pwn 0.5.709 → 0.5.711

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a21d92ef6104c4aec2f54470689f0398fda97a2894bb9a61b1034a72b5291e1f
-  data.tar.gz: 19a47d2db6aae502ab6a2380853569f172ff393839187818b891f01272029f5f
+  metadata.gz: 2ab0eff0005f523bb5972be43cf49ab4c15ab9eaecda0968c9206621e2997e47
+  data.tar.gz: 2a166f6ff6b5620e820de709d5dc1ae356550e23afffbc52de138d3ab6499d7f
 SHA512:
-  metadata.gz: 79f9a1ac713919b1e4cd239f5475b9d14f2b73dcc19152fc0b1e82312d6f1c25062bb90f45ffe5533bd3fda09769faf3207d946110a196d3d050847344ac3549
-  data.tar.gz: 8718455cc9a5db44fa41ce916b26292a92889c4c7208ecaa74df310dddafeddfd4d8ba1983ea8c437b83c67a36bc589fb06d5c0d2729e6b104a3bff598c2a7c3
+  metadata.gz: c74d677beb74e9cd348faebbc1b02dff1b48956b0225487ef48af1be080f94137472f892dce6698a2d55c0febbbb1637a477e4ec090098ffe64cc5e26030b33b
+  data.tar.gz: 6bf02d8127f74b609d3cc8ae1c03586b96f29e44c921e00893dc550f516817c6b4d3456ad516262c1d919e93a36cceffedc7891039460801de2c937dfbbaf2d1

data/Gemfile

@@ -22,7 +22,7 @@ gem 'brakeman', '8.0.6'
 gem 'bson', '5.2.0'
 gem 'bundler', '>=4.0.19'
 gem 'bundler-audit', '>=0.9.3'
-gem 'bunny', '3.2.0'
+gem 'bunny', '3.3.0'
 gem 'colorize', '1.1.0'
 gem 'credit_card_validations', '9.0.0'
 gem 'curses', '1.7.0'
@@ -77,7 +77,7 @@ gem 'rbvmomi2', '3.10.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.1.1'
+gem 'rmagick', '7.1.3'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'

data/documentation/Installation.md

@@ -103,10 +103,13 @@ pwn setup --list-profiles
 `--deps` / `--profile` will:
 
 1. Resolve the profile → set of native gems + external binaries.
-2. Map those to OS packages for **your** package manager (data lives in
-   `PWN::Setup::NATIVE_GEMS` / `::TOOLCHAIN` - versioned with the gem, so
-   `gem install --verbose pwn`, git checkout, Docker, Packer and Vagrant all read the
-   same table).
+2. Map those to OS packages for **this** distro and version
+   (`PWN::Plugins::DetectOS.distro` / `.version`, e.g. Kali `2026.3` vs Ubuntu
+   `24.04`) via `PWN::Setup.packages_for`. Family fallbacks still live in
+   `PWN::Setup::NATIVE_GEMS` / `::TOOLCHAIN`. Tools with no OS package on this
+   distro (Frida, one_gadget, ROPgadget, checksec, ropper, kube-hunter, or
+   Kali-only names on Ubuntu) install via `pip` / `gem` or are skipped so
+   `apt-get` does not abort the whole profile.
 3. Show the exact commands, prompt (unless `--yes`), run them, then
    `gem pristine` / `gem install` any native extension that still fails to
    load, and re-run the doctor.
@@ -127,7 +130,7 @@ pwn setup --list-profiles
 | `voice` | `PWN::Plugins::Voice` · `extro_voice` · espeak-ng / sox |
 | `exploit` | `Metasploit` · `sqlmap` |
 | `hardware` | `Serial` · `BusPirate` · `Android` · `BareSIP` · `extro_serial` · `extro_telecomm` |
-| `re` | `Radare2` · `GDB` · `ExploitDev` · `Frida` · Android RE (`apktool`/`jadx`) |
+| `re` | `Radare2` · `GDB` · `ExploitDev` · `Frida` · Android RE (`apktool`/`jadx`) · `pwndbg` · `ropper` · `rizin` |
 | `full` | everything above |
 
