pwn 0.5.709 → 0.5.710

data/lib/pwn/plugins/radare2.rb

@@ -19,7 +19,7 @@ module PWN
       #   path: 'required - filesystem path to the binary r2 should open'
       # )
       public_class_method def self.open(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'r2')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'r2')
         path = opts[:path].to_s
         raise 'ERROR: path is required' if path.empty?
         raise "ERROR: binary not found: #{path}" unless File.file?(path)

data/lib/pwn/plugins/recon.rb

@@ -21,16 +21,20 @@ module PWN
         raise 'ERROR: domain is required' if domain.empty?
 
         names = []
-        if PWN::Plugins::Doctor.bin?(name: 'subfinder')
+        if PWN::Plugins::PreflightChecker.bin?(name: 'subfinder')
           stdout, = Open3.capture3('subfinder', '-silent', '-d', domain)
           names.concat(stdout.lines.map(&:strip).reject(&:empty?))
         end
+        if PWN::Plugins::PreflightChecker.bin?(name: 'amass')
+          stdout, = Open3.capture3('amass', 'enum', '-passive', '-d', domain, '-nocolor')
+          names.concat(stdout.lines.map(&:strip).reject(&:empty?))
+        end
         names.concat(Array(crt_sh(domain: domain)))
         normalize_names(names: names, domain: domain)
       end
 
       public_class_method def self.httpx(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'httpx')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'httpx')
         hosts = Array(opts[:hosts] || opts[:urls])
         stdout, = Open3.capture3('httpx', '-silent', '-json', stdin_data: "#{hosts.join("\n")}\n")
         stdout.each_line.filter_map do |ln|
@@ -41,8 +45,8 @@ module PWN
       end
 
       public_class_method def self.masscan(opts = {})
-        bin = %w[masscan naabu].find { |b| PWN::Plugins::Doctor.bin?(name: b) }
-        raise PWN::Plugins::Doctor::MissingBinary, 'ERROR: masscan/naabu missing' unless bin
+        bin = %w[masscan naabu].find { |b| PWN::Plugins::PreflightChecker.bin?(name: b) }
+        raise PWN::Plugins::PreflightChecker::MissingBinary, 'ERROR: masscan/naabu missing' unless bin
 
         target = opts[:target].to_s
         ports = (opts[:ports] || '1-1024').to_s
@@ -75,6 +79,26 @@ module PWN
         raise "ERROR: cert-transparency lookup failed for #{domain} (#{errors.join('; ')})"
       end
 
+      public_class_method def self.amass(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'amass')
+        domain = opts[:domain].to_s
+        raise 'ERROR: domain is required' if domain.empty?
+
+        stdout, = Open3.capture3('amass', 'enum', '-passive', '-d', domain, '-nocolor')
+        stdout.lines.map(&:strip).reject(&:empty?)
+      end
+
+      public_class_method def self.passive_dns(opts = {})
+        domain = opts[:domain].to_s.downcase.strip
+        raise 'ERROR: domain is required' if domain.empty?
+
+        uri = URI("https://api.hackertarget.com/hostsearch/?q=#{URI.encode_www_form_component(domain)}")
+        rows = http_json(url: uri.to_s, timeout: opts[:timeout] || 8)
+        Array(rows)
+      rescue StandardError => e
+        { error: "#{e.class}: #{e.message}", domain: domain }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -107,6 +131,17 @@ module PWN
             timeout: 'optional - seconds to wait before giving up'
           )
 
+          # Passive amass enum (requires amass).
+          #{self}.amass(
+            domain: 'required - FQDN to query (e.g. example.com)'
+          )
+
+          # Passive DNS hostsearch for a domain (hackertarget).
+          #{self}.passive_dns(
+            domain: 'required - FQDN to query (e.g. example.com)',
+            timeout: 'optional - seconds to wait before giving up'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/semgrep.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+
+module PWN
+  module Plugins
+    # semgrep wrapper feeding SAST-shaped findings.
+    module Semgrep
+      public_class_method def self.required_bins
+        %w[semgrep]
+      end
+
+      public_class_method def self.scan(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'semgrep')
+        target = opts[:path] || opts[:target] || '.'
+        cmd = ['semgrep', '--json', '--quiet']
+        cmd += ['--config', opts[:config].to_s] if opts[:config]
+        cmd << target.to_s
+        stdout, stderr, status = Open3.capture3(*cmd)
+        parsed = begin
+          JSON.parse(stdout)
+        rescue JSON::ParserError
+          {}
+        end
+        findings = Array(parsed['results']).map do |r|
+          {
+            title: r['check_id'],
+            severity: r.dig('extra', 'severity'),
+            path: r['path'],
+            line: r.dig('start', 'line'),
+            message: r.dig('extra', 'message')
+          }
+        end
+        { findings: findings, stderr: stderr, exit: status.exitstatus }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run semgrep --json and map results into finding hashes.
+          #{self}.scan(
+            path: 'optional - directory or file to scan (defaults to .)',
+            target: 'optional - alias for path',
+            config: 'optional - semgrep --config value (e.g. auto or p/owasp-top-ten)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/sock.rb

