pwn 0.5.509 → 0.5.510

data/Gemfile

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+LANG = 'en_US.UTF-8'
+LC_ALL = 'en_US.UTF-8'
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in pwn.gemspec
+gemspec
+
+# *** FYI:
+# In some circumstances custom flags are passed to gems in order
+# to build appropriately.  Defer to ./reinstall_pwn_gemset.sh
+# to review these custom flags (e.g. pg, serialport, etc).
+gem 'activesupport', '<8.1.1'
+gem 'anemone', '0.7.2'
+gem 'authy', '3.0.1'
+gem 'aws-sdk', '3.3.0'
+gem 'barby', '0.7.0'
+gem 'base32', '0.3.4'
+gem 'bitcoin-ruby', '0.0.20'
+gem 'brakeman', '7.1.1'
+gem 'bson', '5.2.0'
+gem 'bundler', '>=4.0.0'
+gem 'bundler-audit', '>=0.9.3'
+gem 'bunny', '2.24.0'
+gem 'colorize', '1.1.0'
+gem 'credit_card_validations', '7.0.0'
+gem 'curses', '1.5.3'
+gem 'diffy', '3.4.4'
+gem 'eventmachine', '1.2.7'
+gem 'executable-hooks', '1.7.1'
+gem 'faker', '3.5.3'
+gem 'faye-websocket', '0.12.0'
+gem 'ffi', '1.17.2'
+# gem 'fftw3', '0.3'
+gem 'gdb', '1.0.0'
+gem 'gem-wrappers', '1.4.0'
+gem 'geocoder', '1.8.6'
+gem 'gist', '6.0.0'
+gem 'gruff', '0.29.0'
+gem 'htmlentities', '4.4.2'
+gem 'ipaddress', '0.8.3'
+gem 'jenkins_api_client2', '1.9.0'
+gem 'js-beautify', '0.1.8'
+gem 'json', '>=2.13.2'
+gem 'jsonpath', '1.1.5'
+gem 'json_schemer', '2.4.0'
+gem 'jwt', '3.1.2'
+gem 'libusb', '0.7.2'
+gem 'luhn', '3.0.0'
+gem 'mail', '2.9.0'
+gem 'meshtastic', '0.0.147'
+gem 'metasm', '1.0.5'
+gem 'mongo', '2.22.0'
+gem 'msfrpc-client', '1.1.2'
+gem 'netaddr', '2.0.6'
+gem 'net-ldap', '0.20.0'
+gem 'net-openvpn', '0.8.7'
+gem 'net-smtp', '0.5.1'
+gem 'nexpose', '7.3.0'
+gem 'nokogiri', '1.18.10'
+gem 'nokogiri-diff', '0.3.0'
+gem 'oily_png', '1.2.1'
+gem 'open3', '0.2.1'
+gem 'os', '1.1.4'
+gem 'ostruct', '0.6.3'
+gem 'packetfu', '2.0.0'
+gem 'packetgen', '4.1.1'
+gem 'pdf-reader', '2.15.0'
+gem 'pg', '1.6.2'
+gem 'pry', '0.15.2'
+gem 'pry-doc', '1.6.0'
+gem 'rake', '13.3.1'
+gem 'rb-readline', '0.5.5'
+gem 'rbvmomi2', '3.8.0'
+gem 'rdoc', '6.16.1'
+gem 'rest-client', '2.1.0'
+gem 'rex', '2.0.13'
+gem 'rmagick', '6.1.4'
+gem 'rqrcode', '3.1.1'
+gem 'rspec', '3.13.2'
+gem 'rtesseract', '3.1.4'
+gem 'rubocop', '1.81.7'
+gem 'rubocop-rake', '0.7.1'
+gem 'rubocop-rspec', '3.8.0'
+gem 'ruby-audio', '1.6.1'
+gem 'ruby-nmap', '1.0.3'
+gem 'ruby-saml', '1.18.1'
+gem 'rvm', '1.11.3.9'
+gem 'savon', '2.15.1'
+gem 'selenium-devtools', '0.142.0'
+gem 'selenium-webdriver', '4.38.0'
+gem 'slack-ruby-client', '3.1.0'
+gem 'socksify', '1.8.1'
+gem 'spreadsheet', '1.3.4'
+gem 'sqlite3', '2.8.1'
+gem 'thin', '2.0.1'
+gem 'tty-prompt', '0.23.1'
+gem 'tty-spinner', '0.9.3'
+gem 'uart', '1.0.0'
+gem 'watir', '7.3.0'
+gem 'waveform', '0.1.3'
+gem 'webrick', '1.9.2'
+gem 'whois', '6.0.3'
+gem 'whois-parser', '2.0.0'
+gem 'wicked_pdf', '2.8.2'
+gem 'yard', '0.9.37'

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2014 0day Inc.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,100 @@
+![PWN](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/PWN.png)
+
+### **Table of Contents** ###
