pwn 0.5.708 → 0.5.710

data/lib/pwn/plugins/process_tube.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require 'pty'
+require 'timeout'
+require 'socket'
+
+module PWN
+  module Plugins
+    # PTY.spawn tube: sendline/recvuntil/recvline, persisted across pwn_eval.
+    module ProcessTube
+      @tubes = {}
+
+      public_class_method def self.required_bins
+        []
+      end
+
+      public_class_method def self.spawn(opts = {})
+        cmd = opts[:cmd] || opts[:command]
+        raise 'ERROR: cmd is required' if cmd.to_s.empty?
+
+        argv = cmd.is_a?(Array) ? cmd.map(&:to_s) : ['bash', '-lc', cmd.to_s]
+        r, w, pid = PTY.spawn(*argv)
+        id = "tube_#{pid}"
+        @tubes[id] = { r: r, w: w, pid: pid, buf: +'' }
+        { id: id, pid: pid }
+      end
+
+      public_class_method def self.connect(opts = {})
+        host = (opts[:host] || opts[:target]).to_s
+        port = opts[:port].to_i
+        raise 'ERROR: host and port are required' if host.empty? || port <= 0
+
+        sock = TCPSocket.new(host, port)
+        id = "sock_#{sock.object_id}"
+        @tubes[id] = { r: sock, w: sock, pid: nil, buf: +'' }
+        { id: id, host: host, port: port }
+      end
+
+      public_class_method def self.write_line(opts = {})
+        t = tube!(opts)
+        line = opts[:line] || opts[:data] || ''
+        t[:w].write("#{line}\n")
+        t[:w].flush
+        line.to_s
+      end
+
+      public_class_method def self.recvuntil(opts = {})
+        t = tube!(opts)
+        needle = opts[:until].to_s
+        raise 'ERROR: until is required' if needle.empty?
+
+        timeout = (opts[:timeout] || 5).to_f
+        Timeout.timeout(timeout) do
+          loop do
+            return t[:buf] if t[:buf].include?(needle)
+
+            ch = t[:r].read_nonblock(4_096)
+            t[:buf] << ch
+          rescue IO::WaitReadable
+            t[:r].wait_readable(0.2)
+            retry
+          end
+        end
+      end
+
+      public_class_method def self.recvline(opts = {})
+        recvuntil(opts.merge(until: "\n"))
+      end
+
+      public_class_method def self.close(opts = {})
+        t = tube!(opts)
+        t[:w].close
+        t[:r].close
+        Process.kill('TERM', t[:pid]) if t[:pid]
+        @tubes.delete(opts[:id].to_s)
+        true
+      rescue StandardError
+        @tubes.delete(opts[:id].to_s)
+        false
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run spawn and return its result
+          #{self}.spawn(
+            cmd: 'required - command string to run (defaults to opts[:command])',
+            command: 'optional - command value consumed by #spawn'
+          )
+
+          # Connect a TCP tube with the same write_line/recvuntil API as spawn.
+          #{self}.connect(
+            host: 'required - hostname or IP address (defaults to opts[:target])',
+            target: 'optional - hostname, IP, or CIDR to scan',
+            port: 'required - TCP/UDP port number'
+          )
+
+          # Run write line and return its result
+          #{self}.write_line(
+            line: 'optional - line value consumed by #write_line',
+            data: 'optional - data value consumed by #write_line'
+          )
+
+          # Run recvuntil and return its result
+          #{self}.recvuntil(
+            until: 'required - until value consumed by #recvuntil',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
+          # Run recvline and return its result
+          #{self}.recvline
+
+          # Close a session previously returned by #open.
+          #{self}.close(
+            id: 'optional - id value consumed by #close'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.tube!(opts = {})
+        id = opts[:id].to_s
+        t = @tubes[id]
+        raise 'ERROR: id is required / unknown tube' unless t
+
+        t
+      end
+    end
+  end
+end

data/lib/pwn/plugins/ps.rb

@@ -76,14 +76,20 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
-          proc_list_arr = #{self}.list
+          # Run list and return its result
+          #{self}.list(
+            pid: 'optional - pid value consumed by #list'
+          )
 
+          # Run cleanup pids and return its result
           #{self}.cleanup_pids(
             pids_arr: 'required - array of pids to kill'
           )
 
