/banned_function_calls_c.rb'
-    - 'lib/pwn/sast/cmd_execution_java.rb'
-    - 'lib/pwn/sast/cmd_execution_python.rb'
-    - 'lib/pwn/sast/cmd_execution_ruby.rb'
-    - 'lib/pwn/sast/cmd_execution_scala.rb'
-    - 'lib/pwn/sast/deserial_java.rb'
-    - 'lib/pwn/sast/factory.rb'
-    - 'lib/pwn/sast/log4j.rb'
-    - 'lib/pwn/sast/logger.rb'
-    - 'lib/pwn/sast/php_input_mechanisms.rb'
-    - 'lib/pwn/sast/php_type_juggling.rb'
-    - 'lib/pwn/sast/throw_errors.rb'
-    - 'lib/pwn/sast/type_script_type_juggling.rb'
-
 # Offense count: 12
 # This cop supports safe autocorrection (--autocorrect).
 Style/RedundantStringEscape:
@@ -177,7 +153,19 @@ Style/RedundantStringEscape:
     - 'lib/pwn/sast/redos.rb'
     - 'vagrant/provisioners/kali_customize.rb'
 
-# Offense count: 62
+# Offense count: 19
 # This cop supports unsafe autocorrection (--autocorrect-all).
 Style/SlicingWithRange:
-  Enabled: false
+  Exclude:
+    - 'lib/pwn/ai/grok.rb'
+    - 'lib/pwn/ai/ollama.rb'
+    - 'lib/pwn/ai/open_ai.rb'
+    - 'lib/pwn/aws/iam.rb'
+    - 'lib/pwn/plugins/gqrx.rb'
+    - 'lib/pwn/plugins/irc.rb'
+    - 'lib/pwn/plugins/open_api.rb'
+    - 'lib/pwn/plugins/repl.rb'
+    - 'lib/pwn/plugins/serial.rb'
+    - 'lib/pwn/plugins/xxd.rb'
+    - 'lib/pwn/sast/pom_version.rb'
+    - 'lib/pwn/sast/test_case_engine.rb'

data/Gemfile

@@ -18,6 +18,7 @@ gem 'aws-sdk', '3.3.0'
 # gem 'bettercap', '1.6.2'
 gem 'barby', '0.7.0'
 gem 'base32', '0.3.4'
+gem 'bitcoin-ruby', '0.0.20'
 gem 'brakeman', '7.1.0'
 gem 'bson', '5.1.1'
 gem 'bundler', '>=2.7.2'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.444]:001 >>> PWN.help
+pwn[v0.5.446]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.4.4@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.444]:001 >>> PWN.help
+pwn[v0.5.446]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.4.4@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.444]:001 >>> PWN.help
+pwn[v0.5.446]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/etc/pwn.yaml.EXAMPLE

@@ -34,6 +34,13 @@ asm:
   arch: 'x86_64'
   endian: 'little'
 
+blockchain:
+  bitcoin:
+    rpc_host: '127.0.0.1'
+    rpc_port: 8332
+    rpc_user: 'bitcoin rpc user'
+    rpc_pass: 'bitcoin rpc password'
+
 irc:
   ui_nick: '_human_'
   shared_chan: '#pwn'

data/lib/pwn/blockchain/btc.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'bitcoin'
+require 'base64'
 require 'json'
 require 'rest-client'
 require 'tty-spinner'
@@ -25,10 +27,20 @@ module PWN
                         opts[:http_method].to_s.scrub.to_sym
                       end
 
-        base_uri = 'https://api.blockcypher.com/v1/btc/'
+        rpc_host = PWN::Env[:blockchain][:bitcoin][:rpc_host] ||= '127.0.0.1'
+        rpc_port = PWN::Env[:blockchain][:bitcoin][:rpc_port] ||= '8332'
+        base_uri = "http://#{rpc_host}:#{rpc_port}"
         rest_call = opts[:rest_call].to_s.scrub
         params = opts[:params]
-        headers = { content_type: 'application/json; charset=UTF-8' }
+        rpc_user = PWN::Env[:blockchain][:bitcoin][:rpc_user] ||= PWN::Plugins::AuthenticationHelper.username(prompt: 'Bitcoin Node RPC Username')
+        rpc_pass = PWN::Env[:blockchain][:bitcoin][:rpc_pass] ||= PWN::Plugins::AuthenticationHelper.mask_password(prompt: 'Bitcoin Node RPC Password')
+
+        basic_auth = Base64.strict_encode64("#{rpc_user}:#{rpc_pass}")
+
+        headers = {
+          content_type: 'application/json; charset=UTF-8',
+          authorization: "Basic #{basic_auth}"
+        }
 
         http_body = opts[:http_body]
         http_body ||= {}
@@ -100,16 +112,20 @@ module PWN
       end
 
