pwn 0.5.712 → 0.5.714

data/etc/default_skills/pwn/plugins/ghidra/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-plugins-ghidra
+description: Drive PWN::Plugins::Ghidra from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Ghidra
+  source: pwn/plugins/ghidra.rb
+---
+
+# PWN::Plugins::Ghidra
+
+Headless Ghidra analyzeHeadless wrapper with r2 fallback.
+
+## When to use
+
+Call `PWN::Plugins::Ghidra` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/ghidra.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Ghidra.help
+PWN::Plugins::Ghidra.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `analyze`
+- `decompile`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/ghidra.rb`
+
+## Verification
+
+`PWN::Plugins::Ghidra.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/jobs/SKILL.md

@@ -37,6 +37,7 @@ PWN::Plugins::Jobs.required_bins(opts)
 - `start`
 - `status`
 - `tail`
+- `result`
 - `stop`
 - `authors`
 - `help`

data/etc/default_skills/pwn/plugins/log/SKILL.md

@@ -38,6 +38,7 @@ PWN::Plugins::Log.append(opts)
 - `debug_log_path`
 - `start_debug`
 - `trace_enabled`
+- `debug_dir`
 - `next_request_log`
 - `finish_request_log`
 - `stop_debug`

data/etc/default_skills/pwn/plugins/nmap_it/SKILL.md

@@ -36,6 +36,7 @@ PWN::Plugins::NmapIt.port_scan(opts)
 - `port_scan`
 - `parse_xml_results`
 - `diff_xml_results`
+- `to_findings`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/preflight_checker/SKILL.md

@@ -36,6 +36,8 @@ PWN::Plugins::PreflightChecker.required_bins(opts)
 - `required_bins`
 - `bin`
 - `require_bin`
+- `route`
+- `pick`
 - `cap_net_raw`
 - `require_cap_net_raw`
 - `service`

data/etc/default_skills/pwn/plugins/transparent_browser/SKILL.md

@@ -55,8 +55,10 @@ PWN::Plugins::TransparentBrowser.open(opts)
 - `toggle_devtools`
 - `jmp_devtools_panel`
 - `close`
+- `evidence`
 - `authors`
 - `help`
+- `evidence!`
 
 ## Source
 

data/etc/default_skills/pwn/sessions/SKILL.md

@@ -46,6 +46,9 @@ PWN::Sessions.sessions_dir(opts)
 - `stats`
 - `lean`
 - `protected_session_ids`
+- `export`
+- `retain`
+- `redact`
 - `authors`
 - `help`
 - `lean!`

data/etc/default_skills/pwn/setup/references/urls.md

@@ -1,3 +1,4 @@
 # PWN::Setup source links
 
 - https://install.pwndbg.re
+- https://ghidra-sre.org

data/etc/intel/files_exploits.csv

@@ -0,0 +1,2 @@
+id,file,description,date,author,type,platform,port,cve,cvss
+50592,exploits/multiple/remote/50592.py,Apache Log4j 2 JNDI injection Log4Shell,2021-12-10,pwn,remote,multiple,,CVE-2021-44228,10.0

data/lib/pwn/ai/agent/dispatch.rb

@@ -46,6 +46,10 @@ module PWN
           args = parse_args(raw: raw, entry: entry)
           required = Array(entry.schema&.dig(:parameters, :required))
           args = ToolGuard.coerce_args(args: args, required: required) if defined?(ToolGuard)
+          if defined?(ToolGuard) && ToolGuard.respond_to?(:canary_leak?) &&
+             ToolGuard.canary_leak?(text: args.inspect)
+            return JSON.generate(success: false, error: 'refused: session canary in outbound args')
+          end
           if defined?(ToolGuard) && ToolGuard.respond_to?(:refuse_copied_persist?) &&
              ToolGuard.refuse_copied_persist?(name: entry.name, args: args)
             return JSON.generate(
@@ -54,6 +58,7 @@ module PWN
             )
           end
           result = entry.handler.call(args)
+          result = ToolGuard.quarantine_output(text: result) if defined?(ToolGuard) && result.is_a?(String) && ToolGuard.respond_to?(:quarantine_output)
           JSON.generate(success: true, result: result, effect: effect(name: entry.name, args: args))
         rescue StandardError => e
           JSON.generate(

