pwn 0.5.708 → 0.5.709

data/lib/pwn/plugins/radare2.rb

@@ -0,0 +1,253 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # Persistent r2pipe-style session: open/cmd/cmdj/close plus helpers.
+    module Radare2
+      @sessions = {}
+
+      public_class_method def self.required_bins
+        %w[r2]
+      end
+
+      # Supported Method Parameters::
+      # session = PWN::Plugins::Radare2.open(
+      #   path: 'required - filesystem path to the binary r2 should open'
+      # )
+      public_class_method def self.open(opts = {})
+        PWN::Plugins::Doctor.require_bin!(name: 'r2')
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: binary not found: #{path}" unless File.file?(path)
+
+        stdin, stdout, waiter = Open3.popen2('r2', '-q0', '-e', 'scr.color=0', path)
+        sid = SecureRandom.hex(8)
+        @sessions[sid] = { stdin: stdin, stdout: stdout, waiter: waiter, path: path }
+        read_until_null(io: stdout)
+        sid
+      end
+
+      # Supported Method Parameters::
+      # text = PWN::Plugins::Radare2.cmd(
+      #   session: 'required - session id returned by #open',
+      #   cmd: 'required - r2 command to run; returns raw text (e.g. pdf @ main)'
+      # )
+      public_class_method def self.cmd(opts = {})
+        sess = session!(opts)
+        line = opts[:cmd].to_s
+        raise 'ERROR: cmd is required' if line.empty?
+
+        sess[:stdin].write("#{line}\n")
+        sess[:stdin].flush
+        read_until_null(io: sess[:stdout])
+      end
+
+      # Supported Method Parameters::
+      # json = PWN::Plugins::Radare2.cmdj(
+      #   session: 'required - session id returned by #open',
+      #   cmd: 'required - r2 command; trailing j is added if missing and stdout is JSON.parse (e.g. afl or aflj)'
+      # )
+      public_class_method def self.cmdj(opts = {})
+        raw = cmd(opts.merge(cmd: opts[:cmd].to_s.sub(/j?\z/, 'j')))
+        JSON.parse(raw)
+      rescue JSON::ParserError
+        raw
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.close(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.close(opts = {})
+        sess = session!(opts)
+        sess[:stdin].write("q\n")
+        sess[:stdin].close
+        sess[:stdout].close
+        @sessions.delete(opts[:session].to_s)
+        true
+      rescue StandardError
+        @sessions.delete(opts[:session].to_s)
+        false
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.functions(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.functions(opts = {})
+        cmdj(opts.merge(cmd: 'aflj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.xrefs_to(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to list xrefs to (e.g. main or 0x401000)'
+      # )
+      public_class_method def self.xrefs_to(opts = {})
+        addr = opts[:addr].to_s
+        cmdj(opts.merge(cmd: "axtj #{addr}"))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.disasm(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to disassemble from',
+      #   n: 'optional - instruction count (defaults to 32)'
+      # )
+      public_class_method def self.disasm(opts = {})
+        addr = opts[:addr].to_s
+        n = (opts[:n] || 32).to_i
+        cmd(opts.merge(cmd: "pd #{n} @ #{addr}"))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.strings(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.strings(opts = {})
+        cmdj(opts.merge(cmd: 'izj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.imports(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.imports(opts = {})
