pwn 0.5.716 → 0.5.718

data/lib/pwn/ai/agent/tools/intel_lookup.rb

@@ -13,12 +13,16 @@ PWN::AI::Agent::Registry.register(
       properties: {
         query: { type: 'string' },
         cve: { type: 'string' },
-        cpe: { type: 'string' }
+        cpe: { type: 'string' },
+        kind: { type: 'string' },
+        binary: { type: 'string' },
+        technique: { type: 'string' }
       }
     }
   },
   handler: lambda { |args|
-    q = args[:query] || args['query'] || args[:cve] || args['cve'] || args[:cpe] || args['cpe']
-    PWN::Plugins::ExploitDB.search(query: q)
+    q = args[:query] || args['query'] || args[:cve] || args['cve'] || args[:cpe] || args['cpe'] || args[:binary] || args['binary']
+    kind = args[:kind] || args['kind'] || 'cve'
+    PWN::Plugins::ExploitDB.lookup(kind: kind, query: q, binary: args[:binary] || args['binary'], technique: args[:technique] || args['technique'])
   }
 )

data/lib/pwn/ai/agent/tools/pty_session.rb

@@ -71,3 +71,46 @@ PWN::AI::Agent::Registry.register(
     PWN::Plugins::ProcessTube.close(id: args[:id] || args['id'])
   }
 )
+PWN::AI::Agent::Registry.register(
+  name: 'pty_session',
+  toolset: 'terminal',
+  schema: {
+    name: 'pty_session',
+    description: 'Interactive PTY: op spawn|expect|send|stream|close.',
+    parameters: {
+      type: 'object',
+      properties: {
+        op: { type: 'string' },
+        session_id: { type: 'string' },
+        id: { type: 'string' },
+        cmd: { type: 'string' },
+        command: { type: 'string' },
+        pattern: { type: 'string' },
+        until: { type: 'string' },
+        timeout: { type: 'integer' },
+        data: { type: 'string' },
+        line: { type: 'string' },
+        offset: { type: 'integer' }
+      },
+      required: %w[op]
+    }
+  },
+  handler: lambda { |args|
+    op = (args[:op] || args['op']).to_s
+    id = args[:id] || args[:session_id] || args['id'] || args['session_id']
+    case op
+    when 'spawn'
+      PWN::Plugins::ProcessTube.spawn(cmd: args[:cmd] || args[:command] || args['cmd'])
+    when 'expect'
+      PWN::Plugins::ProcessTube.expect(id: id, until: args[:pattern] || args[:until] || args['pattern'], timeout: args[:timeout])
+    when 'send'
+      PWN::Plugins::ProcessTube.write_line(id: id, line: args[:data] || args[:line] || args['data'])
+    when 'stream'
+      PWN::Plugins::ProcessTube.stream(id: id, offset: args[:offset])
+    when 'close'
+      PWN::Plugins::ProcessTube.close(id: id)
+    else
+      { error: "unknown op #{op}" }
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/session_export.rb

@@ -10,11 +10,11 @@ PWN::AI::Agent::Registry.register(
     description: 'Export a session transcript plus attached artifacts as a tar.gz under ~/.pwn/exports.',
     parameters: {
       type: 'object',
-      properties: { session_id: { type: 'string' } },
+      properties: { session_id: { type: 'string' }, engagement_id: { type: 'string' } },
       required: %w[session_id]
     }
   },
   handler: lambda { |args|
-    PWN::Sessions.export(session_id: args[:session_id] || args['session_id'])
+    PWN::Sessions.export(session_id: args[:session_id] || args['session_id'], engagement_id: args[:engagement_id] || args['engagement_id'])
   }
 )

data/lib/pwn/ai/agent/tools/shell.rb

@@ -59,7 +59,10 @@ PWN::AI::Agent::Registry.register(
     if cmd.empty? || PWN::AI::Agent::ToolGuard.placeholder?(text: cmd)
       return PWN::AI::Agent::ToolGuard.invalid_payload(
         hint: 'command is required (string). Do not send ..., {...}, {…}, or empty. ' \
-              'Example: shell(command="uname -r").'
+              'Example: shell(command="uname -r").',
+        offending_token: '...',
+        code: 'SYNTAX_DENY',
+        suggestion: 'replace ellipsis or placeholders with a concrete command'
       )
     end
 

data/lib/pwn/ai/agent/tools/verify.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require 'digest'
+require 'json'
+require 'socket'
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'verify',
+  toolset: 'sessions',
+  schema: {
+    name: 'verify',
+    description: 'Run machine-checkable acceptance checks (file_exists, file_sha256, file_grep, port_open, http_status, cmd_exit0).',
+    parameters: {
+      type: 'object',
+      properties: {
+        checks: { type: 'array' }
+      },
+      required: %w[checks]
+    }
+  },
+  handler: lambda { |args|
+    checks = Array(args[:checks] || args['checks'])
+    results = checks.map do |row|
+      row = {} unless row.is_a?(Hash)
+      type = (row[:type] || row['type']).to_s
+      a = row[:args] || row['args'] || row
+      case type
+      when 'file_exists'
+        path = (a[:path] || a['path']).to_s
+        { type: type, passed: File.file?(path), path: path }
+      when 'file_sha256'
+        path = (a[:path] || a['path']).to_s
+        want = (a[:sha256] || a['sha256']).to_s
+        have = File.file?(path) ? Digest::SHA256.file(path).hexdigest : ''
+        { type: type, passed: !want.empty? && have == want, path: path }
+      when 'file_grep'
+        path = (a[:path] || a['path']).to_s
+        rx = (a[:pattern] || a['pattern']).to_s
+        body = File.file?(path) ? File.read(path) : ''
+        { type: type, passed: !rx.empty? && body.match?(Regexp.new(rx)), path: path }
+      when 'port_open'
+        host = (a[:host] || a['host'] || '127.0.0.1').to_s
+        port = (a[:port] || a['port']).to_i
+        ok = begin
+          TCPSocket.new(host, port).close
+          true
+        rescue StandardError
+          false
+        end
+        { type: type, passed: ok, host: host, port: port }
+      when 'http_status'
+        { type: type, passed: false, error: 'use TransparentBrowser for HTTP checks' }
+      when 'cmd_exit0'
+        cmd = (a[:command] || a['command']).to_s
+        { type: type, passed: system(cmd) == true }
+      else
+        { type: type, passed: false, error: 'unknown check type' }
+      end
+    end
+    { passed: results.all? { |r| r[:passed] }, results: results }
+  }
+)

data/lib/pwn/memory.rb

@@ -15,6 +15,7 @@ module PWN
   # via ruby code blocks during execution loops.
   module Memory
     MEMORY_FILE = File.join(Dir.home, '.pwn', 'memory.json')
+    ARCHIVE_FILE = File.join(Dir.home, '.pwn', 'memory.archive.json')
     # Lean retention — keep RL-quality signal, drop ephemeral bulk.
     VALUE_MAX_CHARS = 2_000
     PROTECT_KEY_PREFIXES = %w[operator_pref_ process_sop_ mistake_fix_ memory_].freeze
@@ -111,7 +112,10 @@ module PWN
         source: (opts[:source] || 'pwn-ai').to_s,
         confidence: opts[:confidence]&.to_f&.clamp(0.0, 1.0),
         importance: opts[:importance]&.to_f&.clamp(0.0, 1.0),
-        ttl: opts[:ttl]&.to_i
+        ttl: opts[:ttl]&.to_i,
+        namespace: (opts[:namespace] || 'default').to_s,
+        last_hit: Time.now.utc.iso8601,
+        hits: 1
       }.compact
       mem[key.to_sym] = entry
       save(mem: mem)
@@ -510,17 +514,62 @@ module PWN
     #   context = PWN::Memory.to_context(limit: 20)
     #   (used internally by pwn-ai hook to inject into system prompt)
     public_class_method def self.to_context(opts = {})
-      limit = opts[:limit] || 20
-      mem = recall(limit: limit, include_session: false)
-      return '' if mem.empty?
+      limit = (opts[:limit] || 12).to_i
+      limit = 12 if limit <= 0
+      mem = load
+      now = Time.now.utc
+      live = {}
+      expired = {}
+      mem.each do |k, v|
+        next unless v.is_a?(Hash)
+
+        ttl = v[:ttl].to_i
+        ts = begin
+          Time.parse(v[:timestamp].to_s)
+        rescue StandardError
+          now
+        end
+        if ttl.positive? && (now - ts) > ttl
+          expired[k] = v
+        else
+          live[k] = v
+        end
+      end
+      archive_expired!(rows: expired) unless expired.empty?
+      ranked = live.sort_by do |_k, v|
+        hits = v[:hits].to_i
+        hits = 1 if hits <= 0
+        rec = begin
+          Time.parse((v[:last_hit] || v[:timestamp]).to_s).to_f
+        rescue StandardError
+          0
+        end
+        -(hits * rec)
+      end.first(limit)
+      return '' if ranked.empty?
 
       ctx = "\n\nPERSISTENT MEMORY (cross-session facts, prefs, lessons - use PWN::Memory.remember to store new ones):\n"
-      mem.each do |k, v|
+      ranked.each do |k, v|
         ctx += "- #{k} [#{v[:category]} @ #{v[:timestamp]}]: #{v[:value].to_s[0, 300]}\n"
       end
       ctx
     end
 
+    private_class_method def self.archive_expired!(opts = {})
+      rows = opts[:rows]
+      return if rows.nil? || rows.empty?
+
+      arch = File.file?(ARCHIVE_FILE) ? JSON.parse(File.read(ARCHIVE_FILE), symbolize_names: true) : {}
+      arch.merge!(rows)
+      FileUtils.mkdir_p(File.dirname(ARCHIVE_FILE))
+      File.write(ARCHIVE_FILE, JSON.pretty_generate(arch))
+      mem = load
+      rows.each_key { |k| mem.delete(k) }
+      save(mem: mem, force: mem.empty?)
+    rescue StandardError
+      nil
+    end
+
     # True when a memory key must survive cap eviction / age GC.
     public_class_method def self.protected_entry?(opts = {})
       key = opts[:key].to_s
@@ -618,7 +667,8 @@ module PWN
           source: 'optional - :human | :reflect | :heuristic | :resolve | :consolidate (M3 provenance)',
           confidence: 'optional - 0.0..1.0 how sure the writer was (M3)',
           importance: 'optional - 0.0..1.0 retrieval/eviction weight (M2/M3)',
-          ttl: 'optional - seconds until stale (M3; consolidate evicts stale low-conf first)'
+          ttl: 'optional - seconds until stale (M3; consolidate evicts stale low-conf first)',
+          namespace: 'optional - memory namespace string (defaults to default)'
         )
 
         # Run recall and return its result

data/lib/pwn/plugins/aflplusplus.rb

@@ -60,6 +60,17 @@ module PWN
         }
       end
 
+      public_class_method def self.minimize(opts = {})
+        crash = opts[:crash].to_s
+        out = opts[:out].to_s
+        target = opts[:target].to_s
+        raise 'ERROR: crash, out, and target are required' if crash.empty? || out.empty? || target.empty?
+        return { error: 'afl-tmin missing', hint: 'pwn setup --profile re' } unless PWN::Plugins::PreflightChecker.bin?(name: 'afl-tmin')
+
+        stdout, stderr, status = Open3.capture3('afl-tmin', '-i', crash, '-o', out, '--', target)
+        { stdout: stdout, stderr: stderr, exit: status.exitstatus, out: out }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -91,6 +102,13 @@ module PWN
             output: 'optional - alias for out_dir'
           )
 
+          # Minimize a crash input with afl-tmin when present.
+          #{self}.minimize(
+            crash: 'required - path to a crashing input',
+            out: 'required - path to write the minimized input',
+            target: 'required - fuzz target binary'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/binary_parser.rb

@@ -91,17 +91,35 @@ module PWN
           format: inf[:format],
           arch: inf[:cpu],
           bits: inf[:cpu].to_s[/\d+/],
+          endian: inf[:endian] || inf[:ei_data],
+          stripped: inf[:stripped],
+          static: inf[:static],
+          protections: {
+            nx: inf[:nx],
+            pie: inf[:pie],
+            relro: inf[:relro],
+            canary: inf[:canary],
+            fortify: inf[:fortify]
+          },
+          sections: secs,
           imports: imps,
           exports: exps,
+          strings_top: Array(inf[:strings]).first(20),
+          entry: inf[:entry] || inf[:entrypoint],
           function_count: Array(symbols(opts)).length,
-          section_entropy_map: secs.to_h { |s| [s[:name], s[:size]] }
+          notes: []
         }
         sha = Digest::SHA256.file(path).hexdigest
-        dir = File.join(Dir.home, '.pwn', 'artifacts', 'triage')
+        dir = File.join(Dir.home, '.pwn', 'cache', 'triage')
         FileUtils.mkdir_p(dir)
-        art = File.join(dir, "#{sha[0, 16]}.json")
-        File.write(art, JSON.pretty_generate(summary.merge(path: path, sha256: sha)))
-        summary.merge(artifact: art)
+        art = File.join(dir, "#{sha}.json")
+        if File.file?(art)
+          cached = JSON.parse(File.read(art), symbolize_names: true)
+          return cached.merge(cached: true, artifact: art)
+        end
+        body = summary.merge(path: path, sha256: sha)
+        File.write(art, JSON.pretty_generate(body))
+        body.merge(artifact: art, cached: false)
       end
 