+- [Intro](#intro)
+  * [What is PWN](#what-is-pwn)
+  * [Why PWN](#why-pwn)
+  * [How PWN Works](#how-pwn-works)
+- [Installation](#installation)
+- [General Usage](#general-usage)
+- [Call to Arms](#call-to-arms)
+- [Module Documentation](#module-documentation)
+- [Keep Us Caffeinated](#keep-us-caffeinated)
+- [0x004D65726368](#0x004D65726368)
+
+
+### **Intro** ###
+#### **What is PWN** ####
+PWN (Pronounced /pōn/ or pone), is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation.  Build your own custom automation drivers freely and easily using pre-built modules.
+
+
+#### **Why PWN** ####
+It's easy to agree that while corporate automation is a collection of proprietary source code, the core modules used to produce automated solutions should be open for all eyes to continuously promote trust and innovation...broad collaboration is key to any automation framework's success, particularly in the cyber security arena.
+
+
+#### **How PWN Works** ####
+Leveraging various pre-built modules and the pwn prototyper, you can mix-and-match modules to test, record, replay, and rollout your own custom security automation packages known as, "drivers." Here are some [example drivers](https://github.com/0dayInc/pwn/tree/master/bin) distributed with PWN.
+
+
+
+#### **Installation** ####
+Tested on Debian-Based Linux Distros, & OSX leveraging Ruby via RVM.
+
+```
+$ cd /opt
+$ sudo git clone https://github.com/0dayinc/pwn
+$ cd /opt/pwn
+$ ./install.sh
+$ ./install.sh ruby-gem
+$ pwn
+pwn[v0.5.510]:001 >>> PWN.help
+```
+
+[![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
+
+### **General Usage** ###
+[General Usage Quick-Start](https://github.com/0dayinc/pwn/wiki/General-PWN-Usage)
+
+It's wise to update pwn often as numerous versions are released/week:
+```
+$ rvm list gemsets
+$ rvm use ruby-3.4.7@pwn
+$ gem uninstall --all --executables pwn
+$ gem install --verbose pwn
+$ pwn
+pwn[v0.5.510]:001 >>> PWN.help
+```
+
+If you're using a multi-user install of RVM do:
+```
+$ rvm list gemsets
+$ rvm use ruby-3.4.7@pwn
+$ rvmsudo gem uninstall --all --executables pwn
+$ rvmsudo gem install --verbose pwn
+$ pwn
+pwn[v0.5.510]:001 >>> PWN.help
+```
+
+PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:
+```
+$ /opt/pwn/vagrant/provisioners/pwn.sh
+```
+This should update Ruby, create the necessary pwn gemset within the latest Ruby version, etc.  It's important to note that if you're running an older version of ruby, you can only upgrade the `pwn` gem to the latest version supported by the earlier version of Ruby.
+
+
+### **Call to Arms** ###
+If you're willing to provide access to commercial security tools (e.g. Rapid7's Nexpose, Tenable Nessus, QualysGuard, HP WebInspect, IBM Appscan, etc) please [email us](mailto:support@0dayinc.com).  This will continue to promote PWNs interoperability w/ industry-recognized security tools moving forward.  Additionally if you want to contribute to this framework's success, check out our [How to Contribute](https://github.com/0dayInc/pwn/blob/master/CONTRIBUTING.md).
