pwn 0.5.721 → 0.5.723

data/lib/pwn/plugins/exploit_dev.rb

@@ -2,6 +2,7 @@
 
 require 'open3'
 require 'fileutils'
+require 'json'
 
 module PWN
   module Plugins
@@ -197,6 +198,14 @@ module PWN
         { path: out, triage: triage, gadgets: gadgets.first(8) }
       end
 
+      public_class_method def self.from_crash(opts = {})
+        path = (opts[:path] || opts[:from_crash]).to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        JSON.parse(File.read(path), symbolize_names: true)
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -344,6 +353,12 @@ module PWN
             names: 'optional - Array of symbol names (defaults to system, execve, __libc_start_main)'
           )
 
+          # Load a crash.json produced by a fuzz campaign.
+          #{self}.from_crash(
+            path: 'required - filesystem path of crash.json',
+            from_crash: 'optional - alias for path'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/findings.rb

@@ -20,22 +20,37 @@ module PWN
         raise 'ERROR: title is required' if title.empty?
 
         arts = Array(opts[:poc_artifacts]).map(&:to_s).reject(&:empty?)
-        arts << opts[:poc].to_s unless opts[:poc].to_s.empty?
+        if opts[:poc].is_a?(Hash)
+          arts << opts[:poc][:path].to_s unless opts[:poc][:path].to_s.empty?
+        else
+          arts << opts[:poc].to_s unless opts[:poc].to_s.empty?
+        end
         raise 'ERROR: poc_artifacts are required' if arts.empty?
 
-        ev = opts[:evidence].to_s
-        raise 'ERROR: evidence must be at least 40 characters citing the PoC' if ev.length < 40
+        ev = opts[:evidence]
+        ev_list = Array(ev).map(&:to_s)
+        ev_text = ev_list.join(' ')
+        raise 'ERROR: evidence must be at least 40 characters citing the PoC' if ev_text.length < 40
+
+        sha_ev = arts.filter_map do |p|
+          next unless File.file?(p)
 
+          Digest::SHA256.file(p).hexdigest
+        end
+        proven = sha_ev.any?
         row = {
           id: SecureRandom.hex(6),
           title: title,
-          severity: (opts[:severity] || 'info').to_s,
+          severity: proven ? (opts[:severity] || 'info').to_s : 'unproven',
+          cvss_vector: (opts[:cvss_vector] || opts[:cvss]).to_s,
+          affected_asset: (opts[:affected_asset] || opts[:host]).to_s,
           host: opts[:host].to_s,
-          evidence: opts[:evidence].to_s,
-          poc: opts[:poc].to_s,
+          evidence: sha_ev.any? ? sha_ev : ev_list,
+          poc: opts[:poc].is_a?(Hash) ? opts[:poc] : { type: 'file', path: arts.first, reproduction_steps: opts[:reproduction_steps].to_s },
           poc_artifacts: arts,
+          chain_refs: Array(opts[:chain_refs] || opts[:chain_parent_id]).map(&:to_s).reject(&:empty?),
           cvss: opts[:cvss].to_s,
-          status: (opts[:status] || 'open').to_s,
+          status: proven ? (opts[:status] || 'open').to_s : 'unproven',
           engagement_id: opts[:engagement_id].to_s,
           chain_parent_id: opts[:chain_parent_id].to_s,
           session_id: opts[:session_id].to_s,
@@ -98,6 +113,21 @@ module PWN
         child.merge(composite_severity: sev)
       end
 