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
+        constants.sort
       end
     end
   end

data/lib/pwn/plugins/pwn_logger.rb

@@ -53,11 +53,15 @@ module PWN
 
       public_class_method def self.help
         puts "USAGE:
-          logger = #{self}.create(
-            level: 'optional - logging verbosity :debug|:error|:fatal|:info|:unknown|:warn (Defaults to :info)'
+          # Run create and return its result
+          #{self}.create(
+            level: 'optional - level value consumed by #create'
           )
+
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
+        constants.sort
       end
     end
   end

data/lib/pwn/plugins/rabbit_mq.rb

@@ -50,20 +50,25 @@ module PWN
       # Display Usage for this Module
 
       public_class_method def self.help
-        puts %{USAGE:
-          amqp_conn1 = #{self}.open(
-            hostname: 'required',
+        puts "USAGE:
+          # Open a session or connection and return a handle.
+          #{self}.open(
+            hostname: 'required - hostname value consumed by #open',
             port: 'optional - defaults to 5672',
-            username: 'optional',
-            password: 'optional'
+            username: 'optional - username value consumed by #open',
+            password: 'optional - password value consumed by #open'
           )
 
+          # Close a session previously returned by #open.
           #{self}.close(
-            amqp_oject: amqp_conn1
+            amqp_oject: 'optional - amqp oject value consumed by #close',
+            amqp_obj: 'optional - amqp obj value consumed by #close'
           )
 
+          # Print the AUTHOR(S) string for this module.
           #{self}.authors
-        }
+        "
+        constants.sort
       end
     end
   end

data/lib/pwn/plugins/radare2.rb

@@ -0,0 +1,253 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # Persistent r2pipe-style session: open/cmd/cmdj/close plus helpers.
+    module Radare2
+      @sessions = {}
+
+      public_class_method def self.required_bins
+        %w[r2]
+      end
+
+      # Supported Method Parameters::
+      # session = PWN::Plugins::Radare2.open(
+      #   path: 'required - filesystem path to the binary r2 should open'
+      # )
+      public_class_method def self.open(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'r2')
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: binary not found: #{path}" unless File.file?(path)
+
+        stdin, stdout, waiter = Open3.popen2('r2', '-q0', '-e', 'scr.color=0', path)
+        sid = SecureRandom.hex(8)
+        @sessions[sid] = { stdin: stdin, stdout: stdout, waiter: waiter, path: path }
+        read_until_null(io: stdout)
+        sid
+      end
+
+      # Supported Method Parameters::
+      # text = PWN::Plugins::Radare2.cmd(
+      #   session: 'required - session id returned by #open',
+      #   cmd: 'required - r2 command to run; returns raw text (e.g. pdf @ main)'
+      # )
+      public_class_method def self.cmd(opts = {})
+        sess = session!(opts)
+        line = opts[:cmd].to_s
+        raise 'ERROR: cmd is required' if line.empty?
+
+        sess[:stdin].write("#{line}\n")
+        sess[:stdin].flush
+        read_until_null(io: sess[:stdout])
+      end
+
+      # Supported Method Parameters::
+      # json = PWN::Plugins::Radare2.cmdj(
+      #   session: 'required - session id returned by #open',
+      #   cmd: 'required - r2 command; trailing j is added if missing and stdout is JSON.parse (e.g. afl or aflj)'
+      # )
+      public_class_method def self.cmdj(opts = {})
+        raw = cmd(opts.merge(cmd: opts[:cmd].to_s.sub(/j?\z/, 'j')))
+        JSON.parse(raw)
+      rescue JSON::ParserError
+        raw
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.close(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.close(opts = {})
+        sess = session!(opts)
+        sess[:stdin].write("q\n")
+        sess[:stdin].close
+        sess[:stdout].close
+        @sessions.delete(opts[:session].to_s)
+        true
+      rescue StandardError
+        @sessions.delete(opts[:session].to_s)
+        false
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.functions(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.functions(opts = {})
+        cmdj(opts.merge(cmd: 'aflj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.xrefs_to(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to list xrefs to (e.g. main or 0x401000)'
+      # )
+      public_class_method def self.xrefs_to(opts = {})
+        addr = opts[:addr].to_s
+        cmdj(opts.merge(cmd: "axtj #{addr}"))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.disasm(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to disassemble from',
+      #   n: 'optional - instruction count (defaults to 32)'
+      # )
+      public_class_method def self.disasm(opts = {})
+        addr = opts[:addr].to_s
+        n = (opts[:n] || 32).to_i
+        cmd(opts.merge(cmd: "pd #{n} @ #{addr}"))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.strings(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.strings(opts = {})
+        cmdj(opts.merge(cmd: 'izj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.imports(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.imports(opts = {})
+        cmdj(opts.merge(cmd: 'iij'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.sections(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.sections(opts = {})
+        cmdj(opts.merge(cmd: 'iSj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.binary_info(
+      #   session: 'required - session id returned by #open'
+      # )
+      public_class_method def self.binary_info(opts = {})
+        cmdj(opts.merge(cmd: 'iIj'))
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Radare2.decompile(
+      #   session: 'required - session id returned by #open',
+      #   addr: 'required - address or flag to decompile (needs r2ghidra)'
+      # )
+      public_class_method def self.decompile(opts = {})
+        addr = opts[:addr].to_s
+        cmd(opts.merge(cmd: "pdg @ #{addr}"))
+      rescue StandardError => e
+        { error: "#{e.class}: #{e.message}", hint: 'r2ghidra plugin may be absent' }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Open the binary in r2 (-q0) and return a session id.
+          #{self}.open(
+            path: 'required - filesystem path to the binary r2 should open'
+          )
+
+          # Run a command and return raw text output.
+          #{self}.cmd(
+            session: 'required - session id returned by #open',
+            cmd: 'required - r2 command to run; returns raw text (e.g. pdf @ main)'
+          )
+
+          # Run a command, request JSON, and parse the result.
+          #{self}.cmdj(
+            session: 'required - session id returned by #open',
+            cmd: 'required - r2 command; trailing j is added if missing and stdout is JSON.parse (e.g. afl or aflj)'
+          )
+
+          # Close a session previously returned by #open.
+          #{self}.close(
+            session: 'required - session id returned by #open'
+          )
+
+          # List functions after analysis (aflj JSON).
+          #{self}.functions(
+            session: 'required - session id returned by #open'
+          )
+
+          # List xrefs to an address or flag (axtj JSON).
+          #{self}.xrefs_to(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to list xrefs to (e.g. main or 0x401000)'
+          )
+
+          # Disassemble n instructions at addr (pd text).
+          #{self}.disasm(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to disassemble from',
+            n: 'optional - instruction count (defaults to 32)'
+          )
+
+          # List strings in the binary (izj JSON).
+          #{self}.strings(
+            session: 'required - session id returned by #open'
+          )
+
+          # List imported symbols (iij JSON).
+          #{self}.imports(
+            session: 'required - session id returned by #open'
+          )
+
+          # List sections / segments (iSj JSON).
+          #{self}.sections(
+            session: 'required - session id returned by #open'
+          )
+
+          # Print binary header info (iIj JSON).
+          #{self}.binary_info(
+            session: 'required - session id returned by #open'
+          )
+
+          # Decompile a function at addr via r2ghidra (pdg text).
+          #{self}.decompile(
+            session: 'required - session id returned by #open',
+            addr: 'required - address or flag to decompile (needs r2ghidra)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.session!(opts = {})
+        sid = opts[:session].to_s
+        sess = @sessions[sid]
+        raise 'ERROR: session is required / unknown' unless sess
+
+        sess
+      end
+
+      private_class_method def self.read_until_null(opts = {})
+        io = opts[:io]
+        buf = +''
+        loop do
+          ch = io.read(1)
+          break if ch.nil? || ch == "\x00"
+
+          buf << ch
+        end
+        buf
+      end
+    end
+  end
+end

data/lib/pwn/plugins/recon.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'net/http'
+require 'uri'
+require 'timeout'
+
+module PWN
+  module Plugins
+    # subfinder/httpx/masscan wrappers + cert-transparency (crt.sh, certspotter).
+    module Recon
+      UA = 'pwn-recon/1.0'
+
+      public_class_method def self.required_bins
+        []
+      end
+
+      public_class_method def self.subdomains(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        names = []
+        if PWN::Plugins::PreflightChecker.bin?(name: 'subfinder')
+          stdout, = Open3.capture3('subfinder', '-silent', '-d', domain)
+          names.concat(stdout.lines.map(&:strip).reject(&:empty?))
+        end
+        if PWN::Plugins::PreflightChecker.bin?(name: 'amass')
+          stdout, = Open3.capture3('amass', 'enum', '-passive', '-d', domain, '-nocolor')
+          names.concat(stdout.lines.map(&:strip).reject(&:empty?))
+        end
+        names.concat(Array(crt_sh(domain: domain)))
+        normalize_names(names: names, domain: domain)
+      end
+
+      public_class_method def self.httpx(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'httpx')
+        hosts = Array(opts[:hosts] || opts[:urls])
+        stdout, = Open3.capture3('httpx', '-silent', '-json', stdin_data: "#{hosts.join("\n")}\n")
+        stdout.each_line.filter_map do |ln|
+          JSON.parse(ln)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+
+      public_class_method def self.masscan(opts = {})
+        bin = %w[masscan naabu].find { |b| PWN::Plugins::PreflightChecker.bin?(name: b) }
+        raise PWN::Plugins::PreflightChecker::MissingBinary, 'ERROR: masscan/naabu missing' unless bin
+
+        target = opts[:target].to_s
+        ports = (opts[:ports] || '1-1024').to_s
+        stdout, = Open3.capture3(bin, '-p', ports, target)
+        stdout
+      end
+
+      public_class_method def self.crt_sh(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        errors = []
+        names = []
+        sources = [
+          "https://api.certspotter.com/v1/issuances?domain=#{URI.encode_www_form_component(domain)}&include_subdomains=true&expand=dns_names",
+          "https://crt.sh/?q=#{URI.encode_www_form_component(domain)}&output=json",
+          "https://crt.sh/?q=#{URI.encode_www_form_component("%.#{domain}")}&output=json"
+        ]
+        sources.each do |url|
+          next if !names.empty? && url.include?('crt.sh')
+
+          rows = http_json(url: url, timeout: url.include?('crt.sh') ? 8 : (opts[:timeout] || 15))
+          names.concat(extract_dns_names(rows: rows))
+        rescue StandardError => e
+          errors << "#{URI(url).host}: #{e.class}: #{e.message}"
+        end
+        out = normalize_names(names: names, domain: domain)
+        return out unless out.empty?
+
+        raise "ERROR: cert-transparency lookup failed for #{domain} (#{errors.join('; ')})"
+      end
+
+      public_class_method def self.amass(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'amass')
+        domain = opts[:domain].to_s
+        raise 'ERROR: domain is required' if domain.empty?
+
+        stdout, = Open3.capture3('amass', 'enum', '-passive', '-d', domain, '-nocolor')
+        stdout.lines.map(&:strip).reject(&:empty?)
+      end
+
+      public_class_method def self.passive_dns(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        uri = URI("https://api.hackertarget.com/hostsearch/?q=#{URI.encode_www_form_component(domain)}")
+        rows = http_json(url: uri.to_s, timeout: opts[:timeout] || 8)
+        Array(rows)
+      rescue StandardError => e
+        { error: "#{e.class}: #{e.message}", domain: domain }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run subdomains and return its result
+          #{self}.subdomains(
+            domain: 'required - FQDN to query (e.g. example.com)'
+          )
+
+          # Run httpx and return its result
+          #{self}.httpx(
+            hosts: 'optional - Array of hostnames or URLs to probe',
+            urls: 'optional - Array of HTTP(S) URLs'
+          )
+
+          # Run masscan and return its result
+          #{self}.masscan(
+            target: 'optional - hostname, IP, or CIDR to scan',
+            ports: 'optional - port, list, or range (e.g. 22,80,443 or 1-1024)'
+          )
+
+          # Run crt sh and return its result
+          #{self}.crt_sh(
+            domain: 'required - FQDN to query (e.g. example.com)',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
+          # Passive amass enum (requires amass).
+          #{self}.amass(
+            domain: 'required - FQDN to query (e.g. example.com)'
+          )
+
+          # Passive DNS hostsearch for a domain (hackertarget).
+          #{self}.passive_dns(
+            domain: 'required - FQDN to query (e.g. example.com)',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.http_json(opts = {})
+        uri = URI(opts[:url].to_s)
+        timeout = (opts[:timeout] || 15).to_i
+        req = Net::HTTP::Get.new(uri)
+        req['User-Agent'] = UA
+        req['Accept'] = 'application/json'
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = (uri.scheme == 'https')
+        http.open_timeout = [timeout, 8].min
+        http.read_timeout = timeout
+        http.max_retries = 0
+        res = Timeout.timeout(timeout + 2) { http.request(req) }
+        raise "HTTP #{res.code}" unless res.is_a?(Net::HTTPSuccess)
+
+        body = res.body.to_s
+        raise JSON::ParserError, body[0, 120] unless body.lstrip.start_with?('[', '{')
+
+        JSON.parse(body)
+      end
+
+      private_class_method def self.extract_dns_names(opts = {})
+        rows = opts[:rows]
+        return [] if rows.nil?
+
+        Array(rows).flat_map do |row|
+          next [] unless row.is_a?(Hash)
+
+          vals = []
+          vals.concat(Array(row['dns_names'] || row[:dns_names]))
+          vals.concat(row['name_value'].to_s.split(/[\s,]+/))
+          vals.concat(row['common_name'].to_s.split(/[\s,]+/))
+          vals
+        end
+      end
+
+      private_class_method def self.normalize_names(opts = {})
+        domain = opts[:domain].to_s.downcase
+        Array(opts[:names]).map { |n| n.to_s.strip.downcase.delete_prefix('*.') }
+                           .reject(&:empty?)
+                           .select { |n| n == domain || n.end_with?(".#{domain}") }
+                           .uniq
+                           .sort
+      end
+    end
+  end
+end