+
+
+### **Module Documentation** ###
+Additional documentation on using PWN can be found on [RubyGems.org](https://www.rubydoc.info/gems/pwn)
+
+I hope you enjoy PWN and remember...ensure you always have permission prior to carrying out any sort of hacktivities.  Now - go pwn all the things!
+
+### **Keep Us Caffeinated** ###
+If you've found this project useful and you're interested in supporting our efforts, we invite you to take a brief moment to keep us caffeinated:
+
+[![Coffee](https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png)](https://buymeacoff.ee/0dayinc)
+
+
+### [**0x004D65726368**](https://0day.myspreadshop.com/) ###
+
+[![PWN Sticker](https://image.spreadshirtmedia.com/image-server/v1/products/T1459A839PA3861PT28D1044068794FS8193/views/1,width=300,height=300,appearanceId=839,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/stickers)
+
+[![Coffee Mug](https://image.spreadshirtmedia.com/image-server/v1/products/T1313A1PA3933PT10X2Y25D1020472680FS6327/views/3,width=300,height=300,appearanceId=1,backgroundColor=000000/https0dayinccom.jpg)](https://0day.myspreadshop.com/accessories+mugs+%26+drinkware)
+
+[![Mouse Pad](https://image.spreadshirtmedia.com/image-server/v1/products/T993A1PA2168PT10X162Y26D1044068794S100/views/1,width=300,height=300,appearanceId=1,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/accessories)
+
+[![0day Inc.](https://image.spreadshirtmedia.com/image-server/v1/products/T951A550PA3076PT17X0Y73D1020472680FS8515/views/1,width=300,height=300,appearanceId=70,backgroundColor=000000/https0dayinccom.jpg)](https://shop.spreadshirt.com/0day/0dayinc-A5c3e498cf937643162a01b5f?productType=951&appearance=70)
+
+[![Black Fingerprint Hoodie](https://image.spreadshirtmedia.com/image-server/v1/products/T111A2PA3208PT17X169Y51D1020472728FS6268/views/1,width=300,height=300,appearanceId=2/https0dayinccom.jpg)](https://shop.spreadshirt.com/0day/blackfingerprint-A5c3e49db1cbf3a0b9596b4d0?productType=111&appearance=2)

data/Rakefile

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+require 'rdoc/task'
+require 'rubocop/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+RuboCop::RakeTask.new do |rubocop|
+  config_file = '.rubocop.yml'
+  rubocop.options = ['-E', '-S', '-c', config_file]
+end
+
+RDoc::Task.new do |rdoc|
+  rdoc.rdoc_files.include('lib/**/*.rb')
+  rdoc.rdoc_dir = 'rdoc'
+end
+
+task default: %i[spec rubocop rdoc]

data/Vagrantfile

@@ -0,0 +1,250 @@
+# frozen_string_literal: true
+
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+require 'yaml'
+require 'pathname'
+
+API_VERSION = '2'
+pwn_root = Pathname.new(__FILE__).realpath.expand_path.parent
+vagrant_gui = ENV.fetch('VAGRANT_GUI') if ENV.fetch('VAGRANT_GUI')
+pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.fetch('PWN_PROVIDER')
+runtime_userland = 'vagrant_rsync_userland_configs.lst'
+template_userland = "#{pwn_root}/vagrant_rsync_userland_template.lst"
+
+if pwn_provider == 'docker'
+  docker_container_target = ENV.fetch('DOCKER_CONTAINER_TARGET') if ENV.fetch('DOCKER_CONTAINER_TARGET')
+  docker_create_args = [
+    '--interactive',
+    '--tty'
+  ]
+
+  case docker_container_target
+  when 'docker_pwn_prototyper'
+    docker_container_image = '0dayinc/pwn_prototyper'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'echo PWN.help | pwn && pwn'
+    ]
+  when 'docker_pwn_fuzz_net_app_proto'
+    docker_container_image = '0dayinc/pwn_fuzz_net_app_proto'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_fuzz_net_app_proto; bash'