@@ -23,6 +23,7 @@ module PWN
 
         protocol = opts[:protocol]
         protocol ||= :tcp
+        PWN::Plugins::PreflightChecker.require_cap_net_raw! if protocol.to_s.to_sym == :raw
 
         # TODO: Add proxy support
 

data/lib/pwn/plugins/sqlmap.rb

@@ -11,7 +11,7 @@ module PWN
       end
 
       public_class_method def self.run(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'sqlmap')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'sqlmap')
         url = opts[:url].to_s
         raise 'ERROR: url is required' if url.empty?
 

data/lib/pwn/plugins/volatility.rb

@@ -11,8 +11,8 @@ module PWN
       end
 
       public_class_method def self.run(opts = {})
-        bin = %w[vol volatility3 vol3].find { |b| PWN::Plugins::Doctor.bin?(name: b) }
-        raise PWN::Plugins::Doctor::MissingBinary, 'ERROR: volatility3 (vol) missing' unless bin
+        bin = %w[vol volatility3 vol3].find { |b| PWN::Plugins::PreflightChecker.bin?(name: b) }
+        raise PWN::Plugins::PreflightChecker::MissingBinary, 'ERROR: volatility3 (vol) missing' unless bin
 
         memory = opts[:memory] || opts[:file]
         plugin = opts[:plugin] || 'windows.pslist'
@@ -22,6 +22,16 @@ module PWN
         { stdout: stdout, stderr: stderr, exit: status.exitstatus }
       end
 
+      public_class_method def self.yara(opts = {})
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'yara')
+        rules = opts[:rules] || opts[:rule]
+        target = opts[:memory] || opts[:file] || opts[:path]
+        raise 'ERROR: rules and memory/file are required' if rules.to_s.empty? || target.to_s.empty?
+
+        stdout, stderr, status = Open3.capture3('yara', rules.to_s, target.to_s)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -38,6 +48,15 @@ module PWN
             plugin: 'required - plugin value consumed by #run (defaults to windows.pslist)'
           )
 
+          # Scan a memory image with a yara rules file.
+          #{self}.yara(
+            rules: 'required - path to a .yar rules file',
+            rule: 'optional - alias for rules',
+            memory: 'required - memory image path',
+            file: 'optional - alias for memory',
+            path: 'optional - alias for memory'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins.rb

@@ -20,7 +20,7 @@ module PWN
     autoload :Char, 'pwn/plugins/char'
     autoload :CreditCard, 'pwn/plugins/credit_card'
     autoload :CredentialAttack, 'pwn/plugins/credential_attack'
-    autoload :Doctor, 'pwn/plugins/doctor'
+    autoload :PreflightChecker, 'pwn/plugins/preflight_checker'
     autoload :PWNLogger, 'pwn/plugins/pwn_logger'
     autoload :DAOLDAP, 'pwn/plugins/dao_ldap'
     autoload :DAOMongo, 'pwn/plugins/dao_mongo'
@@ -29,6 +29,7 @@ module PWN
     autoload :DefectDojo, 'pwn/plugins/defect_dojo'
     autoload :DetectOS, 'pwn/plugins/detect_os'
     autoload :EIN, 'pwn/plugins/ein'
+    autoload :ExploitDB, 'pwn/plugins/exploit_db'
     autoload :FileFu, 'pwn/plugins/file_fu'
     autoload :Fuzz, 'pwn/plugins/fuzz'
     autoload :Frida, 'pwn/plugins/frida'
@@ -42,6 +43,7 @@ module PWN
     autoload :IPInfo, 'pwn/plugins/ip_info'
     autoload :IRC, 'pwn/plugins/irc'
     autoload :Jenkins, 'pwn/plugins/jenkins'
+    autoload :K8s, 'pwn/plugins/k8s'
     autoload :JiraDataCenter, 'pwn/plugins/jira_data_center'
     autoload :Jobs, 'pwn/plugins/jobs'
     autoload :JSONPathify, 'pwn/plugins/json_pathify'
@@ -68,6 +70,7 @@ module PWN
     autoload :Recon, 'pwn/plugins/recon'
     autoload :REPL, 'pwn/plugins/repl'
     autoload :ScannableCodes, 'pwn/plugins/scannable_codes'
+    autoload :Semgrep, 'pwn/plugins/semgrep'
     autoload :Serial, 'pwn/plugins/serial'
     autoload :Shodan, 'pwn/plugins/shodan'
     autoload :SlackClient, 'pwn/plugins/slack_client'