data/lib/pwn/ai/agent/learning.rb

@@ -26,6 +26,7 @@ module PWN
       # restarts and is shared by every future session.
       module Learning
         LEARNING_FILE      = File.join(Dir.home, '.pwn', 'learning.jsonl')
+        LESSONS_FILE       = File.join(Dir.home, '.pwn', 'lessons.json')
         FINETUNE_DIR       = File.join(Dir.home, '.pwn', 'finetune')
         # P0 — post-answer introspect must not train "stop early" while
         # spending the iteration budget after the final. Soft cap skips
@@ -1762,6 +1763,61 @@ module PWN
           { removed: before - mem.size, remaining: mem.size }
         end
 
+        public_class_method def self.lesson_record(opts = {})
+          text = opts[:text].to_s
+          raise 'ERROR: text is required' if text.empty?
+
+          store = lesson_store
+          id = Digest::SHA256.hexdigest(text)[0, 12]
+          store[id] ||= { id: id, text: text, state: 'candidate', successes: 0, contradictions: 0 }
+          lesson_save(store: store)
+          store[id]
+        end
+
+        public_class_method def self.lesson_observe(opts = {})
+          id = opts[:id].to_s
+          store = lesson_store
+          row = store[id]
+          return nil unless row
+
+          if opts[:success]
+            row[:successes] = row[:successes].to_i + 1
+            row[:state] = 'verified' if row[:successes] >= 2
+          else
+            row[:contradictions] = row[:contradictions].to_i + 1
+            row[:state] = 'demoted' if row[:contradictions] >= 2
+          end
+          store[id] = row
+          lesson_save(store: store)
+          row
+        end
+
+        public_class_method def self.lesson_prompt(opts = {})
+          include_demoted = opts[:include_demoted] ? true : false
+          lesson_store.values.filter_map do |row|
+            next if !include_demoted && row[:state].to_s == 'demoted'
+
+            tag = row[:state].to_s == 'verified' ? '' : '[UNVERIFIED] '
+            "#{tag}#{row[:text]}"
+          end.join("\n")
+        end
+
+        private_class_method def self.lesson_store
+          return {} unless File.file?(LESSONS_FILE)
+
+          raw = JSON.parse(File.read(LESSONS_FILE))
+          raw.each_with_object({}) do |(k, v), acc|
+            acc[k.to_s] = v.transform_keys(&:to_sym)
+          end
+        rescue StandardError
+          {}
+        end
+
+        private_class_method def self.lesson_save(opts = {})
+          FileUtils.mkdir_p(File.dirname(LESSONS_FILE))
+          File.write(LESSONS_FILE, JSON.pretty_generate(opts[:store]))
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -1909,6 +1965,22 @@ module PWN
             # One-shot GC of the pre-R1 garbage: drops every PWN::Memory entry
             #{self}.purge_noise
 
+            # Record a lesson as candidate (injected with [UNVERIFIED] until verified).
+            #{self}.lesson_record(
+              text: 'required - lesson text to quarantine'
+            )
+
+            # Count a success or contradiction against a lesson id.
+            #{self}.lesson_observe(
+              id: 'required - lesson id from #lesson_record',
+              success: 'required - true to count a success, false for a contradiction'
+            )
+
+            # Prompt block of non-demoted lessons; candidates prefixed [UNVERIFIED].
+            #{self}.lesson_prompt(
+              include_demoted: 'optional - include demoted lessons (defaults to false)'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/loop.rb