+      public_class_method def self.chain_score(opts = {})
+        ids = Array(opts[:ids] || opts[:chain_refs]).map(&:to_s)
+        rows = report.select { |r| ids.include?(r[:id].to_s) || ids.include?(r[:chain_parent_id].to_s) }
+        rows = report if rows.empty? && ids.empty?
+        ranks = { 'info' => 0, 'low' => 1, 'medium' => 2, 'high' => 3, 'critical' => 4, 'unproven' => 0 }
+        peak = rows.map { |r| ranks[r[:severity].to_s] || 0 }.max || 0
+        linked = rows.length >= 2
+        sev = if linked && peak >= 2
+                'critical'
+              else
+                %w[info low medium high critical][peak] || 'info'
+              end
+        { chain_refs: rows.map { |r| r[:id] }, score: sev, combined_severity: sev, n: rows.length }
+      end
+
       public_class_method def self.render(opts = {})
         dir = opts[:dir_path].to_s
         dir = File.join(Dir.home, '.pwn', 'exports') if dir.empty?
@@ -148,9 +178,13 @@ module PWN
             severity: 'optional - info|low|medium|high|critical (defaults to info)',
             host: 'optional - affected host or URL',
             evidence: 'optional - proof text or path',
-            poc: 'optional - filesystem path of a PoC',
+            poc: 'optional - filesystem path of a PoC or Hash with type/path/reproduction_steps',
             poc_artifacts: 'required - Array of artifact paths proving the issue',
             cvss: 'optional - CVSS vector or score string',
+            cvss_vector: 'optional - CVSS 3.1 vector string (defaults to cvss)',
+            affected_asset: 'optional - host or URL the finding applies to (defaults to host)',
+            reproduction_steps: 'optional - how to replay the PoC',
+            chain_refs: 'optional - Array of related finding ids',
             status: 'optional - open|closed (defaults to open)',
             engagement_id: 'optional - engagement identifier',
             session_id: 'optional - pwn-ai session id',
@@ -189,6 +223,12 @@ module PWN
             name: 'optional - alias for engagement_id'
           )
 
+          # Recompute combined severity for chained findings.
+          #{self}.chain_score(
+            ids: 'optional - Array of finding ids to score together',
+            chain_refs: 'optional - alias for ids'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/gdb.rb

@@ -90,6 +90,18 @@ module PWN
         crash_info(opts.merge(commands: script))
       end
 
+      public_class_method def self.ptrace_preflight(opts = {})
+        _target = opts[:target]
+        scope = 0
+        path = '/proc/sys/kernel/yama/ptrace_scope'
+        scope = File.read(path).to_i if File.file?(path)
+        {
+          ptrace_scope: scope,
+          attach_ok: scope.zero?,
+          hint: scope.positive? ? 'spawn instead of attach' : 'ok'
+        }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -147,6 +159,11 @@ module PWN
             script: 'optional - Array of gdb/MI commands'
           )
 