+        cmdj(opts.merge(cmd: 'iij'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.sections(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.sections(opts = {})
+        cmdj(opts.merge(cmd: 'iSj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.binary_info(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.binary_info(opts = {})
+        cmdj(opts.merge(cmd: 'iIj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.decompile(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to decompile (needs r2ghidra)'
+      # )
+      public_class_method def self.decompile(opts = {})
+        addr = opts[:addr].to_s
+        cmd(opts.merge(cmd: "pdg @ #{addr}"))
+      rescue StandardError => e
+        { error: "#{e.class}: #{e.message}", hint: 'r2ghidra plugin may be absent' }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Open the binary in r2 (-q0) and return a session id.
+          #{self}.open(
+            path: 'required - filesystem path to the binary r2 should open'
+          )
+
+          # Run a command and return raw text output.
+          #{self}.cmd(
+            session: 'required - session id returned by #open',
+            cmd: 'required - r2 command to run; returns raw text (e.g. pdf @ main)'
+          )
+
+          # Run a command, request JSON, and parse the result.
+          #{self}.cmdj(
+            session: 'required - session id returned by #open',
+            cmd: 'required - r2 command; trailing j is added if missing and stdout is JSON.parse (e.g. afl or aflj)'
+          )
+
+          # Close a session previously returned by #open.
+          #{self}.close(
+            session: 'required - session id returned by #open'
+          )
+
+          # List functions after analysis (aflj JSON).
+          #{self}.functions(
+            session: 'required - session id returned by #open'
+          )
+
+          # List xrefs to an address or flag (axtj JSON).
+          #{self}.xrefs_to(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to list xrefs to (e.g. main or 0x401000)'
+          )
+
+          # Disassemble n instructions at addr (pd text).
+          #{self}.disasm(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to disassemble from',
+            n: 'optional - instruction count (defaults to 32)'
+          )
+
+          # List strings in the binary (izj JSON).
+          #{self}.strings(
+            session: 'required - session id returned by #open'
+          )
+
+          # List imported symbols (iij JSON).
+          #{self}.imports(
+            session: 'required - session id returned by #open'
+          )
+
+          # List sections / segments (iSj JSON).
+          #{self}.sections(
+            session: 'required - session id returned by #open'
+          )
+
+          # Print binary header info (iIj JSON).
+          #{self}.binary_info(
+            session: 'required - session id returned by #open'
+          )
+
+          # Decompile a function at addr via r2ghidra (pdg text).
+          #{self}.decompile(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to decompile (needs r2ghidra)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.session!(opts = {})
+        sid = opts[:session].to_s
+        sess = @sessions[sid]
+        raise 'ERROR: session is required / unknown' unless sess
+
+        sess
+      end
+
+      private_class_method def self.read_until_null(opts = {})
+        io = opts[:io]
+        buf = +''
+        loop do
+          ch = io.read(1)
+          break if ch.nil? || ch == "\x00"
+
+          buf << ch
+        end
+        buf
+      end
+    end
+  end
+end

