pwn 0.5.745 → 0.5.748

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3d60fd604a668b531459517b97dfee6448f9485679bd4c25bfe3ec12090cee9
-  data.tar.gz: 64a4dd65248017933e877c03db222ce61741e60044a03a1c9c9a1297ca7a4fde
+  metadata.gz: 02f94f46fc7627fd28e1b815d61a9ff8988739c4394054e21fd7001e0cbedb1b
+  data.tar.gz: ee53f4520e4d847623db8918e3ece5c182939d17a0e8ba9984be8d98ed21237e
 SHA512:
-  metadata.gz: 1792ff5aea6a7c406248ab0fd6647732c490e56450afdf768840f340b4d7b4847a2d2cd996ff1349b3ca1a1bbfc05be40310225345e675937cc16022aaad5ec3
-  data.tar.gz: 7155e5d3cfca02bda195d0b0f926b85d6cd95b306b570d5956484ae237d360b36628a979e2d98a2c5ce3008343c7cecc1d14f12d0a986dbc577923a9f7905930
+  metadata.gz: 6c0ee2ce5915bebaea32f40413080d0c36ed34547911deee16f7dab729f238c0fc5e7352152c5764618925a882c7046bd5b1bb5f2ae35bb23d4be3ce847498f5
+  data.tar.gz: 032bb3d28b79afd00223158af6b2747d16fb7101b6a852dbe356ccf961d813906c44b1d0efb2972020c82f48a8518b3317f804a955a5a4f6682b153377b1161c

data/Gemfile

@@ -50,7 +50,7 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.6.0'
-gem 'meshtastic', '0.0.184'
+gem 'meshtastic', '0.0.186'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'
@@ -77,7 +77,7 @@ gem 'rbvmomi2', '3.10.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.1.4'
+gem 'rmagick', '7.1.5'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'

data/lib/pwn/ai/agent/tools/exploitdev.rb

@@ -22,6 +22,7 @@ PWN::AI::Agent::Registry.register(
         arch: { type: 'string' },
         offset: { type: 'integer' },
         extra: { type: 'string' },
+        pad: { type: 'integer' },
         cmd: { type: 'string' },
         host: { type: 'string' },
         port: { type: 'integer' },
@@ -55,7 +56,7 @@ PWN::AI::Agent::Registry.register(
     when 'io'
       PWN::Plugins::ExploitDev.io(kind: args[:kind] || 'process', cmd: args[:cmd] || args[:path], host: args[:host], port: args[:port])
     when 'ret2libc'
-      PWN::Plugins::ExploitDev.ret2libc(path: args[:path], offset: args[:offset], extra: args[:extra])
+      PWN::Plugins::ExploitDev.ret2libc(path: args[:path], offset: args[:offset], extra: args[:extra], pad: args[:pad])
     when 'checksec'
       PWN::Plugins::GDB.mitigations(binary: args[:path])
     else

data/lib/pwn/plugins/exploit_dev.rb

@@ -231,7 +231,9 @@ module PWN
         offset = (opts[:offset] || 72).to_i
         raise 'ERROR: missing pop rdi, system, or argument address' unless pop && system && arg
 
-        align = opts[:ret] || Array(gadgets[:gadgets]).find { |row| row[:gadget].to_s == 'ret' }&.fetch(:address, nil)
+        align = opts[:ret]
+        align ||= pop + 1 if pop && Array(gadgets[:gadgets]).any? { |row| row[:address] == pop && row[:gadget].to_s.match?(/pop rdi; ret/i) }
+        align ||= Array(gadgets[:gadgets]).find { |row| row[:gadget].to_s == 'ret' && row[:address] != pop }&.fetch(:address, nil)
         packed = [pop, arg]
         packed << align if align && align != pop
         packed << system

data/lib/pwn/plugins/process_tube.rb

@@ -100,6 +100,8 @@ module PWN
           rescue IO::WaitReadable
             t[:r].wait_readable(0.2)
             retry
+          rescue EOFError
+            return consume_buf(tube: t, bytes: t[:buf].bytesize)
           end
         end
       end