data/lib/pwn/setup.rb

@@ -257,6 +257,18 @@ module PWN
         apt: %w[], dnf: %w[], pacman: %w[], brew: %w[], port: %w[],
         plugins: %w[PWN::Plugins::ExploitDev]
       },
+      'pwndbg' => {
+        apt: %w[pwndbg], dnf: %w[], pacman: %w[pwndbg], brew: %w[], port: %w[],
+        plugins: %w[PWN::Plugins::GDB]
+      },
+      'ropper' => {
+        apt: %w[], dnf: %w[], pacman: %w[], brew: %w[], port: %w[],
+        plugins: %w[PWN::Plugins::ExploitDev]
+      },
+      'rizin' => {
+        apt: %w[rizin], dnf: %w[], pacman: %w[rizin], brew: %w[], port: %w[],
+        plugins: %w[PWN::Plugins::Radare2]
+      },
       'qemu-x86_64' => {
         apt: %w[qemu-user-static], dnf: %w[qemu-user-static], pacman: %w[qemu-user-static],
         brew: %w[], port: %w[],
@@ -344,7 +356,7 @@ module PWN
       re: {
         desc: 'Radare2 · GDB · ExploitDev · Frida · Android RE tier',
         gems: %w[],
-        bins: %w[gdb r2 checksec ROPgadget one_gadget qemu-x86_64 yara frida apktool jadx]
+        bins: %w[gdb r2 checksec ROPgadget one_gadget qemu-x86_64 yara frida apktool jadx pwndbg ropper rizin]
       },
       full: {
         desc: 'everything above',

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.709'
+  VERSION = '0.5.710'
 end

data/spec/integration/help_contract_spec.rb

@@ -75,6 +75,8 @@ RSpec.describe 'PWN:: modules — .help / .authors behavioural contract', :aggre
 
       # .help does not raise, completes in <2 s, and produces SOMETHING
       # (stdout, a String return, or a namespace-index Array).
+      # PWN::FFI::Stdio attaches libc puts; help must not write fd 1 behind
+      # $stdout (Kernel.puts in that module). Still swallow $stdout here.
       out = nil
       expect do
         Timeout.timeout(2) { out = capture_out { mod.help } }

data/spec/lib/pwn/plugins/exploit_db_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::ExploitDB do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/k8s_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::K8s do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/plugins/{doctor_spec.rb → preflight_checker_spec.rb}

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe PWN::Plugins::Doctor do
+describe PWN::Plugins::PreflightChecker do
   it 'should display information for authors' do
     expect(described_class).to respond_to :authors
   end

data/spec/lib/pwn/plugins/semgrep_spec.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Semgrep do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+end