       # Supported Method Parameters::
-      # latest_block = PWN::Blockchain::BTC.get_latest_block(
-      #   token: 'optional - API token for higher rate limits'
-      # )
-
-      public_class_method def self.get_latest_block(opts = {})
-        params = {}
-        params[:token] = opts[:token] if opts[:token]
-
-        rest_call = 'main'
-        response = btc_rest_call(rest_call: rest_call, params: params)
+      # latest_block = PWN::Blockchain::BTC.get_latest_block
+
+      public_class_method def self.get_latest_block
+        http_body = {
+          jsonrpc: '1.0',
+          id: self,
+          method: 'getblockchaininfo',
+          params: []
+        }
+
+        response = btc_rest_call(
+          http_method: :post,
+          http_body: http_body
+        )
 
         JSON.parse(response.body, symbolize_names: true)
       rescue StandardError => e

data/lib/pwn/config.rb

@@ -51,6 +51,14 @@ module PWN
           }
         },
         asm: { arch: PWN::Plugins::DetectOS.arch, endian: PWN::Plugins::DetectOS.endian },
+        blockchain: {
+          bitcoin: {
+            rpc_host: 'localhost',
+            rpc_port: 8332,
+            rpc_user: 'bitcoin RPC Username',
+            rpc_pass: 'bitcoin RPC Password'
+          }
+        },
         irc: {
           ui_nick: '_human_',
           shared_chan: '#pwn',

data/lib/pwn/plugins/authentication_helper.rb

@@ -10,10 +10,13 @@ module PWN
     # of other SP plugins/modules.
     module AuthenticationHelper
       # Supported Method Parameters::
-      # PWN::Plugins::AuthenticationHelper.username
+      # PWN::Plugins::AuthenticationHelper.username(
+      #   prompt: 'optional - string to display at prompt (Default: Username)'
+      # )
 
       public_class_method def self.username
-        user = TTY::Prompt.new.ask('Username: ')
+        prompt = opts[:prompt] ||= 'Username'
+        user = TTY::Prompt.new.ask("#{prompt}: ")
         user.to_s.strip.chomp.scrub
       rescue StandardError => e
         raise e
@@ -21,11 +24,11 @@ module PWN
 
       # Supported Method Parameters::
       # PWN::Plugins::AuthenticationHelper.mask_password(
-      #   prompt: 'optional - string to display at prompt'
+      #   prompt: 'optional - string to display at prompt (Default: Password)'
       # )
 
       public_class_method def self.mask_password(opts = {})
-        opts[:prompt].nil? ? prompt = 'Password' : prompt = opts[:prompt].to_s.scrub.strip.chomp
+        prompt = opts[:prompt] ||= 'Password'
 
         pass = TTY::Prompt.new.mask("#{prompt}: ")
         pass.to_s.strip.chomp.scrub
@@ -37,11 +40,11 @@ module PWN
 
       # Supported Method Parameters::
       # PWN::Plugins::AuthenticationHelper.mfa(
-      #   prompt: 'optional - string to display at prompt'
+      #   prompt: 'optional - string to display at prompt (Default: MFA Token)'
       # )
 
       public_class_method def self.mfa(opts = {})
-        opts[:prompt].nil? ? prompt = 'MFA Token' : prompt = opts[:prompt].to_s.scrub.strip.chomp
+        prompt = opts[:prompt] ||= 'MFA Token'
 
         mfa = TTY::Prompt.new.ask("#{prompt}: ")
         mfa.to_s.strip.chomp.scrub
@@ -63,9 +66,13 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
-          #{self}.username
+          #{self}.username(
+            prompt: 'optional - string to display at prompt'
+          )
 
-          #{self}.mask_password
+          #{self}.mask_password(
+            prompt: 'optional - string to display at prompt'
+          )
 
           #{self}.mfa(
             prompt: 'optional - string to display at prompt'

data/lib/pwn/plugins/monkey_patch.rb

@@ -2,7 +2,7 @@
 
 module PWN
   module Plugins
-    # This module provides the abilty to centralize monkey patches used in PWN
+    # This module provides the ability to centralize monkey patches used in PWN
     module MonkeyPatch
       # Supported Method Parameters::
       # PWN::Plugins::MonkeyPatch.pry
@@ -31,6 +31,21 @@ module PWN
           alias << push
         end
 
+        require 'method_source'
+        MethodSource::CodeHelpers.module_eval do
+          alias_method :original_complete_expression?, :complete_expression?
+
+          def complete_expression?(expression)
+            original_complete_expression?(expression)
+          rescue SyntaxError => e
+            if e.message =~ /expected a `.*` to close the .* literal/ || e.message =~ /unterminated list/
+              false
+            else
+              raise e
+            end
+          end
+        end
+
         Pry.class_eval do
           def handle_line(line, options)
             if line.nil?

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.444'
+  VERSION = '0.5.446'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.444
+  version: 0.5.446
 platform: ruby
 authors:
 - 0day Inc.
@@ -93,6 +93,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 0.3.4
+- !ruby/object:Gem::Dependency
+  name: bitcoin-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.0.20
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.0.20
 - !ruby/object:Gem::Dependency
   name: brakeman
   requirement: !ruby/object:Gem::Requirement