pwn 0.5.712 → 0.5.714

data/lib/pwn/ai/agent/tools/swarm_map.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'swarm_map',
+  toolset: 'pwn',
+  schema: {
+    name: 'swarm_map',
+    description: 'Fan-out TCP/port map of a CIDR or host list. Sequential when swarm is off.',
+    parameters: {
+      type: 'object',
+      properties: {
+        targets: { type: 'string' },
+        ports: { type: 'string' }
+      },
+      required: %w[targets]
+    }
+  },
+  handler: lambda { |args|
+    PWN::AI::Agent::Swarm.map_targets(
+      targets: args[:targets] || args['targets'],
+      ports: args[:ports] || args['ports'] || '80,443'
+    )
+  }
+)

data/lib/pwn/config.rb

@@ -193,7 +193,16 @@ module PWN
             # Advisory only: never replaces TaskSummarizer / plan_first.
             policy: true,
             toolsets: nil,
-            operator_account: nil
+            operator_account: nil,
+            sessions_keep_days: 90,
+            artifacts_keep_days: 90,
+            max_total_mb: 512,
+            model_routes: {
+              summarize: nil,
+              judge: nil,
+              act: nil,
+              sensitive: nil
+            }
             # multi-agent personas : ~/.pwn/agents.yml  (see PWN::AI::Agent::Swarm.help)
             # swarm bus            : ~/.pwn/swarm/<swarm_id>/bus.jsonl
           }

data/lib/pwn/memory_index.rb

@@ -272,6 +272,50 @@ module PWN
       []
     end
 
+    public_class_method def self.bm25(opts = {})
+      query = opts[:query].to_s.downcase
+      docs = Array(opts[:docs]).map(&:to_s)
+      qtok = expand_query(query: query)
+      return docs.map { |d| { doc: d, score: 0.0 } } if qtok.empty?
+
+      df = Hash.new(0)
+      tokenized = docs.map do |d|
+        toks = d.downcase.scan(/[a-z0-9]{3,}/)
+        toks.uniq.each { |t| df[t] += 1 }
+        toks
+      end
+      n = docs.length.to_f
+      avgdl = tokenized.sum(&:length) / [n, 1].max
+      k1 = 1.2
+      b = 0.75
+      ranked = docs.each_with_index.map do |doc, i|
+        toks = tokenized[i]
+        tf = Hash.new(0)
+        toks.each { |t| tf[t] += 1 }
+        dl = toks.length.to_f
+        score = qtok.sum do |t|
+          f = tf[t]
+          next 0.0 if f.zero?
+
+          idf = Math.log(((n - df[t] + 0.5) / (df[t] + 0.5)) + 1)
+          idf * ((f * (k1 + 1)) / (f + (k1 * (1 - b + (b * dl / avgdl)))))
+        end
+        { doc: doc, score: score }
+      end
+      ranked.sort_by { |h| -h[:score] }
+    end
+
+    private_class_method def self.expand_query(opts = {})
+      toks = opts[:query].to_s.downcase.scan(/[a-z0-9]{3,}/)
+      table = {
+        'bypass' => %w[evasion evade],
+        'rate' => %w[throttle],
+        'limit' => %w[throttle],
+        'login' => %w[auth]
+      }
+      toks.flat_map { |t| [t] + Array(table[t]) }.uniq
+    end
+
     # Author(s):: 0day Inc. <support@0dayinc.com>
 
     public_class_method def self.authors
@@ -308,6 +352,12 @@ module PWN
           texts: 'required - Array texts value consumed by #embed'
         )
 
+        # Rank documents by BM25 (pure Ruby; no embedder required).
+        #{self}.bm25(
+          query: 'required - search text',
+          docs: 'required - Array of document strings'
+        )
+
         # Run reset and return its result
         #{self}.reset
 

data/lib/pwn/plugins/aflplusplus.rb

@@ -2,6 +2,7 @@
 
 require 'open3'
 require 'digest'
+require 'json'
 
 module PWN
   module Plugins
@@ -24,16 +25,38 @@ module PWN
         { stdout: stdout, stderr: stderr, exit: status.exitstatus }
       end
 