 ### All flags

data/etc/default_skills/exploitdev/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: exploitdev
+description: "Exploit-dev SOP: packing, cyclic, ROP, one_gadget, libc offsets."
+---
+
+# Exploit development
+
+Use `PWN::Plugins::ExploitDev` from `pwn_eval` — do not shell out to pwntools unless a plugin method is missing.
+
+## Packing
+
+```ruby
+PWN::Plugins::ExploitDev.p32(value: 0x41414141)
+PWN::Plugins::ExploitDev.p64(value: addr, endian: :little)
+PWN::Plugins::ExploitDev.flat(parts: [0xdeadbeef, "A" * 32, 0x401000])
+```
+
+## Cyclic
+
+```ruby
+pattern = PWN::Plugins::ExploitDev.cyclic(length: 200)
+offset = PWN::Plugins::ExploitDev.cyclic_find(value: "Aa0A", length: 200)
+```
+
+## Shellcode / ROP
+
+```ruby
+PWN::Plugins::ExploitDev.shellcode(arch: 'x86_64', kind: 'execve_bin_sh')
+PWN::Plugins::ExploitDev.gadgets(path: '/path/to/binary')
+PWN::Plugins::ExploitDev.one_gadget(path: '/lib/x86_64-linux-gnu/libc.so.6')
+PWN::Plugins::ExploitDev.libc_offsets(path: '/lib/x86_64-linux-gnu/libc.so.6')
+```
+
+## Interactive
+
+`PWN::Plugins::ProcessTube.spawn` or `.connect` then `write_line` / `recvuntil`.
+`PWN::Plugins::GDB.run_to_crash` / `.breakpoints` / `.core`.
+`PWN::Plugins::Radare2.open` then `cmd` (text) or `cmdj` (JSON).

data/etc/default_skills/pwn/plugins/aflplusplus/SKILL.md

@@ -35,6 +35,7 @@ PWN::Plugins::AFLplusplus.required_bins(opts)
 
 - `required_bins`
 - `fuzz`
+- `crash_triage`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/credential_attack/SKILL.md

@@ -38,9 +38,16 @@ PWN::Plugins::CredentialAttack.required_bins(opts)
 - `hydra`
 - `john`
 - `hashcat`
+- `medusa`
+- `identify_hash`
+- `fetch_seclists`
 - `authors`
 - `help`
 
+## References
+
+- `references/urls.md` — URLs from source
+
 ## Source
 
 `pwn/plugins/credential_attack.rb`

data/etc/default_skills/pwn/plugins/credential_attack/references/urls.md

@@ -0,0 +1,3 @@
+# PWN::Plugins::CredentialAttack source links
+
+- https://github.com/danielmiessler/SecLists.git

data/etc/default_skills/pwn/plugins/detect_os/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::Plugins::DetectOS
 
-This plugin converts images to readable text
+Detect host OS family, distro flavor, and version string.
 
 ## When to use
 
@@ -36,6 +36,8 @@ PWN::Plugins::DetectOS.type(opts)
 - `type`
 - `arch`
 - `endian`
+- `distro`
+- `version`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/exploit_db/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-plugins-exploitdb
+description: Drive PWN::Plugins::ExploitDB from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::ExploitDB
+  source: pwn/plugins/exploit_db.rb
+---
+
+# PWN::Plugins::ExploitDB
+
+searchsploit / ExploitDB plus a CPE string builder for nmap versions.
+
+## When to use
+
+Call `PWN::Plugins::ExploitDB` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/exploit_db.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::ExploitDB.help
+PWN::Plugins::ExploitDB.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `search`
+- `cve_for_cpe`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/exploit_db.rb`
+
+## Verification
+
+`PWN::Plugins::ExploitDB.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/exploit_dev/SKILL.md

@@ -46,6 +46,8 @@ PWN::Plugins::ExploitDev.required_bins(opts)
 - `cyclic_find`
 - `flat`
 - `shellcode`
+- `one_gadget`
+- `libc_offsets`
 - `fmt_writes`
 - `gadgets`
 - `authors`

data/etc/default_skills/pwn/plugins/frida/SKILL.md

@@ -36,6 +36,8 @@ PWN::Plugins::Frida.required_bins(opts)
 - `required_bins`
 - `ps`
 - `attach`
+- `spawn`
+- `ssl_pinning_script`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/fuzz/SKILL.md

@@ -34,6 +34,8 @@ PWN::Plugins::Fuzz.socket(opts)
 ## Public methods
 
 - `socket`
+- `http`
+- `file_format`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/gdb/SKILL.md

@@ -39,6 +39,7 @@ PWN::Plugins::GDB.required_bins(opts)
 - `registers`
 - `mitigations`
 - `core`
+- `breakpoints`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/k8s/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: pwn-plugins-k8s
+description: Drive PWN::Plugins::K8s from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::K8s
+  source: pwn/plugins/k8s.rb
+---
+
+# PWN::Plugins::K8s
+
+trivy / kube-hunter wrappers plus docker-socket preflight.
+
+## When to use
+
+Call `PWN::Plugins::K8s` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/k8s.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::K8s.help
+PWN::Plugins::K8s.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `trivy`
+- `kube_hunter`
+- `docker_socket`
+- `authors`
+- `help`
+- `docker_socket?`
+
+## Source
+
+`pwn/plugins/k8s.rb`
+
+## Verification
+
+`PWN::Plugins::K8s.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/nuclei/SKILL.md

@@ -35,6 +35,8 @@ PWN::Plugins::Nuclei.required_bins(opts)
 
 - `required_bins`
 - `scan`
+- `to_findings`
+- `to_defectdojo`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/{doctor → preflight_checker}/SKILL.md

@@ -1,34 +1,34 @@
 ---
-name: pwn-plugins-doctor
-description: Drive PWN::Plugins::Doctor from pwn_eval.
+name: pwn-plugins-preflightchecker
+description: Drive PWN::Plugins::PreflightChecker from pwn_eval.
 license: MIT
 allowed-tools: [pwn, pwn_eval]
 metadata:
   bundled: true
   generated: true
-  module: PWN::Plugins::Doctor
-  source: pwn/plugins/doctor.rb
+  module: PWN::Plugins::PreflightChecker
+  source: pwn/plugins/preflight_checker.rb
 ---
 
-# PWN::Plugins::Doctor
+# PWN::Plugins::PreflightChecker
 
 Plugin/binary/capability preflight. Plugins declare required_bins / required_caps; HOST summaries list degraded modules without autoloading the whole plugin tree.
 
 ## When to use
 
-Call `PWN::Plugins::Doctor` from `pwn_eval` when the task needs this module.
+Call `PWN::Plugins::PreflightChecker` from `pwn_eval` when the task needs this module.
 Do not reimplement it in shell.
 
 ## Methodologies
 
-Generated from `pwn/plugins/doctor.rb`. Prefer the public class methods below.
+Generated from `pwn/plugins/preflight_checker.rb`. Prefer the public class methods below.
 Class methods take `(opts = {})` and read `opts`.
 
 ## How to call
 
 ```ruby
-PWN::Plugins::Doctor.help
-PWN::Plugins::Doctor.required_bins(opts)
+PWN::Plugins::PreflightChecker.help
+PWN::Plugins::PreflightChecker.required_bins(opts)
 ```
 
 ## Public methods
@@ -38,6 +38,7 @@ PWN::Plugins::Doctor.required_bins(opts)
 - `require_bin`
 - `cap_net_raw`
 - `require_cap_net_raw`
+- `service`
 - `check`
 - `host_summary`
 - `authors`
@@ -46,12 +47,13 @@ PWN::Plugins::Doctor.required_bins(opts)
 - `cap_net_raw?`
 - `require_bin!`
 - `require_cap_net_raw!`
+- `service?`
 
 ## Source
 
-`pwn/plugins/doctor.rb`
+`pwn/plugins/preflight_checker.rb`
 
 ## Verification
 
-`PWN::Plugins::Doctor.respond_to?(:required_bins)` after the
+`PWN::Plugins::PreflightChecker.respond_to?(:required_bins)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/process_tube/SKILL.md

@@ -35,6 +35,7 @@ PWN::Plugins::ProcessTube.required_bins(opts)
 
 - `required_bins`
 - `spawn`
+- `connect`
 - `write_line`
 - `recvuntil`
 - `recvline`

data/etc/default_skills/pwn/plugins/recon/SKILL.md

@@ -38,6 +38,8 @@ PWN::Plugins::Recon.required_bins(opts)
 - `httpx`
 - `masscan`
 - `crt_sh`
+- `amass`
+- `passive_dns`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/recon/references/urls.md

@@ -3,3 +3,4 @@
 - https://api.certspotter.com/v1/issuances?domain=#{URI.encode_www_form_component(domain
 - https://crt.sh/?q=#{URI.encode_www_form_component(domain
 - https://crt.sh/?q=#{URI.encode_www_form_component(
+- https://api.hackertarget.com/hostsearch/?q=#{URI.encode_www_form_component(domain

data/etc/default_skills/pwn/plugins/semgrep/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-plugins-semgrep
+description: Drive PWN::Plugins::Semgrep from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Semgrep
+  source: pwn/plugins/semgrep.rb
+---
+
+# PWN::Plugins::Semgrep
+
+semgrep wrapper feeding SAST-shaped findings.
+
+## When to use
+
+Call `PWN::Plugins::Semgrep` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/semgrep.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Semgrep.help
+PWN::Plugins::Semgrep.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `scan`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/semgrep.rb`
+
+## Verification
+
+`PWN::Plugins::Semgrep.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/volatility/SKILL.md

@@ -35,6 +35,7 @@ PWN::Plugins::Volatility.required_bins(opts)
 
 - `required_bins`
 - `run`
+- `yara`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/setup/SKILL.md

@@ -28,11 +28,12 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::Setup.help
-PWN::Setup.pkg_manager(opts)
+PWN::Setup.packages_for(opts)
 ```
 
 ## Public methods
 
+- `packages_for`
 - `pkg_manager`
 - `check`
 - `deps`
@@ -49,5 +50,5 @@ PWN::Setup.pkg_manager(opts)
 
 ## Verification
 
-`PWN::Setup.respond_to?(:pkg_manager)` after the
+`PWN::Setup.respond_to?(:packages_for)` after the
 module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -199,7 +199,7 @@ module PWN
           eval_s = ToolGuard.deadline_s(kind: :eval) if defined?(ToolGuard)
           shell_s = ToolGuard.deadline_s(kind: :shell) if defined?(ToolGuard)
           load_line = "load1=#{snap[:load1]} ncpu=#{snap[:ncpu]} mem_avail_mb=#{snap[:mem_avail_mb]}"
-          doc = (PWN::Plugins::Doctor.host_summary if defined?(PWN::Plugins::Doctor))
+          doc = (PWN::Plugins::PreflightChecker.host_summary if defined?(PWN::Plugins::PreflightChecker))
           "#{load_line} pwn_eval/shell timeout = conservative seconds for this host " \
             "(defaults eval=#{eval_s || 20}s shell=#{shell_s || 30}s, clamped). " \
             "#{doc}"

data/lib/pwn/ai/agent/tools/sessions.rb

@@ -31,7 +31,14 @@ PWN::AI::Agent::Registry.register(
       limit: args[:limit] || 12,
       exclude_session_id: exclude,
       include_current: args[:include_current] == true
-    )
+    ).tap do |hits|
+      sid = exclude.to_s
+      next if sid.empty? || !defined?(PWN::Plugins::ArtifactRegistry)
+
+      artifacts = PWN::Plugins::ArtifactRegistry.list(session_id: sid)
+      hits[:artifacts] = artifacts if hits.is_a?(Hash)
+      hits << { artifacts: artifacts } if hits.is_a?(Array) && artifacts.any?
+    end
   }
 )
 

data/lib/pwn/ffi/stdio.rb

@@ -34,7 +34,9 @@ module PWN
       # Display Usage for this Module
 
       public_class_method def self.help
-        puts "USAGE:
+        # libc `puts` is attached on this module; use Kernel so $stdout capture
+        # (rspec help_contract) and the REPL both see Ruby IO, not fd 1 raw.
+        Kernel.puts "USAGE:
           # Run available and return its result
           #{self}.available?
 

data/lib/pwn/plugins/aflplusplus.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'open3'
+require 'digest'
 
 module PWN
   module Plugins
@@ -11,7 +12,7 @@ module PWN
       end
 
       public_class_method def self.fuzz(opts = {})
-        PWN::Plugins::Doctor.require_bin!(name: 'afl-fuzz')
+        PWN::Plugins::PreflightChecker.require_bin!(name: 'afl-fuzz')
         in_dir = opts[:in_dir] || opts[:corpus]
         out_dir = opts[:out_dir] || opts[:output]
         target = opts[:target]
@@ -23,6 +24,19 @@ module PWN
         { stdout: stdout, stderr: stderr, exit: status.exitstatus }
       end
 
+      public_class_method def self.crash_triage(opts = {})
+        out_dir = (opts[:out_dir] || opts[:output]).to_s
+        raise 'ERROR: out_dir is required' if out_dir.empty?
+
+        crashes = Dir[File.join(out_dir, '**/crashes/id:*')]
+        hashes = crashes.map { |p| [p, Digest::SHA256.file(p).hexdigest] }
+        {
+          crashes: crashes,
+          unique: hashes.map(&:last).uniq,
+          asan: crashes.any? { |p| File.binread(p).include?('AddressSanitizer') }
+        }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -42,6 +56,12 @@ module PWN
             args: 'optional - Array args value consumed by #fuzz'
           )
 
+          # Dedup AFL++ crash files by sha256 and note AddressSanitizer hits.
+          #{self}.crash_triage(
+            out_dir: 'required - AFL output directory containing crashes/',
+            output: 'optional - alias for out_dir'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/android.rb

@@ -1286,16 +1286,22 @@ module PWN
         decoded = File.join(out, 'apktool')
         jadx_out = File.join(out, 'jadx')
         steps = []
-        if PWN::Plugins::Doctor.bin?(name: 'apktool')
+        if PWN::Plugins::PreflightChecker.bin?(name: 'apktool')
           system('apktool', 'd', '-f', '-o', decoded, apk)
           steps << :apktool
         end
-        if PWN::Plugins::Doctor.bin?(name: 'jadx')
+        if PWN::Plugins::PreflightChecker.bin?(name: 'jadx')
           FileUtils.mkdir_p(jadx_out)
           system('jadx', '-d', jadx_out, apk)
           steps << :jadx
         end
-        { out_dir: out, steps: steps, apk: apk }
+        manifest = File.join(decoded, 'AndroidManifest.xml')
+        perms = []
+        if File.file?(manifest)
+          txt = File.read(manifest)
+          perms = txt.scan(/android:name="([^"]+)"/).flatten.grep(/PERMISSION|permission/)
+        end
+        { out_dir: out, steps: steps, apk: apk, permissions: perms, manifest: (File.file?(manifest) ? manifest : nil) }
       end
 
       # Author(s):: 0day Inc. <support@0dayinc.com>