data/lib/pwn/plugins/repl/mesh.rb

@@ -149,11 +149,14 @@ module PWN
           end
         end
         PWN_MESH_TRANSPORTS = %i[serial bluetooth tcp mqtt].freeze
-        # meshtastic 0.0.184 loses protobuf defaults in Data#to_h. Empty
-        # decoded data is not an unsupported application payload.
+        # meshtastic 0.0.184 Data#to_h omits empty payload bytes, and an
+        # unknown PortNum stays an integer (51 is not in the enum). That is
+        # not an undecodable application payload. Bytes on an unsupported
+        # port still warn.
         EMPTY_DATA_DECODER = Module.new do
           define_method(:decode_payload) do |opts = {}|
-            return nil if opts[:payload].nil? && opts[:msg_type].nil?
+            payload = opts[:payload]
+            return nil if payload.nil? || payload == ''
 
             super(opts)
           end
@@ -1140,6 +1143,9 @@ module PWN
             text = opts[:text].to_s.dup.force_encoding(Encoding::UTF_8).scrub
             text.gsub!(/\e\[[0-9;?]*[A-Za-z]/, '')
             text.gsub!(/[\x00-\x08\x0b\x0c\x0e-\x1f]/, '')
+            # Serial.subscribe prints this on startup. It is not a diagnostic,
+            # and capturing it opens a NOTICE before the TUI can be used.
+            text.gsub!('Subscribing to serial FromRadio stream...', '')
             text.strip!
             text.empty? ? nil : text
           end

data/lib/pwn/plugins/sbom.rb

@@ -81,21 +81,16 @@ module PWN
 
       private_class_method def self.run!(opts = {})
         argv = opts[:argv]
-        if Open3.respond_to?(:capture3)
-          out, err, st = Open3.capture3(*argv)
-          raise IOError, "#{argv.first} failed: #{err}" unless st.success? || opts[:allow_nonzero] == true
+        out, st = Open3.capture2(*argv)
+        raise IOError, "#{argv.first} failed" unless st.success? || opts[:allow_nonzero] == true
 
-        else
-          out, = Open3.capture2(*argv)
-        end
-        out
-      rescue Errno::ENOENT
-        out, = Open3.capture2(*opts[:argv])
         out
       end
 
       private_class_method def self.parse_grype(opts = {})
         out = run!(argv: ['grype', '-o', 'json', opts[:target]], allow_nonzero: true)
+        raise IOError, 'grype returned no JSON' if out.to_s.strip.empty?
+
         json = JSON.parse(out)
         Array(json['matches']).map do |row|
           art = row['artifact'] || {}

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.745'
+  VERSION = '0.5.748'
 end

data/spec/lib/pwn/ai/agent/tools/exploitdev_spec.rb

@@ -27,25 +27,35 @@ describe 'PWN::AI::Agent::Tools exploitdev' do
         void keep(void) { __asm__ volatile("pop %rdi; ret"); }
         int main(int argc, char **argv) {
           char buf[64];
+          void *frame = __builtin_frame_address(0);
           (void)argv;
           if (argc > 100) { system(cmd); keep(); }
+          char line[32];
+          snprintf(line, sizeof(line), "%ld", (long)((char *)frame + sizeof(void *) - buf));
+          puts(line);
+          fflush(stdout);
           read(0, buf, 256);
           return 0;
         }
       C
-      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-no-pie', '-o', bin, src)
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src)
       expect(status.success?).to eq(true), out
+      elf = File.binread(bin)
+      expect(elf[16, 2].unpack1('v')).to eq(2), 'cc produced a PIE binary; file addresses would not be the runtime addresses'
+      io = PWN::Plugins::ExploitDev.io(cmd: [bin], pty: false)
+      offset = PWN::Plugins::ProcessTube.recvuntil(id: io[:id], until: "\n", timeout: 3).to_i
+      expect(offset).to be > 64
       raw = PWN::AI::Agent::Dispatch.call(
-        tool_call: { function: { name: 'exploitdev', arguments: JSON.generate(action: 'ret2libc', path: bin, offset: 72, extra: 'cmd') } },
+        tool_call: { function: { name: 'exploitdev', arguments: JSON.generate(action: 'ret2libc', path: bin, offset: offset, extra: 'cmd') } },
         scope_path: File.join(dir, 'absent.yaml')
       )
       row = JSON.parse(raw, symbolize_names: true).fetch(:result)
+      row = JSON.parse(File.binread(row[:artifact][:path]), symbolize_names: true) if row[:artifact]
       expect(row[:payload]).not_to be_empty
       expect(row[:plt].keys.map(&:to_s)).to include('system')
       expect(row[:pop_rdi]).to be_a(Integer)
       packed = [row[:payload_hex] || row['payload_hex']].pack('H*')
       packed = row[:payload].to_s if packed.empty?
-      io = PWN::Plugins::ExploitDev.io(cmd: [bin], pty: false)
       PWN::Plugins::ProcessTube.send_raw(id: io[:id], bytes: packed)
       out = PWN::Plugins::ProcessTube.recvuntil(id: io[:id], until: 'RET2LIBC_OK', timeout: 3)
       expect(out.to_s).to include('RET2LIBC_OK')