+      public_class_method def self.parse_stats(opts = {})
+        out_dir = (opts[:out_dir] || opts[:output]).to_s
+        raise 'ERROR: out_dir is required' if out_dir.empty?
+
+        path = File.join(out_dir, 'fuzzer_stats')
+        path = File.join(out_dir, 'default', 'fuzzer_stats') unless File.file?(path)
+        return {} unless File.file?(path)
+
+        File.read(path).each_line.with_object({}) do |line, acc|
+          key, val = line.split(':', 2)
+          next if key.to_s.strip.empty?
+
+          acc[key.strip.to_sym] = val.to_s.strip
+        end
+      end
+
       public_class_method def self.crash_triage(opts = {})
         out_dir = (opts[:out_dir] || opts[:output]).to_s
         raise 'ERROR: out_dir is required' if out_dir.empty?
 
         crashes = Dir[File.join(out_dir, '**/crashes/id:*')]
         hashes = crashes.map { |p| [p, Digest::SHA256.file(p).hexdigest] }
+        rows = hashes.map do |path, sha|
+          art = File.join(out_dir, "crash-#{sha[0, 12]}.json")
+          File.write(art, JSON.generate(path: path, sha256: sha))
+          { path: path, sha256: sha, artifact: art }
+        end
         {
           crashes: crashes,
           unique: hashes.map(&:last).uniq,
-          asan: crashes.any? { |p| File.binread(p).include?('AddressSanitizer') }
+          asan: crashes.any? { |p| File.binread(p).include?('AddressSanitizer') },
+          artifacts: rows
         }
       end
 
@@ -56,6 +79,12 @@ module PWN
             args: 'optional - Array args value consumed by #fuzz'
           )
 
+          # Parse AFL fuzzer_stats (execs_per_sec, paths, crashes) from out_dir.
+          #{self}.parse_stats(
+            out_dir: 'required - AFL output directory containing fuzzer_stats',
+            output: 'optional - alias for out_dir'
+          )
+
           # Dedup AFL++ crash files by sha256 and note AddressSanitizer hits.
           #{self}.crash_triage(
             out_dir: 'required - AFL output directory containing crashes/',

data/lib/pwn/plugins/artifact_registry.rb

@@ -2,6 +2,7 @@
 
 require 'fileutils'
 require 'json'
+require 'digest'
 
 module PWN
   module Plugins
@@ -40,6 +41,35 @@ module PWN
         end
       end
 
+      public_class_method def self.get(opts = {})
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        { path: path, sha256: Digest::SHA256.file(path).hexdigest, bytes: File.size(path), body: File.binread(path)[0, 65_536] }
+      end
+
+      public_class_method def self.read_page(opts = {})
+        path = opts[:path].to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        offset = opts[:offset].to_i
+        length = (opts[:length] || 4_096).to_i
+        length = 4_096 if length <= 0
+        mode = (opts[:mode] || 'text').to_s
+        data = File.binread(path, length, offset).to_s
+        case mode
+        when 'hex'
+          { path: path, offset: offset, bytes: data.bytesize, hex: data.unpack1('H*') }
+        when 'base64'
+          require 'base64'
+          { path: path, offset: offset, bytes: data.bytesize, body: Base64.strict_encode64(data) }
+        else
+          { path: path, offset: offset, bytes: data.bytesize, body: data.force_encoding('UTF-8').scrub }
+        end
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -61,6 +91,19 @@ module PWN
             session_id: 'optional - session id value consumed by #list'
           )
 
+          # Read an artifact file and return sha256 plus a body cap.
+          #{self}.get(
+            path: 'required - filesystem path of a registered artifact'
+          )
+
+          # Page an artifact as text, hex, or base64 from an offset.
+          #{self}.read_page(
+            path: 'required - filesystem path of the artifact',
+            offset: 'optional - byte offset (defaults to 0)',
+            length: 'optional - byte count (defaults to 4096)',
+            mode: 'optional - text, hex, or base64 (defaults to text)'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/binary_parser.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'metasm'
+require 'digest'
+require 'json'
+require 'fileutils'
 
 module PWN
   module Plugins
@@ -78,6 +81,29 @@ module PWN
         []
       end
 
+      public_class_method def self.triage(opts = {})
+        path = opts[:path].to_s
+        inf = info(opts)
+        secs = sections(opts)
+        imps = Array(imports(opts)).first(40)
+        exps = Array(exports(opts)).first(40)
+        summary = {
+          format: inf[:format],
+          arch: inf[:cpu],
+          bits: inf[:cpu].to_s[/\d+/],
+          imports: imps,
+          exports: exps,
+          function_count: Array(symbols(opts)).length,
+          section_entropy_map: secs.to_h { |s| [s[:name], s[:size]] }
+        }
+        sha = Digest::SHA256.file(path).hexdigest
+        dir = File.join(Dir.home, '.pwn', 'artifacts', 'triage')
+        FileUtils.mkdir_p(dir)
+        art = File.join(dir, "#{sha[0, 16]}.json")
+        File.write(art, JSON.pretty_generate(summary.merge(path: path, sha256: sha)))
+        summary.merge(artifact: art)
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -114,6 +140,11 @@ module PWN
             limit: 'optional - limit value consumed by #relocations'
           )
 
