pwn 0.5.509 → 0.5.510

data/lib/pwn/plugins/json_pathify.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'jsonpath'
+
+module PWN
+  module Plugins
+    # This plugin is for leveraging XPath-like searching capabilities for JSON data structures
+    module JSONPathify
+      # Supported Method Parameters::
+      # PWN::Plugins::JSONPathify.search_key(
+      #   json_data_struct: "required JSON data structure",
+      #   key: "required key to find in JSON data structure. returns key values"
+      # )
+
+      public_class_method def self.search_key(opts = {})
+        key = opts[:key]
+        json_data_struct = opts[:json_data_struct]
+
+        json_path = JsonPath.new("$..#{key}")
+        json_path.on(json_data_struct)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts %{USAGE:
+          json_path_arr = #{self}.search_key(
+            json_data_struct: "required JSON data structure",
+            key: "required key to find in JSON data structure. returns key values"
+          )
+          #{self}.authors
+        }
+      end
+    end
+  end
+end

data/lib/pwn/plugins/log.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'logger'
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # This plugin is used to instantiate a PWN logger with a custom message format
+    module Log
+      # Supported Method Parameters::
+      # PWN::Log.create(
+      # )
+      public_class_method def self.append(opts = {})
+        level = opts[:level].to_s.downcase.to_sym
+        msg = opts[:msg]
+        which_self = opts[:which_self].to_s
+
+        driver_name = File.basename($PROGRAM_NAME)
+
+        # Only attempt to exit gracefully if level == :error
+        exit_gracefully = false
+
+        # Define Date / Time Format
+        datetime_str = '%Y-%m-%d %H:%M:%S.%N%z'
+
+        # Always append to log file
+        if level == :learning
+          session = SecureRandom.hex
+          log_file_path = "/tmp/pwn-ai-#{session}.json" if level == :learning
+          log_file = File.open(log_file_path, 'w')
+        else
+          log_file_path = '/tmp/pwn.log'
+          log_file = File.open(log_file_path, 'a')
+        end
+
+        # Leave 10 "old" log files where
+        # each file is ~ 1,024,000 bytes
+        logger = Logger.new(
+          log_file,
+          10,
+          1_024_000
+        )
+        logger.datetime_format = datetime_str
+
+        case level
+        when :debug
+          logger.level = Logger::DEBUG
+        when :error
+          logger.level = Logger::ERROR
+          exit_gracefully = true unless driver_name == 'pwn'
+          puts "\nERROR: See #{log_file_path} for more details." if driver_name == 'pwn'
+        when :fatal
+          logger.level = Logger::FATAL
+          puts "\n FATAL ERROR: See #{log_file_path} for more details." if driver_name == 'pwn'
+        when :info, :learning
+          logger.level = Logger::INFO
+        when :unknown
+          logger.level = Logger::UNKNOWN
+        when :warn
+          logger.level = Logger::WARN
+        else
+          level_error = "ERROR: Invalid log level. Valid options are:\n"
+          level_error += ":debug\n:error\n:fatal\n:info\n:learning\n:unknown\n:warn\n"
+          raise level_error
+        end
+
+        if level == :learning
+          log_event = msg
+          logger.formatter = proc do |_severity, _datetime, _progname, learning_arr|
+            JSON.pretty_generate(
+              learning_data: learning_arr
+            )
+          end
+        else
+          log_event = "driver: #{driver_name}"
+
+          if msg.instance_of?(Interrupt)
+            logger.level = Logger::WARN
+            if driver_name == 'pwn'
+              log_event += ' => CTRL+C Detected.'
+            else
+              log_event += ' => CTRL+C Detected...Exiting Session.'
+              exit_gracefully = true unless driver_name == 'pwn'
+            end
+          else
+            log_event += " => #{msg}"
+            if msg.respond_to?('backtrace') && !msg.instance_of?(Errno::ECONNRESET)
+              log_event += " => \n\t#{msg.backtrace.join("\n\t")}"
+              log_event += "\n\n\n"
+            end
+          end
+        end
+
+        logger.add(logger.level, log_event, which_self)
+      rescue Interrupt
+        puts "\n#{self}.#{__method__} => Goodbye."
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          logger = #{self}.append(
+            level: 'required - log verbosity :debug|:error|:fatal|:info|:learning|:unknown|:warn',
+            msg: 'required - message to log',
+            which_self: 'required - pass in self object from module calling #{self}'
+          )
+        "
+      end
+    end
+  end
+end

data/lib/pwn/plugins/mail_agent.rb

@@ -0,0 +1,344 @@
+# frozen_string_literal: true
+
+module PWN
+  module Plugins
+    # This plugin is used for sending email from multiple mail agents such as
+    # corporate mail, yahoo, hotmail/live, and mail relays (spoofing).  Supports
+    # sending multiple file attachments and works pretty well.
+    module MailAgent
+      # Supported Method Parameters::
+      # parent_mail_agent(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   address: 'smtp server ip or domain',
+      #   port: 'smtp port',
+      #   tls_auto: true|false,
+      #   username: 'optional',
+      #   password: 'optional',
+      #   debug: true|false
+      # )
+      @@logger = PWN::Plugins::PWNLogger.create
+
+      private_class_method def self.parent_mail_agent(opts = {})
+        from = opts[:from]
+        to = opts[:to]
+        cc = opts[:cc]
+        bcc = opts[:bcc]
+        reply_to = opts[:reply_to]
+        subject = opts[:subject]
+        html_body = opts[:html_body]
+        txt_body = opts[:txt_body] # If HTML is NOT supported or desired
+        authentication = opts[:authentication]
+        attachments_hash = {}
+        opts[:attachments_hash]&.each do |attachment_name, attachment_path|
+          attachments_hash[attachment_name] = File.binread(attachment_path)
+        end
+
+        debug = opts[:debug]
+
+        address = opts[:address]
+        port = opts[:port]
+        tls_auto = opts[:tls_auto]
+        username = opts[:username]
+        password = if !username.nil? && opts[:password].nil?
+                     PWN::Plugins::AuthenticationHelper.mask_password
+                   else
+                     opts[:password]
+                   end
+
+        @@logger.info("DEBUG ENABLED: from: #{from.inspect}, to: #{to.inspect}, cc: #{cc.inspect}, bcc: #{bcc.inspect}, reply_to: #{reply_to} subject: #{subject.inspect}, html_body: #{html_body.inspect}, txt_body: #{txt_body.inspect}, attachments: #{attachments_hash.inspect}, address: #{address.inspect}, port: #{port.inspect}, username: #{username.inspect}, password: #{password.inspect} enable_starttls_auto: #{tls_auto.inspect}, authentication: #{authentication.inspect}") if debug == true
+        # The :body symbol below is known to be problematic until the author of pony fixes it.  better to use :html_body symbol
+        PWN::Plugins::Pony.mail(
+          from: from,
+          to: to,
+          cc: cc,
+          bcc: bcc,
+          reply_to: reply_to,
+          subject: subject,
+          html_body: html_body,
+          body: txt_body,
+          attachments: attachments_hash,
+          via: :smtp,
+          via_options: {
+            address: address,
+            port: port,
+            enable_starttls_auto: tls_auto,
+            user_name: username,
+            password: password,
+            authentication: authentication.to_sym,
+            domain: 'localhost.localdomain'
+          }
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.office365(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required username',
+      #   password: 'optional (but will be prompted if not submitted)',
+      #   debug: true|false
+      # )
+
+      public_class_method def self.office365(opts = {})
+        # Send mail from corporate mail solution
+        opts[:address] = 'smtp.office365.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :login
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.gmail(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.gmail(opts = {})
+        opts[:address] = 'smtp.gmail.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.hotmail_n_live(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.hotmail_n_live(opts = {})
+        opts[:address] = 'smtp.live.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.yahoo(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   username: 'required',
+      #   password: 'optional (but will be prompted if not submitted)'
+      #   debug: true|false
+      # )
+
+      public_class_method def self.yahoo(opts = {})
+        opts[:address] = 'smtp.mail.yahoo.com'
+        opts[:port] = 587
+        opts[:tls_auto] = true
+        opts[:authentication] = :plain
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::MailAgent.manual(
+      #   from: 'required',
+      #   to: 'required',
+      #   cc: 'optional',
+      #   bcc: 'optional',
+      #   reply_to: 'optional',
+      #   subject: 'optional',
+      #   html_body: 'optional',
+      #   txt_body: 'optional alternative to :html_body',
+      #   attachments_hash: {
+      #     'attachment_name1.doc': 'attachment file path 1',
+      #     'attachment_name2.xls': 'attachment file path 2'
+      #   },
+      #   address: 'smtp server ip or domain',
+      #   port: 'smtp port',
+      #   tls_auto: true|false,
+      #   username: 'optional',
+      #   password: 'optional',
+      #   debug: true|false
+      # )
+
+      public_class_method def self.manual(opts = {})
+        # Spoof mail from known relay
+        opts[:authentication] = :plain if opts[:authentication].nil?
+        parent_mail_agent(opts)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          #{self}.office365(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required domain\\username',
+            password: 'optional (but will be prompted if not submitted)',
+            debug: true|false
+          )
+
+          #{self}.gmail(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.hotmail_n_live(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.yahoo(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            username: 'required',
+            password: 'optional (but will be prompted if not submitted)'
+            debug: true|false
+          )
+
+          #{self}.manual(
+            from: 'required',
+            to: 'required',
+            cc: 'optional',
+            bcc: 'optional',
+            reply_to: 'optional',
+            subject: 'optional',
+            html_body: 'optional',
+            txt_body: 'optional alternative to :html_body',
+            attachments_hash: {
+              'attachment_name1.doc': 'attachment file path 1',
+              'attachment_name2.xls': 'attachment file path 2'
+            },
+            address: 'smtp server ip or domain',
+            port: 'smtp port',
+            tls_auto: true|false,
+            authentication: 'optional defaults to :plain - available :login, :plain, or :cram_md5',
+            username: 'optional',
+            password: 'optional',
+            debug: true|false
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/plugins/metasploit.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'msfrpc-client'
+require 'yaml'
+require 'json'
+
+module PWN
+  module Plugins
+    # Plugin used to integrate Metasploit into PWN leveraging a listening MSFRPCD daemon.
+    module Metasploit
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.connect(
+      #   yaml_conf: 'optional -  path to userland yaml (defaults to /pwn/etc/userland/PWN_PROVIDEDR/metasploit/vagrant.yaml)'
+      # )
+
+      public_class_method def self.connect(opts = {})
+        if opts[:yaml_conf] && File.exist?(opts[:yaml_conf])
+          yaml_conf = YAML.load_file(opts[:yaml_conf].to_s.strip.chomp.scrub)
+        else
+          pwn_root = ENV.fetch('PWN_ROOT') if ENV.fetch('PWN_ROOT')
+          pwn_provider = ENV.fetch('PWN_PROVIDER') if ENV.fetch('PWN_PROVIDER')
+          yaml_conf = YAML.load_file("#{pwn_root}/etc/userland/#{pwn_provider}/metasploit/vagrant.yaml")
+        end
+
+        msfrpcd_host = yaml_conf['msfrpcd_host'].to_s
+        port = yaml_conf['port'].to_i
+        username = yaml_conf['username'].to_s
+        password = yaml_conf['password'].to_s
+
+        msfrpcd_conn = Msf::RPC::Client.new
+        msfrpcd_conn.info[:host] = msfrpcd_host
+        msfrpcd_conn.info[:port] = port
+        msfrpcd_conn.login(username, password)
+
+        console_obj = {}
+        console_obj[:msfrpcd_conn] = msfrpcd_conn
+        msfrpcd_resp = msfrpcd_conn.call('console.create')
+        session = JSON.parse(msfrpcd_resp.to_json, symbolize_names: true)
+        console_obj[:session] = session
+
+        console_obj
+      rescue StandardError => e
+        raise "#{e}\nIs the msfrpcd daemon running on #{msfrpcd_host}?"
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.queue_console_cmd(
+      #   console_obj: 'required - console_obj object returned from #connect method',
+      #   cmd: 'required - msfconsole command string or array of strings'
+      # )
+      private_class_method def self.queue_console_cmd(opts = {})
+        console_obj = opts[:console_obj]
+        cmd = opts[:cmd].to_s.strip.chomp.scrub
+
+        msfrpcd_conn = console_obj[:msfrpcd_conn]
+        console_obj[:last_cmd] = cmd
+        console_id = console_obj[:session][:id]
+        msfrpcd_conn.call('console.read', console_id)
+        msfrpcd_conn.call('console.write', console_id, "#{cmd}\n")
+
+        loop do
+          sleep(1)
+          msfrpcd_resp = msfrpcd_conn.call('console.read', console_id)
+          next unless msfrpcd_resp.instance_of?(Hash)
+
+          last_cmd_result = JSON.parse(msfrpcd_resp.to_json, symbolize_names: true)
+          console_obj[:last_cmd_result] = last_cmd_result
+
+          if console_obj[:last_cmd_result][:busy] == true
+            print '.'
+            next
+          end
+          puts "\n#{console_obj[:last_cmd_result][:data]}" unless console_obj[:last_cmd_result][:data].nil?
+          break
+        end
+
+        console_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.console_exec(
+      #   console_obj: 'required - console_obj object returned from #connect method',
+      #   cmd: 'required - msfconsole command string or array of strings'
+      # )
+      public_class_method def self.console_exec(opts = {})
+        console_obj = opts[:console_obj]
+        cmd = opts[:cmd]
+
+        case cmd
+        when String
+          console_obj = queue_console_cmd(console_obj: console_obj, cmd: cmd)
+        when Array
+          cmd.each { |this_cmd| console_obj = queue_console_cmd(console_obj: console_obj, cmd: this_cmd) }
+        else
+          raise "ERROR: cmd parameter must be a String or Array object - object is currently #{cmd.class}"
+        end
+
+        console_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # console_obj = PWN::Plugins::Metasploit.disconnect(
+      #   console_obj: 'required - console_obj returned from #console_exec method to terminate'
+      # )
+      public_class_method def self.disconnect(opts = {})
+        console_obj = opts[:console_obj]
+        msfrpcd_conn = console_obj[:msfrpcd_conn]
+        console_id = console_obj[:session][:id]
+        msfrpcd_conn.call('console.destroy', console_id)
+        msfrpcd_conn.call('auth.logout', msfrpcd_conn.token)
+
+        console_obj = nil
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          console_obj = #{self}.connect(
+            yaml_conf: 'optional -  path to userland yaml (defaults to $PWN_ROOT/etc/userland/$PWN_PROVIDER/metasploit/vagrant.yaml)'
+          )
+
+          console_obj = #{self}.console_exec(
+            console_obj: 'required - msfrpcd_conn object returned from #connect method',
+            cmd: 'required - msfconsole command string or array of strings'
+          )
+
+          console_obj = #{self}.disconnect(
+            console_obj: 'required - msfrpcd_conn object returned from #connect method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end