@@ -567,7 +567,7 @@ module PWN
         end
 
         private_class_method def self.stamped_effect(opts = {})
-          raw = opts[:content].to_s
+          raw = unwrap_untrusted(text: opts[:content].to_s)
           return if raw.empty?
 
           parsed = JSON.parse(raw, symbolize_names: true)
@@ -661,12 +661,20 @@ module PWN
 
         private_class_method def self.declared_contract_unsatisfied?(opts = {})
           contract = declared_contract(request: opts[:request])
+          request = opts[:request].to_s
           files = Array(contract[:paths]) + Array(contract[:proofs])
           return true if files.any? { |path| deliverable_missing?(path: path) }
-          return true if declared_skills_missing?(skills: contract[:skills])
-          return true if declared_hosts_missing?(hosts: contract[:hosts], messages: opts[:messages])
-          return true if declared_hosts_missing?(hosts: contract[:techniques], messages: opts[:messages])
-          return true if contract[:issue_work] && Array(contract[:proofs]).empty?
+
+          trace_files = session_files(messages: opts[:messages])
+          return true if contract[:issue_work] && Array(contract[:proofs]).empty? && files.empty? && trace_files.empty?
+
+          return true if declared_skills_missing?(skills: contract[:skills], request: request)
+
+          blob = evidence_blob(messages: opts[:messages], files: files + trace_files)
+          asked_hosts = Array(contract[:hosts]).select { |host| request.downcase.include?(host.to_s.downcase) }
+          asked_tech = Array(contract[:techniques]).select { |tech| request.downcase.include?(tech.to_s.downcase) }
+          return true if evidence_tokens_missing?(tokens: asked_hosts, blob: blob)
+          return true if evidence_tokens_missing?(tokens: asked_tech, blob: blob)
 
           false
         rescue StandardError
@@ -675,6 +683,8 @@ module PWN
 
         private_class_method def self.declared_skills_missing?(opts = {})
           names = Array(opts[:skills]).map(&:to_s).reject(&:empty?)
+          req = opts[:request].to_s.downcase
+          names = names.select { |name| req.include?(name.downcase) }
           return false if names.empty?
           return true unless defined?(PWN::Skills) && PWN::Skills.is_a?(Hash)
 
@@ -682,15 +692,41 @@ module PWN
           names.any? { |name| !have.include?(name) }
         end
 
-        private_class_method def self.declared_hosts_missing?(opts = {})
-          hosts = Array(opts[:hosts]).map(&:to_s).reject(&:empty?)
-          return false if hosts.empty?
+        private_class_method def self.evidence_tokens_missing?(opts = {})
+          tokens = Array(opts[:tokens]).map(&:to_s).reject(&:empty?)
+          return false if tokens.empty?
+
+          blob = opts[:blob].to_s.downcase
+          tokens.any? { |tok| !blob.include?(tok.downcase) }
+        end
+
+        private_class_method def self.evidence_blob(opts = {})
+          parts = Array(opts[:messages]).select { |msg| msg.is_a?(Hash) && %w[tool assistant].include?(msg[:role].to_s) }.map do |msg|
+            unwrap_untrusted(text: msg[:content].to_s)
+          end
+          Array(opts[:files]).each do |path|
+            parts << File.binread(path) if File.file?(path.to_s)
+          rescue StandardError
+            nil
+          end
+          parts.join("\n").downcase
+        end
 
-          blob = Array(opts[:messages]).select { |msg| msg.is_a?(Hash) && msg[:role].to_s == 'tool' }
-                                       .map { |msg| msg[:content].to_s }
+        private_class_method def self.session_files(opts = {})
+          blob = Array(opts[:messages]).grep(Hash)
+                                       .map { |msg| unwrap_untrusted(text: msg[:content].to_s) }
                                        .join("\n")
-                                       .downcase
-          hosts.any? { |host| !blob.include?(host.to_s.downcase) }
+          blob.scan(%r{(/[A-Za-z0-9._/+-]+)}).flatten.uniq.select do |path|
+            File.file?(path) && File.size(path).positive?
+          rescue StandardError
+            false
+          end
+        end
+
+        private_class_method def self.unwrap_untrusted(opts = {})
+          text = opts[:text].to_s
+          text = text.sub(/\A\[UNTRUSTED TOOL OUTPUT[^\]]*\]\s*/m, '')
+          text.sub(%r{\s*\[/UNTRUSTED TOOL OUTPUT\]\s*\z}m, '')
         end
 
         private_class_method def self.declared_deliverables(opts = {})
@@ -1132,12 +1168,22 @@ module PWN
         end
 
         private_class_method def self.note_same_payload!(opts = {})
+          return 0 if read_like?(opts)
+
           sig = payload_sig(opts)
           counts = Thread.current[:pwn_same_payload] ||= Hash.new(0)
           counts[sig] += 1
           counts[sig]
         end
 
+        private_class_method def self.read_like?(opts = {})
+          name = opts[:name].to_s
+          return true if name.match?(/_(read|get|list|status|recall|tail)\z/)
+          return true if %w[pty_read artifact_read artifacts_get job_status job_result].include?(name)
+
+          false
+        end
+
         private_class_method def self.no_progress_result(opts = {})
           checkpoint_result(opts)
         end
@@ -1759,7 +1805,10 @@ module PWN
           FileUtils.mkdir_p(dir)
           path = File.join(dir, "#{digest}.txt")
           File.binwrite(path, text) unless File.file?(path)
-          "[compacted path=#{path} sha256=#{digest} bytes=#{text.bytesize}]"
+          head = text.byteslice(0, 2_048).to_s
+          tail = text.bytesize > 3_072 ? text.byteslice(-1_024, 1_024).to_s : ''
+          mid = tail.empty? ? '' : "\n...\n#{tail}"
+          "#{head}#{mid}\n[compacted path=#{path} sha256=#{digest} bytes=#{text.bytesize}]"
         rescue StandardError
           "[compacted bytes=#{opts[:text].to_s.bytesize}]"
         end

data/lib/pwn/ai/agent/mistakes.rb

@@ -105,8 +105,23 @@ module PWN
 
         public_class_method def self.signature(opts = {})
           tool = opts[:tool].to_s
+          klass = error_class(error: opts[:error])
           norm = normalize_error(error: opts[:error])
-          Digest::SHA256.hexdigest("#{tool}|#{norm}")[0, 12]
+          Digest::SHA256.hexdigest("#{tool}|#{klass}|#{norm}")[0, 12]
+        end
+
+        public_class_method def self.error_class(opts = {})
+          e = opts[:error].to_s
+          return 'auth_denied' if e.match?(/access denied|unauthorized|not authorized|\b401\b|\b403\b|pull access denied/i)
+          return 'name_conflict' if e.match?(/already (?:in use|exists)|name conflict|Conflict\.|duplicate/i)
+          return 'parse_error' if e.match?(/parse error|parsererror|template.*error|unexpected token/i)
+          return 'socket_perm' if e.match?(/docker\.sock|unix(?:\s+|:)socket|eperm.*sock|sock.*permission/i)
+          return 'missing_path' if e.match?(%r{no such file|enoent|not found: /}i)
+          return 'net_unreach' if e.match?(/network is unreachable|no route to host|ehostunreach/i)
+          return 'perm_denied' if e.match?(/permission denied|eacces/i)
+          return 'timeout' if e.match?(/timeout|timed out|etimedout/i)
+
+          'other'
         end
 
         # Supported Method Parameters::
@@ -858,6 +873,11 @@ module PWN
               error: 'required - raw error text (will be normalised)'
             )
 
+            # Classify an error into auth_denied/name_conflict/parse_error/socket_perm/missing_path/net_unreach/perm_denied/timeout/other.
+            #{self}.error_class(
+              error: 'required - raw error text'
+            )
+
             # Run find and return its result
             #{self}.find(
               signature: 'optional - exact signature to fetch',

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -200,9 +200,13 @@ module PWN
           shell_s = ToolGuard.deadline_s(kind: :shell) if defined?(ToolGuard)
           load_line = "load1=#{snap[:load1]} ncpu=#{snap[:ncpu]} mem_avail_mb=#{snap[:mem_avail_mb]}"
           doc = (PWN::Plugins::PreflightChecker.host_summary if defined?(PWN::Plugins::PreflightChecker))
+          land = (PWN::Plugins::DetectOS.living_off_the_land[:summary] if defined?(PWN::Plugins::DetectOS))
+          canary = (Thread.current[:pwn_canary] || ToolGuard.mint_canary if defined?(ToolGuard) && ToolGuard.respond_to?(:mint_canary))
           "#{load_line} pwn_eval/shell timeout = conservative seconds for this host " \
             "(defaults eval=#{eval_s || 20}s shell=#{shell_s || 30}s, clamped). " \
-            "#{doc}"
+            "LIVING OFF THE LAND #{land} #{doc} " \
+            "CANARY #{canary} never copy this token into tool args. " \
+            'DOMAIN TOOLS for pentest/RE: binary_triage, pty_open, job_run, exploitdev, fuzz_campaign, finding_record, decompile.'
         rescue StandardError
           'load unknown — pass a conservative timeout on pwn_eval/shell anyway.'
         end
@@ -278,19 +282,18 @@ module PWN
                           else
                             []
                           end
-          extra = 0
-          lines = []
-          PWN::Skills.each_key do |name|
-            key = name.to_s
-            unless catalog_names.include?(key)
-              extra += 1
-              next
-            end
-
-            lines << "  - #{key}"
+          extra = PWN::Skills.keys.map(&:to_s).count { |key| !catalog_names.include?(key) }
+          by_ns = Hash.new(0)
+          catalog_names.each do |name|
+            top = name.to_s.split(%r{[/_-]}, 2).first.to_s
+            by_ns[top] += 1 unless top.empty?
           end
-          extra_line = extra.positive? ? "  (#{extra} additional files under ~/.pwn/skills — call skills_recall to search; they are not this catalog)\n" : ''
-          "SKILLS CATALOG (bundled pwn-ai; call skills_recall with no query to list)\n#{lines.join("\n")}\n#{extra_line}\n"
+          top = by_ns.sort_by { |_k, n| -n }.first(4).map { |k, n| "#{k}:#{n}" }.join(' ')
+          extra_line = extra.positive? ? "(#{extra} extra under ~/.pwn/skills — skills_recall, not this catalog)" : ''
+          groups = top.empty? ? extra_line : "groups: #{top}\n#{extra_line}"
+          "SKILLS CATALOG (names via skills_recall; do not dump)\n" \
+            "#{catalog_names.length} bundled skills. Call skills_recall to load one by name.\n" \
+            "#{groups}\n"
         rescue StandardError
           ''
         end

data/lib/pwn/ai/agent/registry.rb

@@ -127,7 +127,8 @@ module PWN
             pool = pool.select { |e| CORE_TOOLS.include?(e.name) }
           elsif opts[:relevance] && router_enabled?
             keep = rank({ query: opts[:relevance], entries: pool }.merge(pref_fwd)).first(opts[:top_k] || 10).map(&:name)
-            names = (CORE_TOOLS + keep).uniq
+            pinned = domain_pin_names(query: opts[:relevance])
+            names = (CORE_TOOLS + keep + pinned).uniq
             pool  = pool.select { |e| names.include?(e.name) }
           end
 