+    ]
+  when 'docker_pwn_transparent_browser'
+    docker_container_image = '0dayinc/pwn_transparent_browser'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'echo PWN::Plugins::TransparentBrowser.help | pwn && pwn'
+    ]
+  when 'docker_pwn_sast'
+    docker_container_image = '0dayinc/pwn_sast'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_sast; bash'
+    ]
+  when 'docker_pwn_www_checkip'
+    docker_container_image = '0dayinc/pwn_www_checkip'
+    docker_cmd = [
+      '--login',
+      '-c',
+      'pwn_www_checkip -h; bash'
+    ]
+  else
+    raise "Unknown DOCKER_CONTAINER_TARGET: #{docker_container_target}"
+  end
+
+  Vagrant.configure(API_VERSION) do |config|
+    # config.ssh.username = 'root'
+    config.vm.define docker_container_target do
+      config.vm.synced_folder('.', '/vagrant', disabled: true)
+      config.vm.provider :docker do |d|
+        d.name = docker_container_target
+        d.image = docker_container_image
+        d.create_args = docker_create_args
+        d.cmd = docker_cmd
+        d.volumes = ['/tmp:/tmp']
+        # d.has_ssh = true
+      end
+    end
+  end
+else
+  puts 'GUI ENABLED.' if vagrant_gui
+
+  Vagrant.configure(API_VERSION) do |config|
+    config.vm.box = 'pwn/kali_rolling'
+    config.ssh.username = 'admin'
+
+    r = Random.new
+    ssh_port = r.rand(1_025...65_535)
+    config.vm.network 'forwarded_port', guest: 22, host: ssh_port, id: 'ssh', auto_correct: true
+
+    config.vm.synced_folder(
+      '.',
+      '/opt/pwn',
+      type: 'rsync',
+      rsync__args: [
+        '--progress',
+        "--rsync-path='/usr/bin/sudo rsync'",
+        '--archive',
+        '--delete',
+        '-compress',
+        '--recursive',
+        '--files-from=vagrant_rsync_third_party.lst',
+        '--ignore-missing-args'
+      ]
+    )
+
+    File.open(runtime_userland, 'w') do |f|
+      File.readlines(template_userland).each do |line|
+        f.puts "etc/userland/#{pwn_provider}/#{line.chomp}"
+      end
+    end
+
+    config.vm.synced_folder(
+      '.',
+      '/opt/pwn',
+      type: 'rsync',
+      rsync__args: [
+        '--progress',
+        "--rsync-path='/usr/bin/sudo rsync'",
+        '--archive',
+        '--delete',
+        '-compress',
+        '--recursive',
+        "--files-from=#{runtime_userland}",
+        '--ignore-missing-args'
+      ]
+    )
+
+    # Load UserLand Configs for Respective Provider
+    case pwn_provider
+    when 'aws'
+      config_path = './etc/userland/aws/vagrant.yaml'
+    when 'virtualbox'
+      config_path = './etc/userland/virtualbox/vagrant.yaml'
+      # config.vm.network('public_network')
+    when 'vmware'
+      config_path = './etc/userland/vmware/vagrant.yaml'
+      # config.vm.network('public_network')
+    else
+      # This is needed when vagrant ssh is executed
+      config_path = ''
+    end
+
+    if File.exist?(config_path)
+      yaml_config = YAML.load_file(config_path)
+
+      hostname = yaml_config['hostname']
+      config.vm.hostname = hostname
+
+      config.vm.provider :virtualbox do |vb, _override|
+        if pwn_provider == 'virtualbox'
+          vb.gui = false
+          vb.gui = true if vagrant_gui == 'true'
+
+          vb.customize ['modifyvm', :id, '--clipboard', 'bidirectional']
+          vb.customize ['modifyvm', :id, '--draganddrop', 'bidirectional']
+          vb.customize ['modifyvm', :id, '--cpus', yaml_config['cpus']]
+          vb.customize ['modifyvm', :id, '--memory', yaml_config['memory']]
+          # disk_mb = yaml_config['diskMB']
+          # TODO: resize vmdk based on /pwn/etc/userland/vmware/vagrant.yaml
+        end
+      end
+
+      %i[vmware_fusion vmware_workstation].each do |vmware_provider|
+        config.vm.provider vmware_provider do |vm, _override|
+          # Workaround until https://github.com/hashicorp/vagrant/issues/10730 is resolved
+          vm.ssh_info_public = true
+          vm.whitelist_verified = true
+          if pwn_provider == 'vmware'
+            if vagrant_gui == 'true'
+              vm.gui = true
+            else
+              vm.gui = false
+            end
+            # vagrant_vmware_license = yaml_config['vagrant_vmware_license']
+            vm.vmx['numvcpus'] = yaml_config['cpus']
+            vm.vmx['memsize'] = yaml_config['memory']
+            vm.vmx['vhv.enable'] = 'true'
+            # disk_mb = yaml_config['diskMB']
+            # TODO: resize vmdk based on /pwn/etc/userland/vmware/vagrant.yaml
+          end
+        end
+      end
+
+      config.vm.provider :aws do |aws, override|
+        if pwn_provider == 'aws'
+          override.vm.box = 'dummy'
+
+          # aws_init_script = "#!/bin/bash\necho \"Updating FQDN: #{hostname}\"\ncat /etc/hosts | grep \"#{hostname}\" || sudo sed 's/127.0.0.1/127.0.0.1 #{hostname}/g' -i /etc/hosts\nhostname | grep \"#{hostname}\" || sudo hostname \"#{hostname}\"\nsudo sed -i -e 's/^Defaults.*requiretty/# Defaults requiretty/g' /etc/sudoers\necho 'Defaults:admin !requiretty' >> /etc/sudoers"
+
+          aws.access_key_id = yaml_config['access_key_id']
+          aws.secret_access_key = yaml_config['secret_access_key']
+          aws.session_token = yaml_config['session_token']
+          aws.keypair_name = yaml_config['keypair_name']
+
+          case yaml_config['region']
+          when 'us-east-1'
+            aws.ami = 'ami-02eb1a4c830533086'
+          when 'us-east-2'
+            aws.ami = 'ami-0ec0b569397da65f4'
+          when 'us-west-1'
+            aws.ami = 'ami-0485cc5cdb2c13dd9'
+          when 'us-west-2'
+            aws.ami = 'ami-0a3b38548723847de'
+          else
+            raise "Error: #{yaml_config['region']} not supported."
+          end
+
+          aws.block_device_mapping = yaml_config['block_device_mapping']
+          aws.region = yaml_config['region']
+          aws.monitoring = yaml_config['monitoring']
+          aws.elastic_ip = yaml_config['elastic_ip']
+          aws.associate_public_ip = yaml_config['associate_public_ip']
+          aws.private_ip_address = yaml_config['private_ip_address']
+          aws.subnet_id = yaml_config['subnet_id']
+          aws.instance_type = yaml_config['instance_type']
+          aws.iam_instance_profile_name = yaml_config['iam_instance_profile_name']
+          aws.security_groups = yaml_config['security_groups']
+          aws.tags = yaml_config['tags']
+          # Hack for dealing w/ images that require a pty when using sudo and changing hostname
+          # aws.user_data = aws_init_script
+
+          override.ssh.username = 'admin'
+          override.ssh.private_key_path = yaml_config['ssh_private_key_path']
+          override.dns.record_sets = yaml_config['record_sets']
+        end
+      end
+
+      # Set PWN_PROVIDER for Guest Deployment
+      config.vm.provision :shell, inline: "echo \"export PWN_ROOT='#{pwn_root}'\" > /etc/profile.d/pwn_envs.sh"
+      config.vm.provision :shell, inline: "echo \"export PWN_PROVIDER='#{pwn_provider}'\" >> /etc/profile.d/pwn_envs.sh"