+          # Probe yama ptrace_scope before gdb/frida attach.
+          #{self}.ptrace_preflight(
+            target: 'optional - pid or binary path being attached'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/gdbmi.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require 'open3'
+
+module PWN
+  module Plugins
+    # GDB machine-interface bridge: breakpoints, stepping, registers,
+    # memory, backtraces, checksec. Pairs with ProcessTube for interactive
+    # sessions.
+    module GDBMI
+      public_class_method def self.required_bins
+        %w[gdb]
+      end
+
+      public_class_method def self.open(opts = {})
+        binary = opts[:binary].to_s
+        PWN::Plugins::ProcessTube.spawn(cmd: ['gdb', '--interpreter=mi2', '--quiet', binary].reject(&:empty?))
+      end
+
+      public_class_method def self.break(opts = {})
+        loc = (opts[:location] || opts[:addr] || opts[:symbol]).to_s
+        raise 'ERROR: location is required' if loc.empty?
+
+        mi(opts.merge(cmd: "-break-insert #{loc}"))
+      end
+
+      public_class_method def self.step(opts = {})
+        mi(opts.merge(cmd: (opts[:into] ? '-exec-step' : '-exec-next')))
+      end
+
+      public_class_method def self.registers(opts = {})
+        mi(opts.merge(cmd: '-data-list-register-values x'))
+      end
+
+      public_class_method def self.read_memory(opts = {})
+        addr = (opts[:addr] || opts[:address]).to_s
+        raise 'ERROR: addr is required' if addr.empty?
+
+        n = (opts[:length] || 64).to_i
+        mi(opts.merge(cmd: "-data-read-memory-bytes #{addr} #{n}"))
+      end
+
+      public_class_method def self.backtrace(opts = {})
+        mi(opts.merge(cmd: '-stack-list-frames'))
+      end
+
+      public_class_method def self.checksec(opts = {})
+        PWN::Plugins::GDB.mitigations(opts)
+      end
+
+      public_class_method def self.mi(opts = {})
+        cmd = opts[:cmd].to_s
+        raise 'ERROR: cmd is required' if cmd.empty?
+
+        if opts[:id]
+          PWN::Plugins::ProcessTube.write_line(id: opts[:id], line: cmd)
+          PWN::Plugins::ProcessTube.recvuntil(id: opts[:id], until: "\n", timeout: opts[:timeout] || 5)
+        else
+          PWN::Plugins::GDB.batch(opts.merge(commands: [cmd.sub(/\A-/, '')]))
+        end
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Open gdb --interpreter=mi2 via ProcessTube.
+          #{self}.open(
+            binary: 'optional - filesystem path of the binary to debug'
+          )
+
+          # Insert a breakpoint (MI -break-insert).
+          #{self}.break(
+            location: 'required - symbol or address',
+            addr: 'optional - alias for location',
+            symbol: 'optional - alias for location',
+            id: 'optional - ProcessTube id from #open'
+          )
+
+          # Step (into when into: true, otherwise next).
+          #{self}.step(
+            into: 'optional - true to step into (defaults to next)',
+            id: 'optional - ProcessTube id from #open'
+          )
+
+          # Read registers via MI.
+          #{self}.registers(
+            id: 'optional - ProcessTube id from #open'
+          )
+
+          # Read memory bytes at addr.
+          #{self}.read_memory(
+            addr: 'required - address to read',
+            address: 'optional - alias for addr',
+            length: 'optional - byte count (defaults to 64)',
+            id: 'optional - ProcessTube id from #open'
+          )
+
+          # Backtrace via MI -stack-list-frames.
+          #{self}.backtrace(
+            id: 'optional - ProcessTube id from #open'
+          )
+
+          # checksec / mitigations via GDB.mitigations.
+          #{self}.checksec(
+            binary: 'optional - filesystem path of the binary'
+          )
+
+          # Send a raw MI command.
+          #{self}.mi(
+            cmd: 'required - MI command string',
+            id: 'optional - ProcessTube id from #open',
+            timeout: 'optional - seconds to wait for a reply'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/ghidra_headless.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'digest'
+require 'open3'
+require 'tmpdir'
+
+module PWN
+  module Plugins
+    # analyzeHeadless wrapper that exports decompiled C plus the symbol
+    # table as JSON, cached by binary SHA-256.
+    module GhidraHeadless
+      public_class_method def self.required_bins
+        %w[analyzeHeadless]
+      end
+
+      public_class_method def self.analyze(opts = {})
+        path = (opts[:bin] || opts[:path]).to_s
+        raise 'ERROR: bin is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        sha = Digest::SHA256.file(path).hexdigest
+        cache = File.join(Dir.home, '.pwn', 'cache', 'ghidra_headless', "#{sha}.json")
+        return JSON.parse(File.read(cache), symbolize_names: true).merge(cached: true) if File.file?(cache)
+
+        row = if PWN::Plugins::PreflightChecker.bin?(name: 'analyzeHeadless')
+                run_headless(path: path, sha: sha, function: opts[:function])
+              else
+                PWN::Plugins::Ghidra.decompile(opts.merge(bin: path))
+              end
+        FileUtils.mkdir_p(File.dirname(cache))
+        File.write(cache, JSON.generate(row))
+        row.merge(sha256: sha, cached: false)
+      end
+
+      public_class_method def self.decompile(opts = {})
+        analyze(opts)
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Run analyzeHeadless and cache decompiled C + symbols as JSON.
+          #{self}.analyze(
+            bin: 'required - filesystem path of the binary',
+            path: 'optional - alias for bin',
+            function: 'optional - function name to decompile'
+          )
+
+          # Alias of #analyze.
+          #{self}.decompile(
+            bin: 'required - filesystem path of the binary',
+            path: 'optional - alias for bin',
+            function: 'optional - function name to decompile'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.run_headless(opts = {})
+        path = opts[:path].to_s
+        Dir.mktmpdir('pwn-ghidra') do |dir|
+          script = File.join(dir, 'export.py')
+          out = File.join(dir, 'export.json')
+          File.write(script, <<~PY)
+            # @runtime PyGhidra
+            import json, os
+            from ghidra.app.decompiler import DecompInterface
+            from ghidra.util.task import ConsoleTaskMonitor
+            decomp = DecompInterface()
+            decomp.openProgram(currentProgram)
+            mon = ConsoleTaskMonitor()
+            fns = []
+            fm = currentProgram.getFunctionManager()
+            it = fm.getFunctions(True)
+            while it.hasNext():
+                fn = it.next()
+                res = decomp.decompileFunction(fn, 30, mon)
+                c = res.getDecompiledFunction().getC() if res and res.getDecompiledFunction() else ''
+                fns.append({'name': fn.getName(), 'entry': str(fn.getEntryPoint()), 'c': c})
+            open(#{out.inspect}, 'w').write(json.dumps({'functions': fns, 'symbols': [s.getName() for s in currentProgram.getSymbolTable().getAllSymbols(True)]}))
+          PY
+          stdout, stderr, status = Open3.capture3(
+            'analyzeHeadless', dir, 'pwn', '-import', path, '-postScript', script, '-deleteProject'
+          )
+          payload = File.file?(out) ? JSON.parse(File.read(out), symbolize_names: true) : {}
+          { stdout: stdout, stderr: stderr, exit: status.exitstatus, engine: 'ghidra', decompiled: payload, sha256: opts[:sha] }
+        end
+      rescue StandardError => e
+        { error: e.message, engine: 'ghidra', sha256: opts[:sha] }
+      end
+    end
+  end
+end

