pwn 0.5.737 → 0.5.739

data/lib/pwn/engagement.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'ipaddr'
+
+module PWN
+  # Engagement scope, host state, and vault refs under ~/.pwn/engagements.
+  module Engagement
+    public_class_method def self.open(opts = {})
+      row = PWN::AI::Agent::Engagement.open(opts)
+      dir = File.join(PWN::AI::Agent::Engagement::ROOT, row[:name].to_s)
+      FileUtils.mkdir_p(File.join(dir, 'evidence'))
+      hosts = File.join(dir, 'hosts.json')
+      File.write(hosts, JSON.generate({})) unless File.file?(hosts)
+      row.merge(dir: dir, hosts: hosts)
+    end
+
+    public_class_method def self.close(opts = {})
+      PWN::AI::Agent::Engagement.close(opts)
+    end
+
+    public_class_method def self.status(opts = {})
+      PWN::AI::Agent::Engagement.status(opts).merge(hosts: hosts(opts))
+    end
+
+    public_class_method def self.in_scope?(opts = {})
+      PWN::AI::Agent::Engagement.in_scope?(opts)
+    end
+
+    public_class_method def self.warn_unless_in_scope(opts = {})
+      return { ok: true } if in_scope?(opts) || opts[:override] == true
+
+      { ok: false, warning: "out of scope: #{opts[:host] || opts[:ip] || opts[:target]}", override_required: true }
+    end
+
+    public_class_method def self.record_host(opts = {})
+      check = warn_unless_in_scope(opts)
+      return check.merge(recorded: false) unless check[:ok]
+
+      name = (opts[:engagement] || opts[:name] || PWN::AI::Agent::Engagement.current_name || 'default').to_s
+      dir = File.join(PWN::AI::Agent::Engagement::ROOT, name)
+      FileUtils.mkdir_p(dir)
+      path = File.join(dir, 'hosts.json')
+      store = File.file?(path) ? JSON.parse(File.read(path), symbolize_names: true) : {}
+      host = (opts[:host] || opts[:ip]).to_s
+      row = store[host.to_sym] || { host: host, ports: [], services: [], notes: [], creds: [] }
+      incoming = Array(opts[:ports]).map do |port|
+        port.is_a?(Hash) ? port.transform_keys(&:to_sym) : { port: port }
+      end
+      by_port = {}
+      (Array(row[:ports]) + incoming).each do |item|
+        item = item.is_a?(Hash) ? item.transform_keys(&:to_sym) : { port: item }
+        key = item[:port]
+        by_port[key] = (by_port[key] || {}).merge(item)
+      end
+      row[:ports] = by_port.values.map { |item| item.keys == [:port] ? item[:port] : item }
+      row[:services] = (Array(row[:services]) + Array(opts[:services])).uniq
+      row[:notes] = (Array(row[:notes]) + Array(opts[:notes])).uniq
+      row[:creds] = (Array(row[:creds]) + Array(opts[:creds])).uniq
+      store[host.to_sym] = row
+      File.write(path, JSON.pretty_generate(store))
+      row
+    end
+
+    public_class_method def self.hosts(opts = {})
+      name = (opts[:name] || PWN::AI::Agent::Engagement.current_name || 'default').to_s
+      path = File.join(PWN::AI::Agent::Engagement::ROOT, name, 'hosts.json')
+      return {} unless File.file?(path)
+
+      JSON.parse(File.read(path), symbolize_names: true)
+    end
+
+    public_class_method def self.merge_scan(opts = {})
+      Array(opts[:hosts] || opts[:results]).each do |row|
+        row = row.transform_keys(&:to_sym) if row.respond_to?(:transform_keys)
+        record_host(
+          host: row[:host] || row['host'],
+          ports: [{ port: row[:port] || row['port'], proto: row[:proto], service: row[:service], version: row[:version], scripts: row[:scripts] }.compact],
+          services: [row[:service] || row['service']].compact,
+          override: opts[:override],
+          engagement: opts[:engagement] || opts[:name]
+        )
+      end
+      hosts(name: opts[:engagement] || opts[:name])
+    end
+
+    public_class_method def self.authors
+      "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+    end
+
+    public_class_method def self.help
+      puts "USAGE:
+        # Open an engagement and ensure its host/evidence directories exist.
+        #{self}.open(
+          name: 'optional - engagement identifier (defaults to default)',
+          engagement: 'optional - alias for name',
+          scope_cidrs: 'optional - Array of CIDR strings',
+          scope_domains: 'optional - Array of DNS suffixes',
+          excluded: 'optional - Array of excluded hosts',
+          roe: 'optional - rules of engagement notes'
+        )
+
+        # Clear the active engagement pointer.
+        #{self}.close(
+          unused: 'optional - accepted so callers can pass a Hash'
+        )
+
+        # Return scope plus persisted host state.
+        #{self}.status(
+          name: 'optional - engagement identifier'
+        )
+
+        # True when a host or URL is inside the active scope.
+        #{self}.in_scope?(
+          host: 'optional - hostname or IP',
+          ip: 'optional - alias for host',
+          target: 'optional - alias for host',
+          url: 'optional - URL whose host is checked'
+        )
+
+        # Warn on out-of-scope targets unless override is true.
+        #{self}.warn_unless_in_scope(
+          host: 'optional - hostname or IP',
+          ip: 'optional - alias for host',
+          target: 'optional - alias for host',
+          override: 'optional - true continues despite a scope miss'
+        )
+
+        # Deep-merge ports, services, notes, and vault refs for a host.
+        #{self}.record_host(
+          host: 'required - hostname or IP',
+          ip: 'optional - alias for host',
+          ports: 'optional - Array of open ports',
+          services: 'optional - Array of service labels',
+          notes: 'optional - Array of freeform notes',
+          creds: 'optional - Array of vault references',
+          override: 'optional - true records an out-of-scope host'
+        )
+
+        # Return the host map for an engagement.
+        #{self}.hosts(
+          name: 'optional - engagement identifier'
+        )
+
+        # Merge structured scan rows into host state.
+        #{self}.merge_scan(
+          hosts: 'optional - Array of {host, port, service} hashes',
+          results: 'optional - alias for hosts',
+          override: 'optional - true records out-of-scope hosts'
+        )
+
+        # Print the AUTHOR(S) string for this module.
+        #{self}.authors
+      "
+    end
+  end
+end