+      # Provision Software Based on UserLand Configurations w/in vagrant_rsync_userland_configs.lst
+      # After PWN Box has Booted
+      config.vm.provision :shell, path: './vagrant/provisioners/init_env.sh', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/kali_customize.rb', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/pwn.sh', args: hostname, privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/postgres.sh', args: hostname, privileged: false
+      # AWS EC2 Storage is handled via EBS Volumes
+      unless pwn_provider == 'aws'
+        config.vm.provision :shell, path: './vagrant/provisioners/userland_fdisk.sh', args: hostname, privileged: false
+        config.vm.provision :reload
+        config.vm.provision :shell, path: './vagrant/provisioners/userland_lvm.sh', args: hostname, privileged: false
+      end
+      config.vm.provision :shell, path: './vagrant/provisioners/metasploit.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/openvas.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/burpsuite_pro.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/jenkins.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/apache2.sh', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/jenkins_ssh-keygen.rb', privileged: false
+      config.vm.provision :shell, path: './vagrant/provisioners/post_install.sh', privileged: false
+    end
+  end
+end
+File.unlink(runtime_userland)

data/bin/pwn

@@ -0,0 +1,30 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+
+pwn_driver = PWN::Driver::Parser.new
+pwn_driver.auto_opts_help = false
+pwn_driver.parse!
+
+begin
+  pwn_pid = Process.pid
+  PWN::Plugins::REPL.start
+rescue StandardError => e
+  raise e
+ensure
+  ps_list_arr = PWN::Plugins::PS.list
+
+  kid_pids_arr = ps_list_arr.select { |ps_line| ps_line[3] == pwn_pid.to_s }
+  # pp kid_pids_arr
+
+  grandkid_pids_arr = []
+  kid_pids_arr.each do |kid_pid|
+    gk_arr = ps_list_arr.select { |ps_line| ps_line[3] == kid_pid[2] }
+    gk_arr.each { |gk| grandkid_pids_arr.push(gk) }
+  end
+  # pp grandkid_pids_arr
+
+  PWN::Plugins::PS.cleanup_pids(pids_arr: grandkid_pids_arr)
+  PWN::Plugins::PS.cleanup_pids(pids_arr: kid_pids_arr)
+end

data/bin/pwn_android_war_dialer

@@ -0,0 +1,151 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'pwn'
+require 'waveform'
+
+opts = PWN::Env[:driver_opts]
+PWN::Driver::Parser.new do |options|
+  options.on('-fFROM', '--from=FROM', '<Required - Dial Range from (Beginning Number)>') do |f|
+    opts[:from_num] = f
+  end
+
+  options.on('-tTO', '--to=TO', '<Required - Dial Range to (Ending Number)>') do |t|
+    opts[:to_num] = t
+  end
+
+  options.on('-sSEC', '--seconds-to-record=SEC', '<Required - Seconds to Record >') do |s|
+    opts[:seconds_to_record] = s
+  end
+
+  options.on('-aADB', '--adb-path=ADB', '<Required - Path to ADB (Android Debug Bridge)>') do |adb|
+    opts[:adb_bin] = adb
+  end
+
+  options.on('-SSOX', '--sox-path=SOX', '<Required - Path to SoX Binary, the Swiss Army knife of Audio>') do |sox|
+    opts[:sox_bin] = sox
+  end
+
+  options.on('-wWAV', '--wav-archive-dir=WAV', '<Required - Directory Path to Store WAV Files>') do |wav|
+    opts[:wav_archive] = wav
+  end
+
+  options.on('-r', '--[no-]randomize', '<Optional - Randomize Number Range (Defaults to false)>') do |r|
+    opts[:randomize] = r
+  end
+
+  options.on('-dSEC', '--delay-between-calls=SEC', '<Optional - Seconds to Delay Between Calls (Defaults to 0)>') do |d|
+    opts[:seconds_to_delay_between_calls] = d
+  end
+end.parse!
+
+# Required Flag Variables
+from_num = opts[:from_num].to_s.scrub.strip.chomp.delete('(').delete(')').delete('-').delete('.').delete('+').to_i
+to_num = opts[:to_num].to_s.scrub.strip.chomp.delete('(').delete(')').delete('-').delete('.').delete('+').to_i
+seconds_to_record = opts[:seconds_to_record].to_i
+adb_bin = opts[:adb_bin] if File.exist?(opts[:adb_bin].to_s.scrub.strip.chomp)
+sox_bin = opts[:sox_bin] if File.exist?(opts[:sox_bin].to_s.scrub.strip.chomp)
+wav_archive = opts[:wav_archive].to_s.scrub.strip.chomp if Dir.exist?(opts[:wav_archive].to_s.scrub.strip.chomp)
+waveform_bin = 'waveform'
+
+# Optional Flag Variables
+randomize = opts[:randomize]
+seconds_to_delay_between_calls = opts[:seconds_to_delay_between_calls].to_i
+
+# Colors!
+red = "\e[31m"
+green = "\e[32m"
+yellow = "\e[33m"
+cayan = "\e[36m"
+end_of_color = "\e[0m"
+
+raise 'ERROR: --from value must be <= --to value' if from_num > to_num
+
+begin
+  $stdout.sync = true
+  range = []
+  # Prepare the targets for assessment
+  (from_num..to_num).each { |number| range.push(number) }
+
+  # Randomize targets if applicable
+  range.shuffle! if randomize
+
+  range.each do |target_num|
+    start_timestamp = Time.now.strftime('%Y-%m-%d.%H.%M.%S')
+    puts "#{green}#{start_timestamp} >>>#{end_of_color} #{yellow}dialing #{target_num}#{end_of_color}"
+    PWN::Plugins::Android.adb_sh(
+      adb_path: adb_bin,
+      command: "am start -a android.intent.action.CALL -d tel:'#{target_num}'"
+    )
+
+    # Record Call
+    pid_to_kill = 0
+    wav_file = "#{wav_archive}/#{target_num}-#{start_timestamp}.wav"
+
+    puts red
+    puts "Recording Duration: #{seconds_to_record}s"
+    system(
+      sox_bin,
+      '-d',
+      wav_file,
+      'trim',
+      '0',
+      seconds_to_record.to_s
+    )
+
+    puts 'Complete.'
+    puts end_of_color
+
+    ending_timestamp = Time.now.strftime('%Y-%m-%d.%H.%M.%S')
+    print "#{yellow}#{ending_timestamp} >>> #{end_of_color}"
+    PWN::Plugins::Android.adb_sh(
+      adb_path: adb_bin,
+      command: 'input keyevent KEYCODE_ENDCALL'
+    )
+    puts "#{green}hung up #{target_num}#{end_of_color}"
+
+    puts cayan
+    puts 'Generating Audio Spectrogram...'
+    system(
+      sox_bin,
+      wav_file,
+      '-n',
+      'spectrogram',
+      '-o',
+      "#{wav_file}-spectrogram.png",
+      '-d',
+      seconds_to_record.to_s
+    )
+
+    puts 'Generating Audio Waveform...'
+    system(
+      waveform_bin,
+      '-c',
+      '#FF0000',
+      '-b',
+      '#000000',
+      '-F',
+      wav_file,
+      "#{wav_file}-waveform.png"
+    )
+    puts 'Complete.'
+    puts end_of_color
+
+    if seconds_to_delay_between_calls.positive? # Greater than 0
+      (1..seconds_to_delay_between_calls).reverse_each do |countdown|
+        print "#{red}delay #{seconds_to_delay_between_calls}s until next call: #{format('%-9.9s', countdown)}#{end_of_color}"
+        print "\r"
+        sleep 1
+      end
+      puts "\n#{green}waking up \\o/#{end_of_color}"
+    end
+    puts "\n\n\n"
+  end
+rescue StandardError => e
+  raise e.message
+ensure
+  PWN::Plugins::Android.adb_sh(
+    adb_path: adb_bin,
+    command: 'input keyevent KEYCODE_ENDCALL'
+  )
+end