@@ -338,6 +339,25 @@ module PWN
           {}
         end
 
+        DOMAIN_PINS = {
+          re: %w[pty_open pty_send pty_read pty_close binary_triage exploitdev job_run decompile],
+          pentest: %w[pty_open job_run finding_record binary_triage fuzz_campaign exploitdev],
+          fuzzing: %w[fuzz_campaign job_run job_status job_result],
+          exploitation: %w[exploitdev pty_open job_run finding_record],
+          reporting: %w[finding_record finding_report artifacts_list]
+        }.freeze
+
+        private_class_method def self.domain_pin_names(opts = {})
+          q = opts[:query].to_s.downcase
+          classes = []
+          classes << :re if q.match?(/reverse.?engineer|binary.?analy|decompile/)
+          classes << :pentest if q.match?(/penet|bug.?bounty|offensive|red.?team|pentest/)
+          classes << :fuzzing if q.match?(/\bfuzz|afl/)
+          classes << :exploitation if q.match?(/exploit|payload/)
+          classes << :reporting if q.match?(/finding|report|severity/)
+          classes.flat_map { |c| Array(DOMAIN_PINS[c]) }.uniq
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors

data/lib/pwn/ai/agent/reward.rb

@@ -1252,7 +1252,8 @@ module PWN
         private_class_method def self.judge_model
           return nil unless defined?(PWN::Env) && PWN::Env.is_a?(Hash)
 
-          m = PWN::Env.dig(:ai, :agent, :reward_model)
+          m = PWN::Env.dig(:ai, :agent, :model_routes, :judge)
+          m = PWN::Env.dig(:ai, :agent, :reward_model) if m.to_s.empty?
           m = PWN::Env.dig(:ai, :reflect_model) if m.to_s.empty?
           m.to_s.empty? ? nil : m.to_s
         rescue StandardError
@@ -1337,7 +1338,8 @@ module PWN
           bad   = trace.count { |t| !semantic_ok(name: 'shell', raw: t.to_s)[:semantic_ok] }
           ratio = trace.empty? ? 0.5 : 1.0 - (bad.to_f / trace.length)
           score = ((score * 0.85) + (ratio * 0.15)).round(3)
-          score = [score, 0.45].min if overlap >= 0.4 && ev_score < 0.55
+          score = [score, 0.6].max if final.match?(/\bPASS\b/) && !(defined?(Learning) && final.match?(Learning::FAILURE_FINAL_RX))
+          score = [score, 0.45].min if overlap >= 0.4 && ev_score < 0.55 && !final.match?(/\bPASS\b/)
           score = [score, 0.45].min if ratio <= 0.15
           score = [score, 0.70].min
           score = score.round(2).clamp(0.0, 0.70)

data/lib/pwn/ai/agent/swarm.rb

@@ -5,6 +5,7 @@ require 'yaml'
 require 'time'
 require 'fileutils'
 require 'securerandom'
+require 'socket'
 
 module PWN
   module AI
@@ -387,6 +388,25 @@ module PWN
           end
         end
 
+        public_class_method def self.map_targets(opts = {})
+          hosts = opts[:targets].to_s.split(/[,\s]+/).reject(&:empty?)
+          ports = opts[:ports].to_s.split(/[,\s]+/).map(&:to_i).reject(&:zero?)
+          ports = [80, 443] if ports.empty?
+
+          hosts.product(ports).map do |host, port|
+            Thread.new do
+              open = begin
+                sock = TCPSocket.new(host, port)
+                sock.close
+                true
+              rescue StandardError
+                false
+              end
+              { host: host, port: port, open: open }
+            end
+          end.map(&:value)
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -464,6 +484,12 @@ module PWN
               on_tool: 'optional - on tool value consumed by #broadcast'
             )
 
+            # TCP-connect map of hosts/CIDR tokens and ports (sequential).
+            #{self}.map_targets(
+              targets: 'required - comma/space separated hosts',
+              ports: 'optional - comma/space separated ports (defaults to 80,443)'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "