pwn 0.5.709 → 0.5.710

data/lib/pwn/plugins/exploit_db.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+
+module PWN
+  module Plugins
+    # searchsploit / ExploitDB plus a CPE string builder for nmap versions.
+    module ExploitDB
+      public_class_method def self.required_bins
+        %w[searchsploit]
+      end
+
+      public_class_method def self.search(opts = {})
+        q = (opts[:query] || opts[:q]).to_s
+        raise 'ERROR: query is required' if q.empty?
+
+        return { error: 'searchsploit missing', query: q } unless PWN::Plugins::PreflightChecker.bin?(name: 'searchsploit')
+
+        stdout, stderr, status = Open3.capture3('searchsploit', '--json', q)
+        parsed = begin
+          JSON.parse(stdout)
+        rescue JSON::ParserError
+          {}
+        end
+        { query: q, results: parsed['RESULTS_EXPLOIT'] || parsed['results'] || [], stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.cve_for_cpe(opts = {})
+        cpe = opts[:cpe].to_s
+        product = opts[:product].to_s
+        version = opts[:version].to_s
+        q = cpe
+        q = "#{product} #{version}".strip if q.empty?
+        raise 'ERROR: cpe or product is required' if q.empty?
+
+        search(query: q).merge(cpe: cpe, product: product, version: version)
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Search local ExploitDB via searchsploit --json.
+          #{self}.search(
+            query: 'required - product, CVE, or keyword',
+            q: 'optional - alias for query'
+          )
+
+          # Build a search from an nmap CPE/product/version tuple.
+          #{self}.cve_for_cpe(
+            cpe: 'optional - CPE string (e.g. cpe:/a:apache:http_server:2.4.49)',
+            product: 'optional - product name when no CPE',
+            version: 'optional - version string from nmap_it'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/exploit_dev.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'open3'
+
 module PWN
   module Plugins
     # p8/p16/p32/p64, cyclic, flat, fmt writes, gadget search.
@@ -83,6 +85,8 @@ module PWN
       public_class_method def self.shellcode(opts = {})
         arch = (opts[:arch] || 'x86_64').to_s
         kind = (opts[:kind] || opts[:payload] || 'nop').to_s
+        return execve_bin_sh_bytes(arch: arch) if kind == 'execve_bin_sh'
+
         asm = case kind
               when 'nop' then 'nop'
               when 'ret' then 'ret'
@@ -93,6 +97,40 @@ module PWN
         PWN::Plugins::Assembly.asm_to_opcodes(asm: asm, arch: arch, endian: opts[:endian])
       end
 
+      public_class_method def self.one_gadget(opts = {})
+        path = (opts[:path] || opts[:libc]).to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        return { error: 'one_gadget missing', hint: 'pwn setup --profile re', path: path } unless PWN::Plugins::PreflightChecker.bin?(name: 'one_gadget')
+
+        stdout, stderr, status = Open3.capture3('one_gadget', path)
+        {
+          path: path,
+          stdout: stdout,
+          stderr: stderr,
+          exit: status.exitstatus,
+          gadgets: stdout.scan(/0x[0-9a-fA-F]+/)
+        }
+      end
+
+      public_class_method def self.libc_offsets(opts = {})
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        wanted = Array(opts[:names] || %w[system execve __libc_start_main])
+        syms = PWN::Plugins::BinaryParser.symbols(path: path, limit: 20_000)
+        map = {}
+        Array(syms).each do |s|
+          n = s[:name].to_s
+          next if n.empty?
+
+          wanted.each do |w|
+            map[w.to_s] = s[:value] if n == w.to_s || n.end_with?(w.to_s)
+          end
+        end
+        { path: path, symbols: map }
+      end
+
       public_class_method def self.fmt_writes(opts = {})
         addr = (opts[:addr] || 0).to_i
         value = (opts[:value] || 0).to_i
@@ -109,14 +147,14 @@ module PWN
         path = opts[:path].to_s
         raise 'ERROR: path is required' if path.empty?
 
-        if PWN::Plugins::Doctor.bin?(name: 'r2')
+        if PWN::Plugins::PreflightChecker.bin?(name: 'r2')
           sid = PWN::Plugins::Radare2.open(path: path)
           begin
             PWN::Plugins::Radare2.cmd(session: sid, cmd: '/R')
           ensure
             PWN::Plugins::Radare2.close(session: sid)
           end
-        elsif PWN::Plugins::Doctor.bin?(name: 'ROPgadget')
+        elsif PWN::Plugins::PreflightChecker.bin?(name: 'ROPgadget')
           `ROPgadget --binary #{path}`.to_s
         else
           { error: 'r2 and ROPgadget missing', hint: 'pwn setup --profile re' }
@@ -230,7 +268,19 @@ module PWN
 
           # Run gadgets and return its result
           #{self}.gadgets(
-            path: 'required - filesystem path to read or write'
+            path: 'required - filesystem path of the binary to search for gadgets'
+          )
+
+          # Resolve one_gadget offsets in a libc (needs the one_gadget gem/bin).
+          #{self}.one_gadget(
+            path: 'required - filesystem path to libc.so',
+            libc: 'optional - alias for path'
+          )
+
+          # Map named libc symbols to virtual addresses via BinaryParser.
+          #{self}.libc_offsets(
+            path: 'required - filesystem path to libc or any ELF',
+            names: 'optional - Array of symbol names (defaults to system, execve, __libc_start_main)'
           )
 
           # Print the AUTHOR(S) string for this module.
@@ -259,6 +309,22 @@ module PWN
         template = { 1 => 'C', 2 => little ? 'v' : 'n', 4 => little ? 'V' : 'N', 8 => little ? 'Q<' : 'Q>' }[bytes]
         buf.unpack1(template)
       end
+
+      private_class_method def self.execve_bin_sh_bytes(opts = {})
+        arch = opts[:arch].to_s
+        if arch.match?(/64|amd64/i)
+          return [
+            0x48, 0x31, 0xd2, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e,
+            0x2f, 0x73, 0x68, 0x00, 0x53, 0x48, 0x89, 0xe7, 0x50,
+            0x57, 0x48, 0x89, 0xe6, 0xb0, 0x3b, 0x0f, 0x05
+          ].pack('C*')
+        end
+
+        [
+          0x31, 0xc0, 0x50, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69, 0x6e,
+          0x89, 0xe3, 0x50, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80
+        ].pack('C*')
+      end
     end
   end
 end

data/lib/pwn/plugins/frida.rb

@@ -6,18 +6,39 @@ module PWN
   module Plugins
     # Frida attach/spawn + script injection.
     module Frida
+      SSL_PINNING = <<~JS
+        Java.perform(function () {
+          try {
+            var TrustManager = Java.use('javax.net.ssl.X509TrustManager');
+            var SSLContext = Java.use('javax.net.ssl.SSLContext');
+            var TrustManagers = [Java.registerClass({
+              name: 'pwn.TrustAll',
+              implements: [TrustManager],
+              methods: {
+                checkClientTrusted: function () {},
+                checkServerTrusted: function () {},
+                getAcceptedIssuers: function () { return []; }
+              }
+            }).$new()];
+            var ctx = SSLContext.getInstance('TLS');
+            ctx.init(null, TrustManagers, null);
+            SSLContext.getDefault.implementation = function () { return ctx; };
+          } catch (e) {}
+        });
+      JS
+
       public_class_method def self.required_bins
         %w[frida]
       end
 
       public_class_method def self.ps(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'frida')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'frida')
         stdout, stderr, status = Open3.capture3('frida-ps', *Array(opts[:extra]))
         { stdout: stdout, stderr: stderr, exit: status.exitstatus }
       end
 
       public_class_method def self.attach(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'frida')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'frida')
         target = opts[:target] || opts[:name]
         script = opts[:script].to_s
         raise 'ERROR: target is required' if target.to_s.empty?
@@ -29,6 +50,23 @@ module PWN
         { stdout: stdout, stderr: stderr, exit: status.exitstatus }
       end
 
+      public_class_method def self.spawn(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'frida')
+        path = (opts[:path] || opts[:file]).to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        cmd = ['frida', '-f', path]
+        cmd += ['-l', opts[:script_path].to_s] if opts[:script_path]
+        cmd += ['-e', opts[:script].to_s] unless opts[:script].to_s.empty?
+        stdout, stderr, status = Open3.capture3(*cmd)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.ssl_pinning_script(opts = {})
+        opts[:android]
+        SSL_PINNING
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -38,17 +76,30 @@ module PWN
           # List host binaries this module expects to be installed.
           #{self}.required_bins
 
-          # Run ps and return its result
+          # List processes via frida-ps.
           #{self}.ps(
-            extra: 'optional - Array extra value consumed by #ps'
+            extra: 'optional - extra frida-ps argv'
           )
 
-          # Run attach and return its result
+          # Attach to a running process and optionally inject a script.
           #{self}.attach(
-            target: 'required - hostname, IP, or CIDR to scan (defaults to opts[:name])',
-            name: 'optional - binary or identifier name',
-            script: 'required - script value consumed by #attach',
-            script_path: 'optional - script path value consumed by #attach'
+            target: 'required - process name (defaults to opts[:name])',
+            name: 'optional - alias for target',
+            script: 'optional - JavaScript source to pass with -e',
+            script_path: 'optional - path to a .js file for -l'
+          )
+
+          # Spawn a binary under Frida and inject a script.
+          #{self}.spawn(
+            path: 'required - filesystem path to the binary',
+            file: 'optional - alias for path',
+            script: 'optional - JavaScript source to pass with -e',
+            script_path: 'optional - path to a .js file for -l'
+          )
+
+          # Return an SSL-pinning bypass JavaScript template.
+          #{self}.ssl_pinning_script(
+            android: 'optional - currently always returns the Java TrustManager template'
           )
 
           # Print the AUTHOR(S) string for this module.

data/lib/pwn/plugins/fuzz.rb

@@ -171,6 +171,25 @@ module PWN
         sock_obj = PWN::Plugins::Sock.disconnect(sock_obj: sock_obj) unless sock_obj.nil?
       end
 
+      public_class_method def self.http(opts = {})
+        template = opts[:request].to_s
+        raise 'ERROR: request is required' if template.empty?
+
+        token = (opts[:token] || 'FUZZ').to_s
+        Array(opts[:dictionary] || opts[:payloads] || ['A']).map do |p|
+          template.gsub(token, p.to_s)
+        end
+      end
+
+      public_class_method def self.file_format(opts = {})
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        seed = File.binread(path)
+        dict = Array(opts[:dictionary] || ["\xff"])
+        dict.map { |blob| seed + blob.to_s }
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -199,6 +218,20 @@ module PWN
             char_encoding: 'optional - character encoding returned by PWN::Plugins::Char.list_encoders (defaults to UTF-8)'
           )
 
+          # Expand an HTTP request template by substituting FUZZ with dictionary payloads.
+          #{self}.http(
+            request: 'required - HTTP request template containing FUZZ (or token:)',
+            dictionary: 'optional - Array of payload strings',
+            payloads: 'optional - alias for dictionary',
+            token: 'optional - placeholder to replace (defaults to FUZZ)'
+          )
+
+          # Append dictionary blobs to a seed file for coverage-guided or dumb file fuzzing.
+          #{self}.file_format(
+            path: 'required - filesystem path to the seed file',
+            dictionary: 'optional - Array of binary/string mutations'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/gdb.rb

@@ -11,7 +11,7 @@ module PWN
       end
 
       public_class_method def self.batch(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'gdb')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'gdb')
         binary = opts[:binary].to_s
         cmds = Array(opts[:commands] || opts[:cmds])
         args = Array(opts[:args])
@@ -38,7 +38,7 @@ module PWN
         batch(opts.merge(commands: ['checksec']))
       rescue StandardError
         path = opts[:binary].to_s
-        return { error: 'gdb missing' } unless PWN::Plugins::Doctor.bin?(name: 'gdb')
+        return { error: 'gdb missing' } unless PWN::Plugins::PreflightChecker.bin?(name: 'gdb')
 
         { hint: 'pwndbg/gef checksec not loaded', binary: path }
       end
@@ -48,7 +48,18 @@ module PWN
         binary = opts[:binary].to_s
         raise 'ERROR: core is required' if core.empty?
 
-        batch(opts.merge(commands: ['bt', 'info registers'], binary: binary, args: []))
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'gdb')
+        binary = opts[:binary].to_s
+        argv = ['gdb', '--batch', '--quiet', '-c', core, '-ex', 'set pagination off', '-ex', 'bt', '-ex', 'info registers']
+        argv << binary unless binary.empty?
+        stdout, stderr, status = Open3.capture3(*argv)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.breakpoints(opts = {})
+        bps = Array(opts[:breakpoints] || opts[:bp])
+        cmds = bps.map { |b| "break #{b}" } + Array(opts[:commands]) + %w[run bt]
+        batch(opts.merge(commands: cmds))
       end
 
       public_class_method def self.authors
@@ -81,8 +92,17 @@ module PWN
 
           # Run core and return its result
           #{self}.core(
-            core: 'required - core value consumed by #core',
-            binary: 'optional - binary value consumed by #core'
+            core: 'required - filesystem path to the core dump',
+            binary: 'optional - matching binary for symbols'
+          )
+
+          # Plant breakpoints then run and dump a backtrace.
+          #{self}.breakpoints(
+            binary: 'optional - binary to debug',
+            breakpoints: 'optional - Array of break specs (e.g. main or *0x401000)',
+            bp: 'optional - alias for breakpoints',
+            commands: 'optional - extra gdb commands after the breaks',
+            args: 'optional - Array of inferior argv'
           )
 
           # Print the AUTHOR(S) string for this module.

data/lib/pwn/plugins/jobs.rb

@@ -34,6 +34,7 @@ module PWN
           started_at: Time.now.utc.iso8601
         }
         File.write(meta, JSON.generate(row))
+        PWN::Plugins::ArtifactRegistry.register(session_id: opts[:session_id], path: log, kind: 'job-log') if opts[:session_id] && defined?(PWN::Plugins::ArtifactRegistry) && File.file?(log)
         row
       end
 

data/lib/pwn/plugins/k8s.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'open3'
+
+module PWN
+  module Plugins
+    # trivy / kube-hunter wrappers plus docker-socket preflight.
+    module K8s
+      public_class_method def self.required_bins
+        %w[trivy]
+      end
+
+      public_class_method def self.trivy(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'trivy')
+        target = opts[:target] || opts[:image] || opts[:path]
+        raise 'ERROR: target is required' if target.to_s.empty?
+
+        mode = (opts[:mode] || :image).to_s
+        cmd = ['trivy', mode, '--format', 'json', target.to_s]
+        stdout, stderr, status = Open3.capture3(*cmd)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.kube_hunter(opts = {})
+        return { error: 'kube-hunter missing', hint: 'pip install kube-hunter' } unless PWN::Plugins::PreflightChecker.bin?(name: 'kube-hunter')
+
+        cmd = ['kube-hunter']
+        cmd += ['--remote', opts[:remote].to_s] if opts[:remote]
+        cmd << '--report' << 'json'
+        stdout, stderr, status = Open3.capture3(*cmd)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.docker_socket?(opts = {})
+        path = (opts[:path] || '/var/run/docker.sock').to_s
+        PWN::Plugins::PreflightChecker.service?(name: 'docker', path: path)
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Scan a container image or filesystem with trivy.
+          #{self}.trivy(
+            target: 'required - image name or path',
+            image: 'optional - alias for target',
+            path: 'optional - alias for target',
+            mode: 'optional - trivy subcommand (defaults to image)'
+          )
+
+          # Run kube-hunter (remote cluster optional).
+          #{self}.kube_hunter(
+            remote: 'optional - API server host for --remote'
+          )
+
+          # True when the docker unix socket is present.
+          #{self}.docker_socket?(
+            path: 'optional - socket path (defaults to /var/run/docker.sock)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/nuclei.rb

@@ -12,7 +12,7 @@ module PWN
       end
 
       public_class_method def self.scan(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'nuclei')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'nuclei')
         target = opts[:target] || opts[:url]
         raise 'ERROR: target is required' if target.to_s.empty?
 
@@ -26,7 +26,28 @@ module PWN
         rescue JSON::ParserError
           nil
         end
-        { findings: findings, stderr: stderr, exit: status.exitstatus }
+        { findings: to_findings(rows: findings), raw: findings, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.to_findings(opts = {})
+        Array(opts[:rows] || opts[:findings]).map do |r|
+          r = r.transform_keys(&:to_s) if r.is_a?(Hash)
+          info = r['info'] || {}
+          info = info.transform_keys(&:to_s) if info.is_a?(Hash)
+          {
+            title: info['name'] || r['template-id'] || 'nuclei finding',
+            severity: (info['severity'] || 'info').to_s,
+            url: r['matched-at'] || r['host'],
+            template: r['template-id'],
+            description: info['description']
+          }
+        end
+      end
+
+      public_class_method def self.to_defectdojo(opts = {})
+        to_findings(opts).map do |f|
+          { title: f[:title], severity: f[:severity], description: "#{f[:url]} #{f[:template]}".strip }
+        end
       end
 
       public_class_method def self.authors
@@ -44,7 +65,19 @@ module PWN
             url: 'optional - HTTP(S) URL',
             severity: 'optional - severity value consumed by #scan',
             templates: 'optional - templates value consumed by #scan',
-            rate_limit: 'optional - rate limit value consumed by #scan'
+            rate_limit: 'optional - requests per second passed to nuclei -rate-limit'
+          )
+
+          # Map nuclei JSONL rows into report-shaped finding hashes.
+          #{self}.to_findings(
+            rows: 'optional - Array of parsed nuclei JSONL objects',
+            findings: 'optional - alias for rows'
+          )
+
+          # Shape findings for a DefectDojo import payload.
+          #{self}.to_defectdojo(
+            rows: 'optional - Array of parsed nuclei JSONL objects',
+            findings: 'optional - alias for rows'
           )
 
           # Print the AUTHOR(S) string for this module.

data/lib/pwn/plugins/packet.rb

@@ -1085,7 +1085,7 @@ module PWN
       # )
 
       public_class_method def self.send(opts = {})
-        PWN::Plugins::Doctor.require_cap_net_raw! if defined?(PWN::Plugins::Doctor)
+        PWN::Plugins::PreflightChecker.require_cap_net_raw! if defined?(PWN::Plugins::PreflightChecker)
         pkt = opts[:pkt]
 
         if opts[:iface]

data/lib/pwn/plugins/{doctor.rb → preflight_checker.rb}

@@ -5,9 +5,10 @@ module PWN
     # Plugin/binary/capability preflight. Plugins declare required_bins /
     # required_caps; HOST summaries list degraded modules without autoloading
     # the whole plugin tree.
-    module Doctor
+    module PreflightChecker
       class MissingBinary < StandardError; end
       class MissingCapability < StandardError; end
+      class MissingService < StandardError; end
 
       PLUGIN_DEPS = {
         'PWN::Plugins::Radare2' => { bins: %w[r2] },
@@ -21,7 +22,8 @@ module PWN
         'PWN::Plugins::Metasploit' => { bins: %w[msfconsole] },
         'PWN::Plugins::BurpSuite' => { bins: %w[burpsuite] },
         'PWN::Plugins::Zaproxy' => { bins: %w[zaproxy] },
-        'PWN::Plugins::Packet' => { bins: [], caps: %w[CAP_NET_RAW] }
+        'PWN::Plugins::Packet' => { bins: [], caps: %w[CAP_NET_RAW] },
+        'PWN::Plugins::K8s' => { bins: %w[trivy], services: [{ name: 'docker', path: '/var/run/docker.sock' }] }
       }.freeze
 
       public_class_method def self.required_bins
@@ -65,6 +67,13 @@ module PWN
               'or run as root. Fallback: PWN::Plugins::Sock.connect (no raw).'
       end
 
+      public_class_method def self.service?(opts = {})
+        path = opts[:path].to_s
+        return File.socket?(path) unless path.empty?
+
+        false
+      end
+
       public_class_method def self.check(opts = {})
         deps = PLUGIN_DEPS
         if opts[:names]
@@ -74,17 +83,19 @@ module PWN
         deps.map do |plugin, dep|
           bins = Array(dep[:bins])
           caps = Array(dep[:caps])
+          services = Array(dep[:services])
           missing_bins = bins.reject { |b| bin?(name: b) }
           missing_caps = []
           missing_caps << 'CAP_NET_RAW' if caps.include?('CAP_NET_RAW') && !cap_net_raw?
-          status = if missing_bins.empty? && missing_caps.empty?
+          missing_services = services.reject { |s| service?(name: s[:name] || s['name'], path: s[:path] || s['path']) }.map { |s| s[:name] || s['name'] }
+          status = if missing_bins.empty? && missing_caps.empty? && missing_services.empty?
                      :ok
                    elsif bins.any? && missing_bins.length == bins.length
                      :dead
                    else
                      :degraded
                    end
-          { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps }
+          { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps, missing_services: missing_services }
         end
       end
 
@@ -95,7 +106,7 @@ module PWN
         degraded = rows.select { |r| r[:status] == :degraded }
         lines = ["HOST plugins ok=#{rows.count { |r| r[:status] == :ok }} degraded=#{degraded.length} dead=#{dead.length}"]
         (degraded + dead).first(cap).each do |r|
-          miss = (r[:missing_bins] + r[:missing_caps]).join(',')
+          miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services])).join(',')
           lines << "  #{r[:status]} #{r[:plugin]} missing=#{miss}"
         end
         lines.join("\n")
@@ -128,6 +139,12 @@ module PWN
           # Run require cap net raw and return its result
           #{self}.require_cap_net_raw!
 
+          # True when a unix socket/service path exists.
+          #{self}.service?(
+            name: 'optional - service name for the report row',
+            path: 'required - unix socket path (e.g. /var/run/docker.sock)'
+          )
+
           # Run check and return its result
           #{self}.check(
             names: 'optional - Array names value consumed by #check'

data/lib/pwn/plugins/process_tube.rb

@@ -2,6 +2,7 @@
 
 require 'pty'
 require 'timeout'
+require 'socket'
 
 module PWN
   module Plugins
@@ -24,6 +25,17 @@ module PWN
         { id: id, pid: pid }
       end
 
+      public_class_method def self.connect(opts = {})
+        host = (opts[:host] || opts[:target]).to_s
+        port = opts[:port].to_i
+        raise 'ERROR: host and port are required' if host.empty? || port <= 0
+
+        sock = TCPSocket.new(host, port)
+        id = "sock_#{sock.object_id}"
+        @tubes[id] = { r: sock, w: sock, pid: nil, buf: +'' }
+        { id: id, host: host, port: port }
+      end
+
       public_class_method def self.write_line(opts = {})
         t = tube!(opts)
         line = opts[:line] || opts[:data] || ''
@@ -59,7 +71,7 @@ module PWN
         t = tube!(opts)
         t[:w].close
         t[:r].close
-        Process.kill('TERM', t[:pid])
+        Process.kill('TERM', t[:pid]) if t[:pid]
         @tubes.delete(opts[:id].to_s)
         true
       rescue StandardError
@@ -82,6 +94,13 @@ module PWN
             command: 'optional - command value consumed by #spawn'
           )
 
+          # Connect a TCP tube with the same write_line/recvuntil API as spawn.
+          #{self}.connect(
+            host: 'required - hostname or IP address (defaults to opts[:target])',
+            target: 'optional - hostname, IP, or CIDR to scan',
+            port: 'required - TCP/UDP port number'
+          )
+
           # Run write line and return its result
           #{self}.write_line(
             line: 'optional - line value consumed by #write_line',