data/spec/lib/pwn/plugins/jobs_spec.rb

@@ -32,12 +32,14 @@ describe PWN::Plugins::Jobs do
   end
 
   it 'survives an exited creator and records completion in a fresh session' do
-    row = fresh("puts JSON.generate(PWN::Plugins::Jobs.start(command: 'sleep 2; printf durable', max_runtime: 21600, session_id: 'old'))")
+    gate = File.join(@root, 'release')
+    row = fresh("puts JSON.generate(PWN::Plugins::Jobs.start(command: 'while [ ! -f #{gate} ]; do sleep 0.05; done; printf durable', max_runtime: 21600, session_id: 'old'))")
     expect(row[:status]).to eq('RUNNING')
     expect(row[:worker_pid]).to be_a(Integer)
     expect(row[:worker_identity]).not_to be_nil
     worker_session = Process.getsid(row[:worker_pid])
     expect(fresh("puts JSON.generate(PWN::Plugins::Jobs.status(id: '#{row[:id]}'))")[:status]).to eq('RUNNING')
+    File.write(gate, '1')
     done = finished(row[:id])
     expect(worker_session).to eq(row[:worker_pid])
     expect(done).to include(status: 'COMPLETED', exit_code: 0, max_runtime: 21_600, session_id: 'old')

data/spec/lib/pwn/plugins/repl_mesh_history_spec.rb

@@ -18,8 +18,26 @@ describe PWN::Plugins::REPL, 'mesh compose history' do
     described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |message| received << message })
     expect(received.size).to eq(2)
     expect(output.string).not_to include("Can't decode")
-    Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
-    expect(output.string).to include("Can't decode", 'unsupported')
+    # meshtastic 0.0.186 returns unknown application bytes instead of warning.
+    decoded = Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
+    expect(decoded).to eq('unsupported')
+    expect(output.string).not_to include("Can't decode")
+  ensure
+    $stdout = old
+  end
+
+  it 'does not warn when a packet has an unknown portnum and no payload' do
+    stub_const('PWN::MeshTransport', :serial)
+    queue = Queue.new
+    encoded = Meshtastic::FromRadio.new(packet: { decoded: Meshtastic::Data.new(portnum: 51) }).to_proto
+    queue << Meshtastic::FromRadio.decode(encoded)
+    queue.close
+    output = StringIO.new
+    old = $stdout
+    $stdout = output
+    described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |_message| })
+    expect(output.string).not_to include("Can't decode")
+    expect(output.string).not_to include('portnum: 51')
   ensure
     $stdout = old
   end
@@ -69,6 +87,25 @@ describe PWN::Plugins::REPL, 'mesh compose history' do
     expect(events).to be_empty
   end
 
+  it 'does not open a notice for the serial subscribe banner' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    described_class.send(:mesh_capture_output, run: proc {
+      puts 'Subscribing to serial FromRadio stream...'
+    })
+    expect(events).to be_empty
+  end
+
+  it 'keeps a warning that shares a chunk with the serial subscribe banner' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    described_class.send(:mesh_capture_output, run: proc {
+      $stdout.write("Subscribing to serial FromRadio stream...\nWARNING: decoder fixture\n")
+    })
+    expect(events.pop(true)[:notice]).to eq('WARNING: decoder fixture')
+    expect(events).to be_empty
+  end
+
   it 'captures dependency stdout and stderr and restores both streams on failure' do
     events = Queue.new
     stub_const('PWN::MeshEvents', events)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.745
+  version: 0.5.748
 platform: ruby
 authors:
 - 0day Inc.
@@ -519,14 +519,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.184
+        version: 0.0.186
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.184
+        version: 0.0.186
 - !ruby/object:Gem::Dependency
   name: metasm
   requirement: !ruby/object:Gem::Requirement
@@ -897,14 +897,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.4
+        version: 7.1.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.4
+        version: 7.1.5
 - !ruby/object:Gem::Dependency
   name: rqrcode
   requirement: !ruby/object:Gem::Requirement