data/lib/pwn/plugins/debugger.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # Structured GDB/MI driver with a handle registry that survives pwn_eval.
+    module Debugger
+      @sessions = {}
+
+      public_class_method def self.required_bins
+        %w[gdb]
+      end
+
+      public_class_method def self.launch(opts = {})
+        bin = (opts[:bin] || opts[:binary]).to_s
+        raise ArgumentError, 'bin is required' if bin.empty?
+
+        args = Array(opts[:args]).map(&:to_s)
+        argv = ['gdb', '--interpreter=mi2', '--quiet', '--nx', '--args', bin, *args]
+        tube = PWN::Plugins::ProcessTube.spawn(cmd: argv, name: opts[:handle])
+        row = store_session(handle: tube[:id], tube: tube, bin: bin)
+        drain_gdb(handle: row[:handle])
+        mi(handle: row[:handle], cmd: '-gdb-set confirm off')
+        mi(handle: row[:handle], cmd: '-gdb-set pagination off')
+        mi(handle: row[:handle], cmd: '-exec-run') if opts[:run] == true
+        row
+      end
+
+      public_class_method def self.attach(opts = {})
+        if opts[:host] || opts[:port]
+          host = (opts[:host] || '127.0.0.1').to_s
+          port = (opts[:port] || 1234).to_i
+          argv = ['gdb', '--interpreter=mi2', '--quiet', '--nx']
+          tube = PWN::Plugins::ProcessTube.spawn(cmd: argv, name: opts[:handle])
+          row = store_session(handle: tube[:id], tube: tube, gdbstub: "#{host}:#{port}")
+          drain_gdb(handle: row[:handle])
+          parse_mi(raw: mi(handle: row[:handle], cmd: "-target-select remote #{host}:#{port}"))
+          return row
+        end
+        pid = opts[:pid].to_i
+        raise ArgumentError, 'pid is required' unless pid.positive?
+
+        argv = ['gdb', '--interpreter=mi2', '--quiet', '--nx', '-p', pid.to_s]
+        tube = PWN::Plugins::ProcessTube.spawn(cmd: argv, name: opts[:handle])
+        row = store_session(handle: tube[:id], tube: tube, pid: pid)
+        drain_gdb(handle: row[:handle])
+        row
+      end
+
+      public_class_method def self.run(opts = {})
+        parse_mi(raw: mi(opts.merge(cmd: '-exec-run')))
+      end
+
+      public_class_method def self.break(opts = {})
+        loc = (opts[:addr_or_sym] || opts[:location] || opts[:addr] || opts[:symbol]).to_s
+        raise ArgumentError, 'addr_or_sym is required' if loc.empty?
+
+        parse_mi(raw: mi(opts.merge(cmd: "-break-insert #{loc}")))
+      end
+
+      public_class_method def self.continue(opts = {})
+        parse_mi(raw: mi(opts.merge(cmd: '-exec-continue')))
+      end
+
+      public_class_method def self.step(opts = {})
+        parse_mi(raw: mi(opts.merge(cmd: (opts[:into] ? '-exec-step' : '-exec-next'))))
+      end
+
+      public_class_method def self.read_mem(opts = {})
+        addr = (opts[:addr] || opts[:address]).to_s
+        raise ArgumentError, 'addr is required' if addr.empty?
+
+        parse_mi(raw: mi(opts.merge(cmd: "-data-read-memory-bytes #{addr} #{(opts[:len] || opts[:length] || 64).to_i}")))
+      end
+
+      public_class_method def self.write_mem(opts = {})
+        addr = (opts[:addr] || opts[:address]).to_s
+        data = opts[:data] || opts[:bytes]
+        raise ArgumentError, 'addr and data are required' if addr.empty? || data.nil?
+
+        hex = data.is_a?(String) ? data.unpack1('H*') : Array(data).pack('C*').unpack1('H*')
+        parse_mi(raw: mi(opts.merge(cmd: "-data-write-memory-bytes #{addr} #{hex}")))
+      end
+
+      public_class_method def self.regs(opts = {})
+        parse_mi(raw: mi(opts.merge(cmd: '-data-list-register-values x')))
+      end
+
+      public_class_method def self.backtrace(opts = {})
+        parse_mi(raw: mi(opts.merge(cmd: '-stack-list-frames')))
+      end
+
+      public_class_method def self.checksec(opts = {})
+        PWN::Plugins::GDB.mitigations(binary: opts[:bin] || opts[:binary] || session!(opts)[:bin])
+      end
+
+      public_class_method def self.cyclic(opts = {})
+        PWN::Plugins::ExploitDev.cyclic(length: opts[:length] || opts[:n] || 200)
+      end
+
+      public_class_method def self.cyclic_find(opts = {})
+        PWN::Plugins::ExploitDev.cyclic_find(value: opts[:value] || opts[:pattern], length: opts[:length] || 8_192)
+      end
+
+      public_class_method def self.to_pwntools_offsets(opts = {})
+        { cyclic: cyclic(opts), offset: cyclic_find(opts) }
+      end
+
+      public_class_method def self.close(opts = {})
+        handle = (opts[:handle] || opts[:id]).to_s
+        sess = @sessions.delete(handle)
+        PWN::Plugins::ProcessTube.close(id: handle) if sess
+        { closed: handle }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Launch a binary under gdb MI and keep the handle in-process.
+          #{self}.launch(
+            bin: 'required - filesystem path of the binary to debug',
+            binary: 'optional - alias for bin',
+            args: 'optional - Array of argv strings after the binary',
+            handle: 'optional - ProcessTube name for the session',
+            run: 'optional - true issues -exec-run after gdb starts'
+          )
+
+          # Attach gdb MI to an existing pid or gdbstub.
+          #{self}.attach(
+            pid: 'optional - integer process id to attach',
+            host: 'optional - gdbstub host for remote attach',
+            port: 'optional - gdbstub TCP port',
+            handle: 'optional - ProcessTube name for the session'
+          )
+
+          # Run the inferior (-exec-run).
+          #{self}.run(
+            handle: 'required - session handle from launch or attach'
+          )
+
+          # Insert a breakpoint at a symbol or address.
+          #{self}.break(
+            handle: 'required - session handle from launch or attach',
+            addr_or_sym: 'required - symbol or address',
+            location: 'optional - alias for addr_or_sym',
+            addr: 'optional - alias for addr_or_sym',
+            symbol: 'optional - alias for addr_or_sym'
+          )
+
+          # Continue execution until the next stop.
+          #{self}.continue(
+            handle: 'required - session handle from launch or attach'
+          )
+
+          # Step one instruction or source line.
+          #{self}.step(
+            handle: 'required - session handle from launch or attach',
+            into: 'optional - true to step into rather than next'
+          )
+
+          # Read memory bytes at an address.
+          #{self}.read_mem(
+            handle: 'required - session handle from launch or attach',
+            addr: 'required - address to read',
+            address: 'optional - alias for addr',
+            len: 'optional - byte count (defaults to 64)',
+            length: 'optional - alias for len'
+          )
+
+          # Write raw bytes to inferior memory.
+          #{self}.write_mem(
+            handle: 'required - session handle from launch or attach',
+            addr: 'required - address to write',
+            address: 'optional - alias for addr',
+            data: 'required - String or byte Array to write',
+            bytes: 'optional - alias for data'
+          )
+
+          # Return register values as a parsed MI hash.
+          #{self}.regs(
+            handle: 'required - session handle from launch or attach'
+          )
+
+          # Return a parsed backtrace hash.
+          #{self}.backtrace(
+            handle: 'required - session handle from launch or attach'
+          )
+
+          # Return binary mitigations via GDB.mitigations.
+          #{self}.checksec(
+            handle: 'optional - session handle whose binary should be probed',
+            bin: 'optional - filesystem path of the binary',
+            binary: 'optional - alias for bin'
+          )
+
+          # Generate a cyclic de Bruijn pattern.
+          #{self}.cyclic(
+            length: 'optional - pattern length in bytes',
+            n: 'optional - alias for length'
+          )
+
+          # Find the offset of a packed register value in a cyclic pattern.
+          #{self}.cyclic_find(
+            value: 'required - leaked register value or substring',
+            pattern: 'optional - alias for value',
+            length: 'optional - haystack length (defaults to 8192)'
+          )
+
+          # Return both a cyclic pattern and the recovered offset.
+          #{self}.to_pwntools_offsets(
+            value: 'optional - leaked register value for cyclic_find',
+            length: 'optional - pattern length in bytes',
+            n: 'optional - alias for length'
+          )
+
+          # Close a debugger session handle.
+          #{self}.close(
+            handle: 'required - session handle from launch or attach',
+            id: 'optional - alias for handle'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.store_session(opts = {})
+        handle = opts[:handle].to_s
+        @sessions[handle] = { tube: opts[:tube], bin: opts[:bin], pid: opts[:pid] }
+        { handle: handle, pid: opts[:tube][:pid], bin: opts[:bin] }
+      end
+
+      private_class_method def self.session!(opts = {})
+        handle = (opts[:handle] || opts[:id]).to_s
+        sess = @sessions[handle]
+        raise ArgumentError, "unknown debugger handle #{handle}" unless sess
+
+        sess.merge(handle: handle)
+      end
+
+      private_class_method def self.drain_gdb(opts = {})
+        PWN::Plugins::ProcessTube.expect(id: opts[:handle], pattern: /\(gdb\)/, timeout: opts[:timeout] || 8)
+      rescue StandardError
+        nil
+      end
+
+      private_class_method def self.mi(opts = {})
+        sess = session!(opts)
+        PWN::Plugins::ProcessTube.write_line(id: sess[:handle], line: opts[:cmd].to_s)
+        row = PWN::Plugins::ProcessTube.expect(
+          id: sess[:handle],
+          pattern: /^\^done|^\^error|^\^running|^\*stopped/m,
+          timeout: opts[:timeout] || 8
+        )
+        row.is_a?(Hash) ? row[:matched].to_s : row.to_s
+      end
+
+      private_class_method def self.parse_mi(opts = {})
+        raw = opts[:raw].to_s
+        ok = raw.match?(/\^(?:done|running)|^\*stopped/m)
+        regs = {}
+        raw.scan(/name="([^"]+)",value="([^"]+)"/) { |name, val| regs[name] = val }
+        raw.scan(/number="(\d+)",value="([^"]+)"/) { |num, val| regs[num] ||= val }
+        mem = {}
+        if (m = raw.match(/memory=\[\{[^}]*begin="([^"]+)"[^}]*contents="([^"]+)"/))
+          mem = { addr: m[1], hex: m[2] }
+        end
+        bkpt = {}
+        if (m = raw.match(/bkpt=\{([^}]+)\}/))
+          m[1].scan(/(\w+)="([^"]+)"/) { |k, v| bkpt[k.to_sym] = v }
+        end
+        { ok: ok, raw: raw, records: raw.lines.map(&:chomp), registers: regs, memory: mem, bkpt: bkpt }
+      end
+    end
+  end
+end

data/lib/pwn/plugins/findings.rb

@@ -19,6 +19,10 @@ module PWN
       # Strict P10 boundary. Legacy record remains available for older callers.
       public_class_method def self.record_structured(opts = {})
         opts = opts.transform_keys(&:to_sym)
+        opts[:affected_asset] ||= opts[:target]
+        opts[:poc] ||= opts[:repro_cmd]
+        opts[:target] ||= opts[:affected_asset]
+        opts[:repro_cmd] ||= opts[:poc]
         %i[title cwe cvss_vector affected_asset poc remediation].each do |key|
           raise ArgumentError, "#{key} must be a non-empty string" unless opts[key].is_a?(String) && !opts[key].strip.empty?
         end
@@ -53,7 +57,8 @@ module PWN
         row = opts.slice(:title, :cwe, :cvss_vector, :cvss_score, :affected_asset, :evidence_paths, :poc,
                          :attack_chain_refs, :remediation, :confidence, :engagement_id, :session_id)
         row = row.merge(id: SecureRandom.hex(6), severity: severity, status: 'open', verification_status: 'not_executed',
-                        chain_refs: refs, host: opts[:affected_asset], evidence: paths.map { |path| Digest::SHA256.file(path).hexdigest },
+                        chain_refs: refs, host: opts[:affected_asset], target: opts[:affected_asset],
+                        repro_cmd: opts[:poc], evidence: paths.map { |path| Digest::SHA256.file(path).hexdigest },
                         poc_artifacts: [], at: Time.now.utc.iso8601)
         FileUtils.mkdir_p(File.dirname(FILE))
         File.open(FILE, 'a') do |file|
@@ -378,7 +383,11 @@ module PWN
             sha256: Digest::SHA256.file(art).hexdigest,
             size: File.size(art)
           }
-          File.open(path, 'a') { |f| f.puts(JSON.generate(rec)) }
+          dest = File.join(dir, 'evidence', rec[:sha256])
+          FileUtils.mkdir_p(File.dirname(dest))
+          FileUtils.cp(art, dest) unless File.file?(dest)
+          rec[:stored] = dest
+          File.open(path, 'a') { |file| file.puts(JSON.generate(rec)) }
         end
       end
 
@@ -404,7 +413,9 @@ module PWN
             remediation: 'required - remediation instructions',
             confidence: 'required - numeric 0..1',
             engagement_id: 'optional - simple engagement identifier',
-            session_id: 'optional - session identifier'
+            session_id: 'optional - session identifier',
+            target: 'optional - alias for affected_asset',
+            repro_cmd: 'optional - alias for poc'
           )
 
           # Append a legacy finding row to ~/.pwn/findings.jsonl.

data/lib/pwn/plugins/fuzz.rb

@@ -190,6 +190,61 @@ module PWN
         dict.map { |blob| seed + blob.to_s }
       end
 
+      public_class_method def self.triage(opts = {})
+        require 'digest'
+        crashes = Array(opts[:crashes])
+        crashes = Dir.glob(File.join(opts[:dir].to_s, '*')) if crashes.empty?
+        files = crashes.select { |path| File.file?(path) }
+        groups = files.group_by { |path| crash_hash(path: path) }
+        groups.map do |hash, group|
+          mini = minimize_group(files: group, target: opts[:target])
+          body = File.binread(mini).to_s
+          score = exploitability(text: body, path: mini)
+          row = {
+            hash: hash,
+            count: group.length,
+            minimized: mini,
+            exploitability: score,
+            files: group
+          }
+          if opts[:record] == true && defined?(PWN::Plugins::Findings)
+            PWN::Plugins::Findings.record(
+              title: "fuzz crash #{hash}",
+              severity: score.include?('pc_control') ? 'high' : 'medium',
+              host: opts[:target].to_s,
+              evidence: mini,
+              poc: mini
+            )
+          end
+          row
+        end
+      end
+
+      private_class_method def self.crash_hash(opts = {})
+        body = File.binread(opts[:path]).to_s
+        if (m = body.match(/AddressSanitizer[^\n]*\n(?:.*\n){0,12}/))
+          Digest::SHA256.hexdigest(m[0])[0, 16]
+        elsif (m = body.scan(/#\d+\s+0x[0-9a-f]+.+/).first(6)).any?
+          Digest::SHA256.hexdigest(m.join)[0, 16]
+        else
+          Digest::SHA256.hexdigest(body)[0, 16]
+        end
+      end
+
+      private_class_method def self.minimize_group(opts = {})
+        files = Array(opts[:files])
+        files.min_by { |path| File.size(path) }
+      end
+
+      private_class_method def self.exploitability(opts = {})
+        text = opts[:text].to_s
+        return 'pc_control_candidate' if text.match?(/pc\s+0x|rip\s+0x|eip\s+0x|SEGV on unknown address 0x/i)
+        return 'writable_address_control' if text.match?(/WRITE of size|heap-buffer-overflow|stack-buffer-overflow/i)
+        return 'pc_control_candidate' if File.size(opts[:path].to_s).to_i >= 8
+
+        'unknown'
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -232,6 +287,13 @@ module PWN
             dictionary: 'optional - Array of binary/string mutations'
           )
 
+          # Dedup crash files by content hash and pick the smallest reproducer.
+          #{self}.triage(
+            crashes: 'optional - Array of crash file paths',
+            dir: 'optional - directory globbed when crashes is empty',
+            record: 'optional - true records unique crashes via Findings.record'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "