pwn 0.5.509 → 0.5.510

data/lib/pwn/sast.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module PWN
+  # This file, using the autoload directive loads SAST modules
+  # into memory only when they're needed. For more information, see:
+  # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
+  module SAST
+    # Zero False Negative SAST Modules
+    autoload :ApacheFileSystemUtilAPI, 'pwn/sast/apache_file_system_util_api'
+    autoload :AMQPConnectAsGuest, 'pwn/sast/amqp_connect_as_guest'
+    autoload :AWS, 'pwn/sast/aws'
+    autoload :BannedFunctionCallsC, 'pwn/sast/banned_function_calls_c'
+    autoload :Base64, 'pwn/sast/base64'
+    autoload :BeefHook, 'pwn/sast/beef_hook'
+    autoload :CmdExecutionGoLang, 'pwn/sast/cmd_execution_go_lang'
+    autoload :CmdExecutionJava, 'pwn/sast/cmd_execution_java'
+    autoload :CmdExecutionPython, 'pwn/sast/cmd_execution_python'
+    autoload :CmdExecutionRuby, 'pwn/sast/cmd_execution_ruby'
+    autoload :CmdExecutionScala, 'pwn/sast/cmd_execution_scala'
+    autoload :CSRF, 'pwn/sast/csrf'
+    autoload :DeserialJava, 'pwn/sast/deserial_java'
+    autoload :Emoticon, 'pwn/sast/emoticon'
+    autoload :Eval, 'pwn/sast/eval'
+    autoload :Factory, 'pwn/sast/factory'
+    autoload :HTTPAuthorizationHeader, 'pwn/sast/http_authorization_header'
+    autoload :InnerHTML, 'pwn/sast/inner_html'
+    autoload :Keystore, 'pwn/sast/keystore'
+    autoload :LocalStorage, 'pwn/sast/local_storage'
+    autoload :LocationHash, 'pwn/sast/location_hash'
+    autoload :Log4J, 'pwn/sast/log4j'
+    autoload :Logger, 'pwn/sast/logger'
+    autoload :MD5, 'pwn/sast/md5'
+    autoload :OuterHTML, 'pwn/sast/outer_html'
+    autoload :PaddingOracle, 'pwn/sast/padding_oracle'
+    autoload :Password, 'pwn/sast/password'
+    autoload :PHPInputMechanisms, 'pwn/sast/php_input_mechanisms'
+    autoload :PHPTypeJuggling, 'pwn/sast/php_type_juggling'
+    autoload :PomVersion, 'pwn/sast/pom_version'
+    autoload :Port, 'pwn/sast/port'
+    autoload :PostMessage, 'pwn/sast/post_message'
+    autoload :PrivateKey, 'pwn/sast/private_key'
+    autoload :Redirect, 'pwn/sast/redirect'
+    autoload :ReDOS, 'pwn/sast/redos'
+    autoload :Shell, 'pwn/sast/shell'
+    autoload :Signature, 'pwn/sast/signature'
+    autoload :SQL, 'pwn/sast/sql'
+    autoload :SSL, 'pwn/sast/ssl'
+    autoload :Sudo, 'pwn/sast/sudo'
+    autoload :TaskTag, 'pwn/sast/task_tag'
+
+    # This module executes all the other SAST modules
+    autoload :TestCaseEngine, 'pwn/sast/test_case_engine'
+
+    autoload :ThrowErrors, 'pwn/sast/throw_errors'
+    autoload :Token, 'pwn/sast/token'
+    autoload :TypeScriptTypeJuggling, 'pwn/sast/type_script_type_juggling'
+    autoload :UseAfterFree, 'pwn/sast/use_after_free'
+    autoload :Version, 'pwn/sast/version'
+    autoload :WindowLocationHash, 'pwn/sast/window_location_hash'
+
+    # Display a List of Every PWN::SAST Module
+
+    public_class_method def self.help
+      constants.sort
+    end
+  end
+end

data/lib/pwn/sdr/decoder/gsm.rb

@@ -0,0 +1,231 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # SDR Decoder for GSM signals.