       public_class_method def self.authors

data/lib/pwn/plugins/detect_os.rb

@@ -27,16 +27,6 @@ module PWN
         'mswin' => :windows
       }.freeze
 
-      PATH_NOISE = %w[
-        sh bash zsh fish csh tcsh dash true false echo test pwd ls cat cp mv rm
-        mkdir rmdir chmod chown chgrp ln touch head tail more less grep egrep fgrep
-        sed awk sort uniq wc find xargs tar gzip gunzip zcat bzip2 xz make
-        python python2 python3 ruby perl php node java git svn hg
-        vi vim nvi nano ed ex
-        apt apt-get dpkg rpm yum dnf pacman brew port pkg pkg_add
-        sudo doas su login id whoami uname hostname env export
-      ].freeze
-
       public_class_method def self.type
         os = :cygwin if OS.cygwin?
         os = :freebsd if OS.freebsd?
@@ -193,8 +183,7 @@ module PWN
           found << name if ok
         end
         owned = pwn_installed_bins(pwn_bins: opts[:pwn_bins])
-        native = (found.map(&:to_s) - owned - PATH_NOISE).reject(&:empty?).uniq.sort
-        native = native.first(256)
+        native = (found.map(&:to_s) - owned).reject(&:empty?).uniq.sort
         cap = if opts.key?(:cap_net_raw)
                 opts[:cap_net_raw]
               else
@@ -205,8 +194,7 @@ module PWN
                  else
                    docker_live
                  end
-        sample = native.first(24).join(',')
-        summary = "#{flavor} #{ver} #{cpu} native=#{sample}"
+        summary = "#{flavor} #{ver} #{cpu}"
         {
           type: os_type,
           distro: flavor,

data/lib/pwn/plugins/exploit_db.rb

@@ -4,11 +4,19 @@ require 'json'
 require 'open3'
 require 'csv'
 require 'fileutils'
+require 'net/http'
+require 'uri'
+require 'stringio'
+require 'zlib'
+require 'rubygems/package'
 
 module PWN
   module Plugins
     # searchsploit / ExploitDB plus a CPE string builder for nmap versions.
     module ExploitDB
+      EXPLOITDB_CSV_URL = 'https://gitlab.com/exploit-database/exploitdb/-/raw/main/files_exploits.csv'
+      GTFOBINS_TAR_URL = 'https://codeload.github.com/GTFOBins/GTFOBins.github.io/tar.gz/master'
+
       public_class_method def self.required_bins
         %w[searchsploit]
       end
@@ -41,37 +49,44 @@ module PWN
         search(query: q).merge(cpe: cpe, product: product, version: version)
       end
 
-      private_class_method def self.local_hits(opts = {})
-        q = opts[:query].to_s.downcase
-        path = intel_csv
-        return [] unless File.file?(path)
-
-        CSV.read(path, headers: true).filter_map do |row|
-          blob = row.to_h.values.join(' ').downcase
-          next unless blob.include?(q) || q.split.any? { |tok| tok.length > 2 && blob.include?(tok) }
+      public_class_method def self.gtfobins(opts = {})
+        name = (opts[:binary] || opts[:query] || opts[:q]).to_s.downcase
+        raise 'ERROR: binary is required' if name.empty?
 
-          {
-            cve: row['cve'],
-            edb_id: row['id'],
-            description: row['description'],
-            local_path: row['file'],
-            cvss: row['cvss']
-          }
-        end
-      rescue StandardError
-        []
+        path = File.join(intel_dir, 'gtfobins.json')
+        data = File.file?(path) ? JSON.parse(File.read(path)) : {}
+        row = data[name] || data.values.find { |v| v.is_a?(Hash) && v['binary'].to_s.downcase == name }
+        { binary: name, hit: row, source: 'local' }
       end
 
-      private_class_method def self.intel_csv
-        dest = File.join(Dir.home, '.pwn', 'intel', 'files_exploits.csv')
-        return dest if File.file?(dest)
+      public_class_method def self.lookup(opts = {})
+        kind = (opts[:kind] || 'cve').to_s
+        q = (opts[:query] || opts[:cve] || opts[:binary] || opts[:technique]).to_s
+        return gtfobins(binary: q) if %w[binary gtfobins].include?(kind)
 
-        bundled = File.expand_path('../../../etc/intel/files_exploits.csv', __dir__)
-        if File.file?(bundled)
-          FileUtils.mkdir_p(File.dirname(dest))
-          FileUtils.cp(bundled, dest)
-        end
-        dest
+        search(query: q).merge(kind: kind)
+      end
+
+      public_class_method def self.sync(opts = {})
+        dest = opts[:dir].to_s
+        dest = intel_dir if dest.empty?
+        FileUtils.mkdir_p(dest)
+        fetched = []
+        csv_url = (opts[:csv_url] || EXPLOITDB_CSV_URL).to_s
+        bins_url = (opts[:gtfobins_url] || GTFOBINS_TAR_URL).to_s
+        return { dest: dest, dry_run: true, urls: [csv_url, bins_url], fetched: [] } if opts[:dry_run]
+
+        csv_body = http_get(url: csv_url, get: opts[:get], timeout: opts[:timeout])
+        csv_path = File.join(dest, 'files_exploits.csv')
+        File.binwrite(csv_path, csv_body)
+        fetched << 'files_exploits.csv'
+
+        bins_body = http_get(url: bins_url, get: opts[:get], timeout: opts[:timeout])
+        json_path = File.join(dest, 'gtfobins.json')
+        File.write(json_path, gtfobins_json(body: bins_body))
+        fetched << 'gtfobins.json'
+
+        { dest: dest, fetched: fetched, dry_run: false }
       end
 
       public_class_method def self.authors
@@ -96,11 +111,124 @@ module PWN
             version: 'optional - version string from nmap_it'
           )
 
+          # Look up a local GTFOBins-style primitive by binary name.
+          #{self}.gtfobins(
+            binary: 'required - host binary name (defaults to query/q)',
+            query: 'optional - alias for binary',
+            q: 'optional - alias for binary'
+          )
+
+          # Offline intel lookup by kind (cve, binary, technique).
+          #{self}.lookup(
+            kind: 'optional - cve|binary|technique (defaults to cve)',
+            query: 'optional - search text',
+            cve: 'optional - CVE id',
+            binary: 'optional - GTFOBins binary name',
+            technique: 'optional - technique keyword'
+          )
+
+          # Fetch latest ExploitDB CSV and GTFOBins into ~/.pwn/intel (not the pwn tree).
+          #{self}.sync(
+            dir: 'optional - destination directory (defaults to ~/.pwn/intel)',
+            dry_run: 'optional - true to list source URLs without writing',
+            timeout: 'optional - HTTP timeout seconds',
+            csv_url: 'optional - ExploitDB files_exploits.csv URL override',
+            gtfobins_url: 'optional - GTFOBins tarball or JSON URL override',
+            get: 'optional - proc taking a URL string and returning the response body'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "
         constants.sort
       end
+
+      private_class_method def self.local_hits(opts = {})
+        q = opts[:query].to_s.downcase
+        path = File.join(intel_dir, 'files_exploits.csv')
+        return [] unless File.file?(path)
+
+        CSV.read(path, headers: true).filter_map do |row|
+          blob = row.to_h.values.join(' ').downcase
+          next unless blob.include?(q) || q.split.any? { |tok| tok.length > 2 && blob.include?(tok) }
+
+          {
+            cve: row['cve'],
+            edb_id: row['id'],
+            description: row['description'],
+            local_path: row['file'],
+            cvss: row['cvss']
+          }
+        end
+      rescue StandardError
+        []
+      end
+
+      private_class_method def self.intel_dir(opts = {})
+        custom = opts[:dir].to_s
+        return custom unless custom.empty?
+
+        File.join(Dir.home, '.pwn', 'intel')
+      end
+
+      private_class_method def self.http_get(opts = {})
+        url = opts[:url].to_s
+        getter = opts[:get]
+        return getter.call(url) if getter.respond_to?(:call)
+
+        timeout = (opts[:timeout] || 120).to_i
+        uri = URI.parse(url)
+        http_get_uri(uri: uri, timeout: timeout, hops: 0)
+      end
+
+      private_class_method def self.http_get_uri(opts = {})
+        uri = opts[:uri]
+        timeout = opts[:timeout].to_i
+        hops = opts[:hops].to_i
+        raise 'ERROR: too many HTTP redirects' if hops > 8
+
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == 'https'
+        http.open_timeout = timeout
+        http.read_timeout = timeout
+        req = Net::HTTP::Get.new(uri.request_uri)
+        req['User-Agent'] = 'pwn-exploitdb-sync'
+        res = http.request(req)
+        case res
+        when Net::HTTPRedirection
+          nxt = URI.parse(res['location'].to_s)
+          nxt = uri + res['location'].to_s unless nxt.absolute?
+          http_get_uri(uri: nxt, timeout: timeout, hops: hops + 1)
+        else
+          raise "ERROR: fetch #{uri} failed: #{res.code}" unless res.is_a?(Net::HTTPSuccess)
+
+          res.body
+        end
+      end
+
+      private_class_method def self.gtfobins_json(opts = {})
+        body = opts[:body].to_s
+        stripped = body.lstrip
+        return body if stripped.start_with?('{', '[')
+
+        bins = {}
+        Zlib::GzipReader.wrap(StringIO.new(body)) do |gz|
+          Gem::Package::TarReader.new(gz) do |tar|
+            tar.each do |entry|
+              next unless entry.file?
+              next unless entry.full_name.include?('_gtfobins/') && entry.full_name.end_with?('.md')
+
+              name = File.basename(entry.full_name, '.md')
+              text = entry.read.to_s
+              funcs = text.scan(/^##\s+(.+)$/).flatten.map(&:strip)
+              bins[name] = { 'binary' => name, 'functions' => funcs }
+            end
+          end
+        end
+        JSON.generate(bins)
+      rescue StandardError
+        body.start_with?('{') ? body : JSON.generate({})
+      end
     end
   end
 end

data/lib/pwn/plugins/exploit_dev.rb

@@ -149,11 +149,7 @@ module PWN
 
         if PWN::Plugins::PreflightChecker.bin?(name: 'r2')
           sid = PWN::Plugins::Radare2.open(path: path)
-          begin
-            PWN::Plugins::Radare2.cmd(session: sid, cmd: '/R')
-          ensure
-            PWN::Plugins::Radare2.close(session: sid)
-          end
+          PWN::Plugins::Radare2.cmd(session: sid, cmd: '/R')
         elsif PWN::Plugins::PreflightChecker.bin?(name: 'ROPgadget')
           `ROPgadget --binary #{path}`.to_s
         else
@@ -161,6 +157,20 @@ module PWN
         end
       end
 
+      public_class_method def self.fmtstr(opts = {})
+        fmt_writes(opts)
+      end
+
+      public_class_method def self.io(opts = {})
+        kind = (opts[:kind] || opts[:mode] || 'process').to_s
+        case kind
+        when 'remote'
+          PWN::Plugins::ProcessTube.connect(host: opts[:host] || opts[:target], port: opts[:port])
+        else
+          PWN::Plugins::ProcessTube.spawn(cmd: opts[:cmd] || opts[:command])
+        end
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -266,6 +276,24 @@ module PWN
             offset: 'optional - offset value consumed by #fmt_writes'
           )
 
+          # Alias of fmt_writes for pwntools-style fmtstr helpers.
+          #{self}.fmtstr(
+            addr: 'optional - address or flag (e.g. main or 0x401000)',
+            value: 'optional - integer or string to pack/encode',
+            offset: 'optional - offset value consumed by #fmt_writes'
+          )
+
+          # Open a local process or remote TCP tube for exploit IO.
+          #{self}.io(
+            kind: 'optional - process|remote|pty_session (defaults to process)',
+            mode: 'optional - alias for kind',
+            cmd: 'optional - command for process/pty_session',
+            command: 'optional - alias for cmd',
+            host: 'optional - remote host',
+            target: 'optional - alias for host',
+            port: 'optional - remote TCP port'
+          )
+
           # Run gadgets and return its result
           #{self}.gadgets(
             path: 'required - filesystem path of the binary to search for gadgets'