+          # Structured binary triage JSON plus an artifact path under ~/.pwn/artifacts/triage.
+          #{self}.triage(
+            path: 'required - filesystem path of the binary to triage'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/detect_os.rb

@@ -31,10 +31,17 @@ module PWN
         os = :cygwin if OS.cygwin?
         os = :freebsd if OS.freebsd?
         os = :linux if OS.linux?
-        os = :netbsd if OS.host_os.include?('netbsd')
-        os = :openbsd if OS.host_os.include?('openbsd')
+        os = :netbsd if OS.host_os.to_s.include?('netbsd')
+        os = :openbsd if OS.host_os.to_s.include?('openbsd')
         os = :osx if OS.osx?
         os = :windows if OS.windows?
+        if os.nil?
+          uname = `uname -s 2>/dev/null`.to_s.downcase
+          os = :openbsd if uname.include?('openbsd')
+          os = :freebsd if uname.include?('freebsd')
+          os = :netbsd if uname.include?('netbsd')
+          os = :linux if uname.include?('linux')
+        end
 
         os
       rescue StandardError => e
@@ -151,6 +158,56 @@ module PWN
         osr['VERSION'].to_s
       end
 
+      # Supported Method Parameters::
+      # PWN::Plugins::DetectOS.living_off_the_land(
+      #   os_release: 'optional - /etc/os-release body (defaults to reading the file)',
+      #   which: 'optional - Hash of binary name => present Boolean (skips live PATH)',
+      #   bins: 'optional - extra binary names to probe besides plugin required_bins'
+      # )
+
+      public_class_method def self.living_off_the_land(opts = {})
+        os_type = opts[:type] || type
+        flavor = distro(opts)
+        ver = version(opts)
+        cpu = opts[:arch] || arch
+        endn = opts[:endian] || endian
+        names = inventory_names(bins: opts[:bins])
+        which = opts[:which]
+        present = []
+        missing = []
+        names.each do |name|
+          ok = if which.is_a?(Hash)
+                 which[name] || which[name.to_sym]
+               else
+                 bin_present?(name: name)
+               end
+          (ok ? present : missing) << name
+        end
+        cap = if opts.key?(:cap_net_raw)
+                opts[:cap_net_raw]
+              else
+                cap_net_raw_live
+              end
+        docker = if opts.key?(:docker)
+                   opts[:docker]
+                 else
+                   docker_live
+                 end
+        summary = "#{flavor} #{ver} #{cpu} present=#{present.first(24).join(',')} missing=#{missing.first(12).join(',')}"
+        {
+          type: os_type,
+          distro: flavor,
+          version: ver,
+          arch: cpu.to_s,
+          endian: endn,
+          present: present,
+          missing: missing,
+          cap_net_raw: cap,
+          docker: docker,
+          summary: summary
+        }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):
           0day Inc. <support@0dayinc.com>
@@ -193,12 +250,62 @@ module PWN
             version: 'optional - force a version string instead of detecting'
           )
 
+          # Profile this host: distro, arch, and which plugin bins are on PATH.
+          #{self}.living_off_the_land(
+            os_release: 'optional - /etc/os-release body (defaults to reading the file)',
+            lsb_release: 'optional - /etc/lsb-release body',
+            build_prop: 'optional - Android /system/build.prop body',
+            type: 'optional - OS family from #type',
+            which: 'optional - Hash of binary name => true/false (skips live PATH when set)',
+            bins: 'optional - extra binary names to probe besides plugin required_bins',
+            arch: 'optional - CPU arch override',
+            endian: 'optional - :little or :big override',
+            cap_net_raw: 'optional - Boolean CAP_NET_RAW override',
+            docker: 'optional - Boolean docker.sock override'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
         constants.sort
       end
 
+      private_class_method def self.inventory_names(opts = {})
+        extra = Array(opts[:bins]).map(&:to_s).reject(&:empty?)
+        deps = if defined?(PWN::Plugins::PreflightChecker::PLUGIN_DEPS)
+                 PWN::Plugins::PreflightChecker::PLUGIN_DEPS.values.flat_map { |row| Array(row[:bins]) }
+               else
+                 []
+               end
+        (deps + extra).map(&:to_s).reject(&:empty?).uniq
+      end
+
+      private_class_method def self.bin_present?(opts = {})
+        name = opts[:name].to_s
+        return false if name.empty?
+        return PWN::Plugins::PreflightChecker.bin?(name: name) if defined?(PWN::Plugins::PreflightChecker)
+
+        ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? { |dir| File.executable?(File.join(dir, name)) }
+      rescue StandardError
+        false
+      end
+
+      private_class_method def self.cap_net_raw_live
+        return unless defined?(PWN::Plugins::PreflightChecker)
+
+        PWN::Plugins::PreflightChecker.cap_net_raw?
+      rescue StandardError
+        nil
+      end
+
+      private_class_method def self.docker_live
+        return unless defined?(PWN::Plugins::PreflightChecker)
+
+        PWN::Plugins::PreflightChecker.service?(name: 'docker', path: '/var/run/docker.sock')
+      rescue StandardError
+        nil
+      end
+
       private_class_method def self.normalize_id(opts = {})
         raw = opts[:id].to_s.downcase.strip.gsub(/["']/, '')
         return :unknown if raw.empty?

data/lib/pwn/plugins/exploit_db.rb

@@ -2,6 +2,8 @@
 
 require 'json'
 require 'open3'
+require 'csv'
+require 'fileutils'
 
 module PWN
   module Plugins
@@ -15,7 +17,9 @@ module PWN
         q = (opts[:query] || opts[:q]).to_s
         raise 'ERROR: query is required' if q.empty?
 
-        return { error: 'searchsploit missing', query: q } unless PWN::Plugins::PreflightChecker.bin?(name: 'searchsploit')
+        local = local_hits(query: q)
+        return { query: q, results: local, source: 'local' } unless local.empty?
+        return { error: 'searchsploit missing', query: q, results: [] } unless PWN::Plugins::PreflightChecker.bin?(name: 'searchsploit')
 
         stdout, stderr, status = Open3.capture3('searchsploit', '--json', q)
         parsed = begin
@@ -37,6 +41,39 @@ module PWN
         search(query: q).merge(cpe: cpe, product: product, version: version)
       end
 
+      private_class_method def self.local_hits(opts = {})
+        q = opts[:query].to_s.downcase
+        path = intel_csv
+        return [] unless File.file?(path)
+
+        CSV.read(path, headers: true).filter_map do |row|
+          blob = row.to_h.values.join(' ').downcase
+          next unless blob.include?(q) || q.split.any? { |tok| tok.length > 2 && blob.include?(tok) }
+
+          {
+            cve: row['cve'],
+            edb_id: row['id'],
+            description: row['description'],
+            local_path: row['file'],
+            cvss: row['cvss']
+          }
+        end
+      rescue StandardError
+        []
+      end
+
+      private_class_method def self.intel_csv
+        dest = File.join(Dir.home, '.pwn', 'intel', 'files_exploits.csv')
+        return dest if File.file?(dest)
+
+        bundled = File.expand_path('../../../etc/intel/files_exploits.csv', __dir__)
+        if File.file?(bundled)
+          FileUtils.mkdir_p(File.dirname(dest))
+          FileUtils.cp(bundled, dest)
+        end
+        dest
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end

data/lib/pwn/plugins/findings.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # Persistent finding rows for pwn-ai (title, severity, host, evidence, PoC).
+    module Findings
+      FILE = File.join(Dir.home, '.pwn', 'findings.jsonl')
+
+      public_class_method def self.required_bins
+        []
+      end
+
+      public_class_method def self.record(opts = {})
+        title = opts[:title].to_s
+        raise 'ERROR: title is required' if title.empty?
+
+        arts = Array(opts[:poc_artifacts]).map(&:to_s).reject(&:empty?)
+        arts << opts[:poc].to_s unless opts[:poc].to_s.empty?
+        raise 'ERROR: poc_artifacts are required' if arts.empty?
+
+        row = {
+          id: SecureRandom.hex(6),
+          title: title,
+          severity: (opts[:severity] || 'info').to_s,
+          host: opts[:host].to_s,
+          evidence: opts[:evidence].to_s,
+          poc: opts[:poc].to_s,
+          poc_artifacts: arts,
+          session_id: opts[:session_id].to_s,
+          at: Time.now.utc.iso8601
+        }
+        FileUtils.mkdir_p(File.dirname(FILE))
+        File.open(FILE, 'a') { |f| f.puts(JSON.generate(row)) }
+        row
+      end
+
+      public_class_method def self.report(opts = {})
+        return [] unless File.file?(FILE)
+
+        rows = File.readlines(FILE).filter_map do |ln|
+          JSON.parse(ln, symbolize_names: true)
+        rescue JSON::ParserError
+          nil
+        end
+        host = opts[:host].to_s
+        rows = rows.select { |r| r[:host].to_s == host } unless host.empty?
+        rows
+      end
+
+      public_class_method def self.render(opts = {})
+        dir = opts[:dir_path].to_s
+        dir = File.join(Dir.home, '.pwn', 'exports') if dir.empty?
+        name = opts[:report_name].to_s
+        name = 'findings' if name.empty?
+        payload = { title: 'Findings', findings: report }
+        {
+          markdown: PWN::Reports::Markdown.generate(results_hash: payload, dir_path: dir, report_name: name),
+          html: PWN::Reports::HTML.generate(results_hash: payload, dir_path: dir, report_name: name),
+          json: PWN::Reports::JSON.generate(results_hash: payload, dir_path: dir, report_name: name)
+        }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Append a finding row to ~/.pwn/findings.jsonl.
+          #{self}.record(
+            title: 'required - short finding title',
+            severity: 'optional - info|low|medium|high|critical (defaults to info)',
+            host: 'optional - affected host or URL',
+            evidence: 'optional - proof text or path',
+            poc: 'optional - filesystem path of a PoC',
+            poc_artifacts: 'required - Array of artifact paths proving the issue',
+            session_id: 'optional - pwn-ai session id'
+          )
+
+          # List recorded findings, optionally filtered by host.
+          #{self}.report(
+            host: 'optional - only rows whose host matches this string'
+          )
+
+          # Render findings as markdown, html, and json reports.
+          #{self}.render(
+            dir_path: 'optional - output directory (defaults to ~/.pwn/exports)',
+            report_name: 'optional - basename without extension (defaults to findings)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/ghidra.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'open3'
+require 'fileutils'
+require 'json'
+
+module PWN
+  module Plugins
+    # Headless Ghidra analyzeHeadless wrapper with r2 fallback.
+    module Ghidra
+      public_class_method def self.required_bins
+        %w[analyzeHeadless]
+      end
+
+      public_class_method def self.analyze(opts = {})
+        path = (opts[:bin] || opts[:path]).to_s
+        raise 'ERROR: bin is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        if PWN::Plugins::PreflightChecker.bin?(name: 'analyzeHeadless')
+          proj = opts[:project_dir].to_s
+          proj = File.join(Dir.home, '.pwn', 'ghidra') if proj.empty?
+          FileUtils.mkdir_p(proj)
+          stdout, stderr, status = Open3.capture3('analyzeHeadless', proj, 'pwn', '-import', path, '-deleteProject')
+          return { stdout: stdout, stderr: stderr, exit: status.exitstatus, engine: 'ghidra' }
+        end
+
+        return r2_fallback(path: path) if PWN::Plugins::PreflightChecker.bin?(name: 'r2')
+
+        { error: 'analyzeHeadless missing', hint: 'install Ghidra or r2; pwn setup --profile re' }
+      end
+
+      public_class_method def self.decompile(opts = {})
+        analyze(opts)
+      end
+
+      private_class_method def self.r2_fallback(opts = {})
+        path = opts[:path].to_s
+        stdout, stderr, status = Open3.capture3('r2', '-q', '-c', 'aaa;s main;pdg', path)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus, engine: 'r2' }
+      rescue StandardError => e
+        { error: e.message, engine: 'r2' }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run analyzeHeadless (or r2 pdg) against a binary.
+          #{self}.analyze(
+            bin: 'required - filesystem path of the binary',
+            path: 'optional - alias for bin',
+            project_dir: 'optional - Ghidra project directory under ~/.pwn/ghidra'
+          )
+
+          # Decompile a binary; same as #analyze when Ghidra/r2 is the engine.
+          #{self}.decompile(
+            bin: 'required - filesystem path of the binary',
+            path: 'optional - alias for bin',
+            project_dir: 'optional - Ghidra project directory'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end