data/lib/pwn/plugins/recon.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'net/http'
+require 'uri'
+require 'timeout'
+
+module PWN
+  module Plugins
+    # subfinder/httpx/masscan wrappers + cert-transparency (crt.sh, certspotter).
+    module Recon
+      UA = 'pwn-recon/1.0'
+
+      public_class_method def self.required_bins
+        []
+      end
+
+      public_class_method def self.subdomains(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        names = []
+        if PWN::Plugins::Doctor.bin?(name: 'subfinder')
+          stdout, = Open3.capture3('subfinder', '-silent', '-d', domain)
+          names.concat(stdout.lines.map(&:strip).reject(&:empty?))
+        end
+        names.concat(Array(crt_sh(domain: domain)))
+        normalize_names(names: names, domain: domain)
+      end
+
+      public_class_method def self.httpx(opts = {})
+        PWN::Plugins::Doctor.require_bin!(name: 'httpx')
+        hosts = Array(opts[:hosts] || opts[:urls])
+        stdout, = Open3.capture3('httpx', '-silent', '-json', stdin_data: "#{hosts.join("\n")}\n")
+        stdout.each_line.filter_map do |ln|
+          JSON.parse(ln)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+
+      public_class_method def self.masscan(opts = {})
+        bin = %w[masscan naabu].find { |b| PWN::Plugins::Doctor.bin?(name: b) }
+        raise PWN::Plugins::Doctor::MissingBinary, 'ERROR: masscan/naabu missing' unless bin
+
+        target = opts[:target].to_s
+        ports = (opts[:ports] || '1-1024').to_s
+        stdout, = Open3.capture3(bin, '-p', ports, target)
+        stdout
+      end
+
+      public_class_method def self.crt_sh(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        errors = []
+        names = []
+        sources = [
+          "https://api.certspotter.com/v1/issuances?domain=#{URI.encode_www_form_component(domain)}&include_subdomains=true&expand=dns_names",
+          "https://crt.sh/?q=#{URI.encode_www_form_component(domain)}&output=json",
+          "https://crt.sh/?q=#{URI.encode_www_form_component("%.#{domain}")}&output=json"
+        ]
+        sources.each do |url|
+          next if !names.empty? && url.include?('crt.sh')
+
+          rows = http_json(url: url, timeout: url.include?('crt.sh') ? 8 : (opts[:timeout] || 15))
+          names.concat(extract_dns_names(rows: rows))
+        rescue StandardError => e
+          errors << "#{URI(url).host}: #{e.class}: #{e.message}"
+        end
+        out = normalize_names(names: names, domain: domain)
+        return out unless out.empty?
+
+        raise "ERROR: cert-transparency lookup failed for #{domain} (#{errors.join('; ')})"
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run subdomains and return its result
+          #{self}.subdomains(
+            domain: 'required - FQDN to query (e.g. example.com)'
+          )
+
+          # Run httpx and return its result
+          #{self}.httpx(
+            hosts: 'optional - Array of hostnames or URLs to probe',
+            urls: 'optional - Array of HTTP(S) URLs'
+          )
+
+          # Run masscan and return its result
+          #{self}.masscan(
+            target: 'optional - hostname, IP, or CIDR to scan',
+            ports: 'optional - port, list, or range (e.g. 22,80,443 or 1-1024)'
+          )
+
+          # Run crt sh and return its result
+          #{self}.crt_sh(
+            domain: 'required - FQDN to query (e.g. example.com)',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.http_json(opts = {})
+        uri = URI(opts[:url].to_s)
+        timeout = (opts[:timeout] || 15).to_i
+        req = Net::HTTP::Get.new(uri)
+        req['User-Agent'] = UA
+        req['Accept'] = 'application/json'
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = (uri.scheme == 'https')
+        http.open_timeout = [timeout, 8].min
+        http.read_timeout = timeout
+        http.max_retries = 0
+        res = Timeout.timeout(timeout + 2) { http.request(req) }
+        raise "HTTP #{res.code}" unless res.is_a?(Net::HTTPSuccess)
+
+        body = res.body.to_s
+        raise JSON::ParserError, body[0, 120] unless body.lstrip.start_with?('[', '{')
+
+        JSON.parse(body)
+      end
+
+      private_class_method def self.extract_dns_names(opts = {})
+        rows = opts[:rows]
+        return [] if rows.nil?
+
+        Array(rows).flat_map do |row|
+          next [] unless row.is_a?(Hash)
+
+          vals = []
+          vals.concat(Array(row['dns_names'] || row[:dns_names]))
+          vals.concat(row['name_value'].to_s.split(/[\s,]+/))
+          vals.concat(row['common_name'].to_s.split(/[\s,]+/))
+          vals
+        end
+      end
+
+      private_class_method def self.normalize_names(opts = {})
+        domain = opts[:domain].to_s.downcase
+        Array(opts[:names]).map { |n| n.to_s.strip.downcase.delete_prefix('*.') }
+                           .reject(&:empty?)
+                           .select { |n| n == domain || n.end_with?(".#{domain}") }
+                           .uniq
+                           .sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/repl.rb

@@ -2131,18 +2131,139 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
+          # Restore the TTY after a spinner / agent turn so Pry/Reline prints
+          #{self}.ready_tty!(
+            skip: 'optional - skip value consumed by #ready_tty!',
+            io: 'optional - io value consumed by #ready_tty!'
+          )
+
+          # Compact token-count formatter for the pwn.ai PS1 (e.g. 0, 843, 12K, 250K, 1M)
+          #{self}.compact_context_tokens(
+            tokens: 'optional - tokens value consumed by #compact_context_tokens'
+          )
+
+          # Run refresh ps1 proc and return its result
           #{self}.refresh_ps1_proc(
-            mode: 'required - :splat or nil'
+            mode: 'optional - mode value consumed by #refresh_ps1_proc'
           )
 
+          # Run add commands and return its result
           #{self}.add_commands
 
+          # Run add hooks and return its result
           #{self}.add_hooks
 
+          # Run pwn ai complete kind and return its result
+          #{self}.pwn_ai_complete_kind(
+            line: 'optional - line value consumed by #pwn_ai_complete_kind'
+          )
+
+          # Run pwn ai complete and return its result
+          #{self}.pwn_ai_complete(
+            target: 'required - token Reline is completing',
+            line: 'optional - full line buffer',
+            pry: 'optional - Pry instance for Ruby completion'
+          )
+
+          # Run pwn ai complete command and return its result
+          #{self}.pwn_ai_complete_command(
+            line: 'optional - line value consumed by #pwn_ai_complete_command',
+            target: 'required - hostname, IP, or CIDR to scan'
+          )
+
+          # Run pwn ai complete path and return its result
+          #{self}.pwn_ai_complete_path(
+            target: 'required - hostname, IP, or CIDR to scan',
+            line: 'optional - line value consumed by #pwn_ai_complete_path'
+          )
+
+          # Run pwn ai complete ruby and return its result
+          #{self}.pwn_ai_complete_ruby(
+            target: 'optional - hostname, IP, or CIDR to scan',
+            pry: 'optional - pry value consumed by #pwn_ai_complete_ruby (defaults to Thread.current[:pwn_ai_completer_pry])'
+          )
+
+          # Install Reline dropdown for pwn-ai (commands / paths / Ruby)
+          #{self}.install_pwn_ai_completer!(
+            pry: 'optional - pry value consumed by #install_pwn_ai_completer!'
+          )
+
+          # Run restore pwn ai completer and return its result
+          #{self}.restore_pwn_ai_completer!
+
+          # Run a leading-slash pwn-ai command locally. Returns true when handled
+          #{self}.pwn_ai_dispatch_slash!(
+            request: 'optional - request value consumed by #pwn_ai_dispatch_slash!',
+            pry: 'optional - pry value consumed by #pwn_ai_dispatch_slash!'
+          )
+
+          # Run pwn ai engines and return its result
+          #{self}.pwn_ai_engines
+
+          # Run pwn ai provider class and return its result
+          #{self}.pwn_ai_provider_class(
+            engine: 'optional - engine value consumed by #pwn_ai_provider_class'
+          )
+
+          # Run pwn ai model ids and return its result
+          #{self}.pwn_ai_model_ids(
+            models: 'optional - models value consumed by #pwn_ai_model_ids'
+          )
+
+          # Run pwn ai list llms and return its result
+          #{self}.pwn_ai_list_llms(
+            engine: 'required - engine value consumed by #pwn_ai_list_llms'
+          )
+
+          # Run pwn ai engine model and return its result
+          #{self}.pwn_ai_engine_model(
+            engine: 'required - engine value consumed by #pwn_ai_engine_model'
+          )
+
+          # Run pwn ai run model and return its result
+          #{self}.pwn_ai_run_model(
+            args: 'optional - Array args value consumed by #pwn_ai_run_model'
+          )
+
+          # Run persist ai selection and return its result
+          #{self}.persist_ai_selection(
+            engine: 'required - engine value consumed by #persist_ai_selection',
+            model: 'required - model value consumed by #persist_ai_selection'
+          )
+
+          # Run pwn ai run cron and return its result
+          #{self}.pwn_ai_run_cron(
+            args: 'optional - Array args value consumed by #pwn_ai_run_cron'
+          )
+
+          # Run pwn ai run sessions and return its result
+          #{self}.pwn_ai_run_sessions(
+            args: 'optional - Array args value consumed by #pwn_ai_run_sessions'
+          )
+
+          # Run pwn ai run memory and return its result
+          #{self}.pwn_ai_run_memory(
+            args: 'optional - Array args value consumed by #pwn_ai_run_memory'
+          )
+
+          # Run pwn ai run skills and return its result
+          #{self}.pwn_ai_run_skills(
+            args: 'optional - Array args value consumed by #pwn_ai_run_skills'
+          )
+
+          # IRB-style suggest-as-you-type for the pwn REPL
+          #{self}.enable_autocomplete(
+            enabled: 'optional - Boolean (default true). false reverts to single-line cycling.',
+            graph: 'optional - constants (PWN::Plugins::Nm<TAB>), instance methods'
+          )
+
+          # Run start and return its result
           #{self}.start
 
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
+        constants.sort
       end
     end
   end

data/lib/pwn/plugins/scannable_codes.rb

@@ -72,15 +72,19 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
+          # Run generate and return its result
           #{self}.generate(
             data: 'required - data to encode',
             type: 'optional - :barcode || :qrcode (defaults to :qrcode)',
             size: 'optional - size of the image when type is :qrcode (defaults to 200)',
-            path: 'optional - path to save image (defaults to \"./\#{data}.png\")'
+            path: 'optional - path to save image (defaults to ./\#{data}.png)',
+            return_type: 'optional - :base64 || :file (defaults to :file)'
           )
 
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
+        constants.sort
       end
     end
   end

data/lib/pwn/plugins/serial.rb

@@ -232,41 +232,51 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
-          serial_obj = #{self}.connect(
-            block_dev: 'optional serial block device path (defaults to /dev/ttyUSB0)',
-            baud: 'optional (defaults to 9600)',
-            data_bits: 'optional (defaults to 8)',
-            stop_bits: 'optional (defaults to 1)',
+          # Run connect and return its result
+          #{self}.connect(
+            block_dev: 'optional - serial block device path (defaults to /dev/ttyUSB0)',
+            baud: 'optional - (defaults to 9600)',
+            data_bits: 'optional - (defaults to 8)',
+            stop_bits: 'optional - (defaults to 1)',
             parity: 'optional - :even|:mark|:odd|:space|:none (defaults to :none)'
           )
 
-          line_state = #{self}.get_line_state(
-            serial_obj: 'required serial_obj returned from #connect method'
+          # Run get line state and return its result
+          #{self}.get_line_state(
+            serial_obj: 'required - required serial_obj returned from #connect method'
           )
 
-          modem_params = #{self}.get_modem_params(
-            serial_obj: 'required serial_obj returned from #connect method'
+          # Run get modem params and return its result
+          #{self}.get_modem_params(
+            serial_obj: 'required - serial_obj returned from #connect method'
           )
 
+          # Run request and return its result
           #{self}.request(
-            serial_obj: 'required serial_obj returned from #connect method',
-            payload: 'required - array of bytes OR string to write to serial device (e.g. [0x00, 0x41, 0x90, 0x00] OR \"ATDT+15555555\r\n\"'
+            serial_obj: 'required - required serial_obj returned from #connect method',
+            payload: 'required - array of bytes OR string to write to serial device (e.g. [0x00, 0x41, 0x90, 0x00] OR ATDT+15555555\\r\\n'
           )
 
+          # Run response and return its result
           #{self}.response(
-            serial_obj: 'required serial_obj returned from #connect method'
+            serial_obj: 'required - serial_obj returned from #connect method'
           )
 
-          session_data_arr = #{self}.dump_session_data
+          # Run dump session data and return its result
+          #{self}.dump_session_data
 
+          # Run flush session data and return its result
           #{self}.flush_session_data
 
+          # Run disconnect and return its result
           #{self}.disconnect(
-            serial_obj: 'required serial_obj returned from #connect method'
+            serial_obj: 'required - serial_obj returned from #connect method'
           )
 
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
+        constants.sort
       end
     end
   end