data/lib/pwn/plugins/jobs.rb

@@ -40,6 +40,39 @@ module PWN
         row
       end
 
+      public_class_method def self.run(opts = {})
+        start(opts)
+      end
+
+      public_class_method def self.job_run(opts = {})
+        start(opts)
+      end
+
+      public_class_method def self.job_status(opts = {})
+        status(id: opts[:handle] || opts[:id])
+      end
+
+      public_class_method def self.job_tail(opts = {})
+        tail(id: opts[:handle] || opts[:id], lines: opts[:lines])
+      end
+
+      public_class_method def self.job_kill(opts = {})
+        stop(id: opts[:handle] || opts[:id])
+      end
+
+      public_class_method def self.watch(opts = {})
+        row = load_job(opts)
+        pattern = opts[:pattern].to_s
+        raise 'ERROR: pattern is required' if pattern.empty?
+
+        log = row[:log].to_s
+        return { id: row[:id], hits: [] } unless File.file?(log)
+
+        rx = Regexp.new(pattern)
+        hits = File.readlines(log).grep(rx).last(20)
+        { id: row[:id], hits: hits.map(&:chomp), pattern: pattern }
+      end
+
       public_class_method def self.status(opts = {})
         row = load_job(opts)
         alive = begin
@@ -144,6 +177,45 @@ module PWN
           # Run stop and return its result
           #{self}.stop
 
+          # Tail a job log for a regex (AFL new-crash lines).
+          #{self}.watch(
+            id: 'required - job id from #start',
+            pattern: 'required - regex to match in the job log'
+          )
+
+          # Alias of start that returns a job handle immediately.
+          #{self}.run(
+            command: 'required - command string to run',
+            cmd: 'optional - alias for command',
+            session_id: 'optional - pwn-ai session id',
+            max_runtime: 'optional - seconds after which a live job is killed'
+          )
+
+          # Alias of #run.
+          #{self}.job_run(
+            command: 'required - command string to run',
+            cmd: 'optional - alias for command'
+          )
+
+          # Status by handle or id.
+          #{self}.job_status(
+            handle: 'optional - job handle from #run',
+            id: 'optional - job id alias for handle'
+          )
+
+          # Tail a job log by handle.
+          #{self}.job_tail(
+            handle: 'optional - job handle from #run',
+            id: 'optional - job id alias for handle',
+            lines: 'optional - number of trailing lines'
+          )
+
+          # Kill a job by handle.
+          #{self}.job_kill(
+            handle: 'optional - job handle from #run',
+            id: 'optional - job id alias for handle'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/packet.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'packetfu'
+require 'open3'
+require 'fileutils'
 require 'packetfu/protos/arp'
 require 'packetfu/protos/eth'
 require 'packetfu/protos/hsrp'
@@ -1212,6 +1214,43 @@ module PWN
         { results: rows, degraded: true, fidelity: 'connect-scan (no raw sockets / custom IP flags)' }
       end
 
+      public_class_method def self.cap_net_raw?(opts = {})
+        _iface = opts[:iface]
+        return true if File.readable?('/dev/bpf0')
+
+        File.read('/proc/self/status').to_s.include?('CapEff:') && begin
+          line = File.readlines('/proc/self/status').find { |l| l.start_with?('CapEff:') }.to_s
+          val = line.split.last.to_s.to_i(16)
+          val.anybits?(0x2000)
+        rescue StandardError
+          false
+        end
+      end
+
+      public_class_method def self.capture(opts = {})
+        iface = (opts[:iface] || 'eth0').to_s
+        count = (opts[:count] || 8).to_i
+        out = (opts[:path] || File.join(Dir.home, '.pwn', 'artifacts', "capture-#{Time.now.to_i}.pcap")).to_s
+        FileUtils.mkdir_p(File.dirname(out))
+        if cap_net_raw?(iface: iface)
+          begin
+            return { path: out, engine: 'packetfu', degraded: false } if defined?(PacketFu)
+          rescue StandardError
+            nil
+          end
+        end
+        if PWN::Plugins::PreflightChecker.bin?(name: 'tcpdump')
+          stdout, stderr, status = Open3.capture3('tcpdump', '-i', iface, '-c', count.to_s, '-w', out)
+          return { path: out, engine: 'tcpdump', exit: status.exitstatus, stdout: stdout, stderr: stderr, degraded: true, hint: 'CAP_NET_RAW missing; used tcpdump' }
+        end
+        {
+          error: 'CAP_NET_RAW missing',
+          capability: 'CAP_NET_RAW',
+          remediation: 'setcap cap_net_raw+ep $(command -v ruby)  # or install tcpdump',
+          degraded: true
+        }
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -1450,6 +1489,18 @@ module PWN
             timeout: 'optional - connect timeout seconds (defaults to 2)'
           )
 
+          # True when this process has CAP_NET_RAW (or /dev/bpf0 on BSD).
+          #{self}.cap_net_raw?(
+            iface: 'optional - interface name reserved for callers'
+          )
+
+          # Capture packets; falls back to tcpdump when CAP_NET_RAW is missing.
+          #{self}.capture(
+            iface: 'optional - interface (defaults to eth0)',
+            count: 'optional - packet count (defaults to 8)',
+            path: 'optional - output pcap path'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/preflight_checker.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require 'json'
+require 'fileutils'
+require 'time'
+
 module PWN
   module Plugins
     # Plugin/binary/capability preflight. Plugins declare required_bins /
@@ -84,6 +88,26 @@ module PWN
         CAPABILITIES.keys.map { |k| capability_coverage(capability: k) }
       end
 