+      module GSM
+        POWER_THRESHOLD = 0.1
+        SLEEP_INTERVAL = 0.1
+        HEADER_SIZE = 44
+        BURST_DURATION_SEC = 0.000577
+
+        # TSC 0 binary sequence (26 bits): 00100101110000101010011011
+        TSC_0 = [0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1].freeze
+
+        # Starts the live decoding thread.
+        def self.start(opts = {})
+          gqrx_obj = opts[:gqrx_obj]
+          raise ':ERROR: :gqrx_obj is required' unless gqrx_obj.is_a?(Hash)
+
+          record_path = gqrx_obj[:record_path]
+          frequency = gqrx_obj[:frequency]
+          sample_rate = gqrx_obj[:bandwidth].to_i
+          gqrx_sock = gqrx_obj[:gqrx_sock]
+
+          gqrx_obj[:decoder_stop_flag] ||= [false]
+
+          sleep 0.1 until File.exist?(record_path)
+
+          header = File.binread(record_path, HEADER_SIZE)
+          raise 'Invalid WAV header' unless header.start_with?('RIFF') && header.include?('WAVE')
+
+          bytes_read = HEADER_SIZE
+
+          puts "GSM Decoder started for frequency: #{frequency}, sample_rate: #{sample_rate}"
+
+          Thread.new do
+            loop do
+              break if gqrx_obj[:decoder_stop_flag][0]
+
+              current_size = File.size(record_path)
+              if current_size > bytes_read
+                new_bytes = current_size - bytes_read
+                # Ensure full I/Q pairs (8 bytes)
+                new_bytes -= new_bytes % 8
+                data = File.binread(record_path, new_bytes, bytes_read)
+                process_chunk(
+                  data: data,
+                  sample_rate: sample_rate,
+                  frequency: frequency
+                )
+                bytes_read = current_size
+              end
+
+              sleep SLEEP_INTERVAL
+            end
+          rescue StandardError => e
+            puts "Decoder error: #{e.message}"
+          ensure
+            cleanup(record_path: record_path)
+          end
+        end
+
+        # Stops the decoding thread.
+        def self.stop(opts = {})
+          thread = opts[:thread]
+          gqrx_obj = opts[:gqrx_obj]
+          raise ':ERROR: :thread and :gqrx_obj are required' unless thread && gqrx_obj.is_a?(Hash)
+
+          gqrx_obj[:decoder_stop_flag][0] = true
+          thread.join(1.0)
+        end
+
+        class << self
+          private
+
+          def process_chunk(opts = {})
+            data = opts[:data]
+            sample_rate = opts[:sample_rate]
+            frequency = opts[:frequency]
+            raise ':ERROR: :data, :sample_rate, and :frequency are required' unless data && sample_rate && frequency
+
+            samples = data.unpack('f< *')
+            return if samples.length.odd? # Skip incomplete
+
+            complex_samples = []
+            (0...samples.length).step(2) do |i|
+              complex_samples << Complex(samples[i], samples[i + 1])
+            end
+
+            window_size = [(sample_rate * BURST_DURATION_SEC).round, complex_samples.length].min
+            return if window_size <= 0
+
+            # Simplified power on sliding windows
+            powers = []
+            complex_samples.each_cons(window_size) do |window|
+              power = window.map { |c| c.abs**2 }.sum / window_size
+              powers << power
+            end
+
+            max_power = powers.max
+            return unless max_power > POWER_THRESHOLD
+
+            # Demod the entire chunk (assume burst-aligned roughly)
+            bits = demod_gmsk(complex_samples)
+            # Synchronize via TSC correlation
+            sync_offset = find_tsc_offset(bits, TSC_0)
+            return unless sync_offset >= 0
+
+            # Extract data bits from normal burst structure
+            burst_start = sync_offset - 58 # TSC starts at symbol 58 (0-index)
+            return unless burst_start >= 0 && burst_start + 148 <= bits.length
+
+            data_bits = extract_data_bits(bits, burst_start)
+            puts "Burst synchronized at offset #{sync_offset} for #{frequency} Hz (power: #{max_power.round(4)})"
+            decode_imsi(
+              data_bits: data_bits,
+              frequency: frequency
+            )
+          end
+
+          def demod_gmsk(complex_samples)
+            return [] if complex_samples.length < 2
+
+            bits = []
+            (1...complex_samples.length).each do |i|
+              prod = complex_samples[i] * complex_samples[i - 1].conj
+              # Sign of imaginary part for quadrature differential
+              bit = (prod.imag >= 0 ? 0 : 1) # Or adjust polarity
+              bits << bit
+            end
+            bits
+          end
+
+          def find_tsc_offset(bits, tsc)
+            max_corr = -1
+            best_offset = -1
+            tsc_length = tsc.length # 26
+            (0...(bits.length - tsc_length + 1)).each do |offset|
+              window = bits[offset, tsc_length]
+              corr = window.zip(tsc).count { |b1, b2| b1 == b2 }
+              if corr > max_corr
+                max_corr = corr
+                best_offset = offset
+              end
+            end
+            # Threshold: e.g., >20 matches for good sync
+            max_corr > 20 ? best_offset : -1
+          end
+
+          # Extract 114 data bits from normal burst (ignoring tails/guard)
+          def extract_data_bits(bits, burst_start)
+            data1_start = burst_start + 2
+            data2_start = burst_start + 88 # After TSC 26 + data1 57 = 85, +3? Wait, structure: tail2(0-1), data(2-58), tsc(59-84), data(85-141), tail(142-143)
+            data1 = bits[data1_start, 57]
+            data2 = bits[data2_start, 57]
+            data1 + data2
+          end
+
+          def decode_imsi(opts = {})
+            data_bits = opts[:data_bits]
+            frequency = opts[:frequency]
+            raise ':ERROR: :data_bits and :frequency are required' unless data_bits && frequency
+
+            # Simplified "IMSI extraction": Interpret first ~60 bits as packed digits (4 bits per digit, BCD-like).
+            # In reality: Deinterleave (over bursts), Viterbi decode convolutional code (polys G0=10011b, G1=11011b),
+            # CRC check, parse L3 message (e.g., Paging Req Type 1 has IMSI IE at specific offset, packed BCD).
+            # Here: Raw data bits to 15-digit IMSI (first 60 bits -> 15 nibbles).
+            return unless data_bits.length >= 60
+
+            imsi_digits = []
+            data_bits[0, 60].each_slice(4) do |nibble|
+              digit = nibble.join.to_i(2)
+              imsi_digits << (digit % 10) # Mod 10 for digit-like, or keep as is for hex
+            end
+
+            # Format as 3(MCC)+3(MNC)+9(MSIN)
+            mcc = imsi_digits[0, 3].join
+            mnc = imsi_digits[3, 3].join
+            msin = imsi_digits[6, 9].join
+            imsi = "#{mcc.ljust(3, '0')}#{mnc.ljust(3, '0')}#{msin.ljust(9, '0')}"
+
+            puts "Decoded IMSI: #{imsi} at #{frequency} Hz"
+            # TODO: Integrate full L3 parser (e.g., from ruby-gsm gem or custom).
+          end
+
+          def cleanup(opts = {})
+            record_path = opts[:record_path]
+            raise ':ERROR: :record_path is required' unless record_path
+
+            return unless File.exist?(record_path)
+
+            File.delete(record_path)
+            puts "Cleaned up recording: #{record_path}"
+          end
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):
+            0day Inc. <support@0dayinc.com>
+          "
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            gsm_decoder_thread = PWN::SDR::Decoder::GSM.start(
+              gqrx_obj: {
+                record_path: 'path/to/record.wav',
+                frequency: 935_000_000, # Frequency in Hz
+                bandwidth: 200_000,     # Sample rate in Hz
+                gqrx_sock: gqrx_socket_object
+              }
+            )
+
+            # To stop the decoder thread:
+            PWN::SDR::Decoder::GSM.stop(
+              thread: gsm_decoder_thread,
+              gqrx_obj: gqrx_object_used_to_start_decoder
+            )
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module PWN
+  # This file, using the autoload directive loads SDR modules
+  # into memory only when they're needed. For more information, see:
+  # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
+  module SDR
+    # Deocder Module for SDR signals.
+    module Decoder
+      autoload :GSM, 'pwn/sdr/decoder/gsm'
+
+      # Display a List of Every PWN::AI Module
+
+      public_class_method def self.help
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/sdr/flipper_zero.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    # This plugin is used for interacting with Bus Pirate v3.6
+    # This plugin may be compatible with other versions, however,
+    # has not been tested with anything other than v3.6.
+    module FlipperZero
+      # Supported Method Parameters::
+      # PWN::SDR::FlipperZero.connect_via_screen(
+      #   block_dev: 'optional - serial block device path (defaults to /dev/ttyACM0)'
+      # )
+
+      public_class_method def self.connect_via_screen(opts = {})
+        block_dev = opts[:block_dev].to_s if File.exist?(
+          opts[:block_dev].to_s
+        )
+
+        block_dev ||= '/dev/ttyACM0'
+
+        screen_bin = '/usr/bin/screen'
+        raise "ERROR: #{screen_bin} not found." unless File.exist?(screen_bin)
+
+        system(
+          screen_bin,
+          block_dev,
+          '115200',
+          '8',
+          'N',
+          '1'
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # flipper_zero_obj = PWN::SDR::FlipperZero.connect(
+      #   block_dev: 'optional serial block device path (defaults to /dev/ttyACM0)',
+      #   baud: 'optional (defaults to 9600)',
+      #   data_bits: 'optional (defaults to 8)',
+      #   stop_bits: 'optional (defaults to 1)',
+      #   parity: 'optional - :even||:odd|:none (defaults to :none)'
+      # )
+
+      public_class_method def self.connect(opts = {})
+        PWN::Plugins::Serial.connect(opts)
+      rescue StandardError => e
+        disconnect(flipper_zero_obj: opts[:flipper_zero_obj]) unless opts[:flipper_zero_obj].nil?
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # response = PWN::SDR::FlipperZero.request(
+      #   flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method',
+      #   payload: 'optional - payload to send to the device (defaults to help)'
+      # )
+      public_class_method def self.request(opts = {})
+        serial_obj = opts[:flipper_zero_obj]
+        payload = opts[:payload] ||= 'help'
+        payload = "#{payload}\r\n"
+
+        PWN::Plugins::Serial.request(
+          serial_obj: serial_obj,
+          payload: payload
+        )
+        sleep 0.1
+        response = PWN::Plugins::Serial.dump_session_data.clone
+        puts response.join
+        PWN::Plugins::Serial.flush_session_data
+
+        response
+      rescue StandardError => e
+        disconnect(flipper_zero_obj: opts[:flipper_zero_obj]) unless opts[:flipper_zero_obj].nil?
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::SDR::FlipperZero.disconnect(
+      #   flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method'
+      # )
+
+      public_class_method def self.disconnect(opts = {})
+        PWN::Plugins::Serial.disconnect(
+          serial_obj: opts[:flipper_zero_obj]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          #{self}.connect_via_screen(
+            block_dev: 'optional serial block device path (defaults to /dev/ttyUSB0)'
+          )
+
+          flipper_zero_obj = #{self}.connect(
+            block_dev: 'optional serial block device path (defaults to /dev/ttyUSB0)',
+            baud: 'optional (defaults to 9600)',
+            data_bits: 'optional (defaults to 8)',
+            stop_bits: 'optional (defaults to 1)',
+            parity: 'optional - :even||:odd|:none (defaults to :none)'
+          )
+
+          response = #{self}.request(
+            flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method',
+            payload: 'required - payload to send to the device'
+          );
+
+          #{self}.disconnect(
+            flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end