data/spec/lib/pwn/req_queue_spec.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'socket'
+require 'tmpdir'
+
+describe 'pwn_debug REQ queue remaining surface' do
+  describe PWN::Plugins::ExploitDev do
+    it 'catalogs per-arch execve_bin_sh shellcode as opcodes' do
+      sc = described_class.shellcode(arch: 'x86_64', kind: 'execve_bin_sh')
+      expect(sc.to_s).not_to be_empty
+      expect(sc.to_s).not_to eq("\x90")
+    end
+
+    it 'one_gadget returns a structured miss when the binary is absent' do
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).and_call_original
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).with(name: 'one_gadget').and_return(false)
+      row = described_class.one_gadget(path: '/lib/x86_64-linux-gnu/libc.so.6')
+      expect(row).to be_a(Hash)
+      expect(row[:error].to_s).to match(/one_gadget/i)
+    end
+
+    it 'libc_offsets extracts named symbols from an ELF' do
+      path = %w[/bin/ls /usr/bin/ls /bin/true /usr/bin/true].find { |p| File.file?(p) }
+      skip 'no ELF on host' unless path
+
+      row = described_class.libc_offsets(path: path)
+      expect(row).to include(:path)
+      expect(row[:symbols]).to be_a(Hash)
+    end
+  end
+
+  describe PWN::Plugins::GDB do
+    it 'core raises without a core path' do
+      expect { described_class.core(core: '') }.to raise_error(/core is required/)
+    end
+
+    it 'breakpoints includes break commands in the gdb batch' do
+      allow(Open3).to receive(:capture3).and_return(['ok', '', instance_double(Process::Status, exitstatus: 0)])
+      described_class.breakpoints(binary: '/bin/true', breakpoints: ['main', '*0x401000'])
+      expect(Open3).to have_received(:capture3) do |*argv|
+        joined = argv.flatten.join(' ')
+        expect(joined).to include('break main')
+        expect(joined).to include('break *0x401000')
+      end
+    end
+  end
+
+  describe PWN::Plugins::ProcessTube do
+    it 'connect uses the same write_line/recvuntil API over TCP' do
+      server = TCPServer.new('127.0.0.1', 0)
+      port = server.addr[1]
+      thr = Thread.new do
+        sock = server.accept
+        sock.write("banner\n")
+        sock.flush
+        line = sock.gets
+        sock.write("ack #{line}")
+        sock.close
+      end
+      tube = described_class.connect(host: '127.0.0.1', port: port)
+      described_class.recvuntil(id: tube[:id], until: "\n", timeout: 2)
+      described_class.write_line(id: tube[:id], line: 'hi')
+      out = described_class.recvuntil(id: tube[:id], until: 'hi', timeout: 2)
+      expect(out).to include('ack')
+    ensure
+      described_class.close(id: tube[:id]) if tube
+      thr&.kill
+      server&.close
+    end
+  end
+
+  describe PWN::Setup do
+    it 're profile includes pwndbg, ropper, and rizin' do
+      bins = PWN::Setup::PROFILES[:re][:bins]
+      expect(bins).to include('pwndbg', 'ropper', 'rizin')
+    end
+  end
+
+  describe PWN::Plugins::PreflightChecker do
+    it 'check includes missing_services' do
+      row = described_class.check.find { |r| r[:plugin].to_s.include?('Packet') }
+      expect(row).to include(:missing_services)
+    end
+
+    it 'service? is false for a missing unix socket' do
+      expect(described_class.service?(name: 'no-such-pwn-svc', path: '/tmp/pwn-no-such.sock')).to be false
+    end
+  end
+
+  describe PWN::Plugins::Sock do
+    it 'protocol :raw demands CAP_NET_RAW' do
+      allow(PWN::Plugins::PreflightChecker).to receive(:cap_net_raw?).and_return(false)
+      expect do
+        described_class.connect(target: '127.0.0.1', port: 9, protocol: :raw)
+      end.to raise_error(PWN::Plugins::PreflightChecker::MissingCapability)
+    end
+  end
+
+  describe PWN::Plugins::Nuclei do
+    it 'to_findings maps JSONL rows into report-shaped hashes' do
+      rows = [{ 'info' => { 'name' => 'xss', 'severity' => 'high' }, 'matched-at' => 'https://x/' }]
+      out = described_class.to_findings(rows: rows)
+      expect(out.first).to include(:title, :severity, :url)
+    end
+  end
+
+  describe PWN::Plugins::Fuzz do
+    it 'http mutates a request with dictionary payloads' do
+      reqs = described_class.http(
+        request: "GET /FUZZ HTTP/1.1\r\nHost: x\r\n\r\n",
+        dictionary: %w[admin ../]
+      )
+      expect(reqs.length).to eq(2)
+      expect(reqs.first).to include('admin')
+    end
+
+    it 'file_format mutates a seed with dictionary blobs' do
+      Dir.mktmpdir do |dir|
+        seed = File.join(dir, 'seed.bin')
+        File.binwrite(seed, 'AAAA')
+        out = described_class.file_format(path: seed, dictionary: ["\xff\xff"])
+        expect(out).to be_an(Array)
+        expect(out.first).to be_a(String)
+      end
+    end
+  end
+
+  describe PWN::Plugins::ArtifactRegistry do
+    it 'lists artifacts for a session id' do
+      Dir.mktmpdir do |dir|
+        stub_const('PWN::Plugins::ArtifactRegistry::ROOT', dir)
+        src = File.join(dir, 'loot.txt')
+        File.write(src, 'x')
+        described_class.register(session_id: 'sess1', path: src, kind: 'loot')
+        rows = described_class.list(session_id: 'sess1')
+        expect(rows.first[:kind]).to eq('loot')
+      end
+    end
+  end
+
+  describe PWN::Plugins::Frida do
+    it 'ssl_pinning_script returns injectable javascript' do
+      js = described_class.ssl_pinning_script
+      expect(js).to match(/SSL_CTX|TrustManager|pinning/i)
+    end
+  end
+
+  describe PWN::Plugins::Semgrep do
+    it 'responds to scan' do
+      expect(described_class).to respond_to(:scan)
+    end
+  end
+
+  describe PWN::Plugins::ExploitDB do
+    it 'responds to search and cve_for_cpe' do
+      expect(described_class).to respond_to(:search)
+      expect(described_class).to respond_to(:cve_for_cpe)
+    end
+  end
+
+  describe PWN::Plugins::K8s do
+    it 'responds to trivy and kube_hunter' do
+      expect(described_class).to respond_to(:trivy)
+      expect(described_class).to respond_to(:kube_hunter)
+    end
+  end
+end