+      public_class_method def self.manifest(opts = {})
+        _refresh = opts[:refresh]
+        path = File.join(Dir.home, '.pwn', 'capabilities.json')
+        FileUtils.mkdir_p(File.dirname(path))
+        caps = {}
+        PLUGIN_DEPS.each do |mod, dep|
+          missing = Array(dep[:bins]).reject { |b| bin?(name: b) }
+          caps[mod] = { bins: dep[:bins], missing: missing, ok: missing.empty?, caps: Array(dep[:caps]) }
+        end
+        row = {
+          at: Time.now.utc.iso8601,
+          cap_net_raw: cap_net_raw?,
+          container: bin?(name: 'podman') || bin?(name: 'docker'),
+          plugins: caps,
+          coverage: capability_coverage
+        }
+        File.write(path, JSON.pretty_generate(row))
+        row.merge(path: path)
+      end
+
       TASK_BINS = {
         'proxy' => %w[burpsuite zaproxy],
         'vuln-scan' => %w[nuclei openvas],
@@ -229,6 +253,11 @@ module PWN
             limit: 'optional - limit value consumed by #host_summary'
           )
 
+          # Refresh ~/.pwn/capabilities.json with bin/CAP_* presence.
+          #{self}.manifest(
+            refresh: 'optional - unused reserved refresh flag'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/process_tube.rb

@@ -20,9 +20,9 @@ module PWN
 
         argv = cmd.is_a?(Array) ? cmd.map(&:to_s) : ['bash', '-lc', cmd.to_s]
         r, w, pid = PTY.spawn(*argv)
-        id = "tube_#{pid}"
-        @tubes[id] = { r: r, w: w, pid: pid, buf: +'', started_at: Time.now, last_io: Time.now }
-        { id: id, pid: pid }
+        name = (opts[:name] || "tube_#{pid}").to_s
+        @tubes[name] = { r: r, w: w, pid: pid, buf: +'', started_at: Time.now, last_io: Time.now, name: name, scrollback: +'' }
+        { id: name, pid: pid, name: name }
       end
 
       public_class_method def self.connect(opts = {})
@@ -41,6 +41,8 @@ module PWN
         line = opts[:line] || opts[:data] || ''
         t[:w].write("#{line}\n")
         t[:w].flush
+        t[:last_io] = Time.now
+        t[:scrollback] = (t[:scrollback].to_s + "#{line}\n")[-65_536, 65_536] || (t[:scrollback].to_s + "#{line}\n")
         line.to_s
       end
 
@@ -69,13 +71,14 @@ module PWN
 
       public_class_method def self.close(opts = {})
         t = tube!(opts)
+        dump_scrollback(tube: t, id: opts[:id] || opts[:name])
         t[:w].close
         t[:r].close
         Process.kill('TERM', t[:pid]) if t[:pid]
-        @tubes.delete(opts[:id].to_s)
+        @tubes.delete((opts[:id] || opts[:name]).to_s)
         true
       rescue StandardError
-        @tubes.delete(opts[:id].to_s)
+        @tubes.delete((opts[:id] || opts[:name]).to_s)
         false
       end
 
@@ -137,7 +140,8 @@ module PWN
           # Run spawn and return its result
           #{self}.spawn(
             cmd: 'required - command string to run (defaults to opts[:command])',
-            command: 'optional - command value consumed by #spawn'
+            command: 'optional - command value consumed by #spawn',
+            name: 'optional - persistent session name reused across tool calls'
           )
 
           # Connect a TCP tube with the same write_line/recvuntil API as spawn.
@@ -202,12 +206,25 @@ module PWN
       end
 
       private_class_method def self.tube!(opts = {})
-        id = opts[:id].to_s
+        id = (opts[:id] || opts[:name]).to_s
         t = @tubes[id]
         raise 'ERROR: id is required / unknown tube' unless t
 
         t
       end
+
+      private_class_method def self.dump_scrollback(opts = {})
+        t = opts[:tube]
+        return unless t
+
+        body = t[:scrollback].to_s + t[:buf].to_s
+        return if body.empty?
+        return unless defined?(PWN::Plugins::ArtifactRegistry)
+
+        PWN::Plugins::ArtifactRegistry.put(bytes: body, kind: 'pty-scrollback', tags: ['pty', opts[:id].to_s])
+      rescue StandardError
+        nil
+      end
     end
   end
 end