pwn 0.5.748 → 0.5.749

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02f94f46fc7627fd28e1b815d61a9ff8988739c4394054e21fd7001e0cbedb1b
-  data.tar.gz: ee53f4520e4d847623db8918e3ece5c182939d17a0e8ba9984be8d98ed21237e
+  metadata.gz: bf86add502082e14d3299544ffc90b9e86887ada46569fa867d9ce6e0cc8560a
+  data.tar.gz: bb266bdff59a1187f99664eb876dc6b591a43d4f725689025e8af2325b735c00
 SHA512:
-  metadata.gz: 6c0ee2ce5915bebaea32f40413080d0c36ed34547911deee16f7dab729f238c0fc5e7352152c5764618925a882c7046bd5b1bb5f2ae35bb23d4be3ce847498f5
-  data.tar.gz: 032bb3d28b79afd00223158af6b2747d16fb7101b6a852dbe356ccf961d813906c44b1d0efb2972020c82f48a8518b3317f804a955a5a4f6682b153377b1161c
+  metadata.gz: b5191f1ecd9004cd4152ead0630c3c91df671ecb6f1f7b1c801a8a9983b6d919734b4006dca79740b9dc5be7181880ac5cddd219d343478a4c5cb66c86bad741
+  data.tar.gz: 8ef2550a781242412f81402b29fa5257fcf404fe5a97facd8126544aabe651cd4e26d008cf92bb040b8d675985943a06cac1800a88eb85b2b3c35bb3f79c4692

data/Gemfile

@@ -11,7 +11,7 @@ gemspec
 # In some circumstances custom flags are passed to gems in order
 # to build appropriately.  Defer to ./reinstall_pwn_gemset.sh
 # to review these custom flags (e.g. pg, serialport, etc).
-gem 'activesupport', '<8.1.3.1'
+gem 'activesupport', '<8.1.4'
 gem 'anemone', '0.7.2'
 gem 'authy', '3.0.1'
 gem 'aws-sdk', '3.3.0'

data/etc/default_skills/pwn/ffi/capstone/SKILL.md

@@ -42,6 +42,7 @@ PWN::FFI::Capstone.available(opts)
 - `cs_disasm`
 - `cs_free`
 - `cs_open`
+- `cs_version`
 - `load_error`
 
 ## Source

data/lib/pwn/ffi/capstone.rb

@@ -17,8 +17,20 @@ module PWN
       CS_MODE_32 = 4
       CS_MODE_64 = 8
 
-      # Capstone cs_insn layout used by cs_disasm.
-      class Insn < PubFFI::Struct
+      # Capstone 4 stores 16 instruction bytes; Capstone 5 stores 24.
+      # A mismatched layout returns non-empty garbage instead of raising.
+      class InsnV4 < PubFFI::Struct
+        layout :id, :uint,
+               :address, :uint64,
+               :size, :ushort,
+               :bytes, [:uchar, 16],
+               :mnemonic, [:char, 32],
+               :op_str, [:char, 160],
+               :detail, :pointer
+      end
+
+      # Capstone 5 widened cs_insn.bytes from 16 to 24.
+      class InsnV5 < PubFFI::Struct
         layout :id, :uint,
                :address, :uint64,
                :size, :ushort,
@@ -44,6 +56,7 @@ module PWN
         attach_function :cs_disasm, %i[size_t pointer size_t uint64 size_t pointer], :size_t
         attach_function :cs_free, %i[pointer size_t], :void
         attach_function :cs_close, [:pointer], :int
+        attach_function :cs_version, %i[pointer pointer], :uint
       end
 
       public_class_method def self.available?(opts = {})
@@ -67,8 +80,9 @@ module PWN
         count = cs_disasm(handle.read_ulong, buf, bytes.bytesize, (opts[:address] || 0).to_i, 0, insn_ptr)
         insns = []
         base = insn_ptr.read_pointer
+        klass = insn_class
         count.times do |i|
-          insn = Insn.new(base + (i * Insn.size))
+          insn = klass.new(base + (i * klass.size))
           insns << { address: insn[:address], mnemonic: insn[:mnemonic].to_s, op_str: insn[:op_str].to_s, size: insn[:size] }
         end
         cs_free(base, count) unless base.null?
@@ -76,6 +90,13 @@ module PWN
         { engine: 'capstone', insns: insns, count: count }
       end
 
+      private_class_method def self.insn_class
+        major = PubFFI::MemoryPointer.new(:int)
+        minor = PubFFI::MemoryPointer.new(:int)
+        cs_version(major, minor)
+        major.read_int >= 5 ? InsnV5 : InsnV4
+      end
+
       private_class_method def self.arch_mode(opts = {})
         arch = opts[:arch].to_s.downcase
         case arch

data/lib/pwn/plugins/assembly.rb

@@ -204,7 +204,8 @@ module PWN
 
         if opts[:engine].to_s != 'metasm' && PWN::FFI.available?(mod: :Keystone)
           begin
-            return PWN::FFI::Keystone.assemble(opts)
+            row = PWN::FFI::Keystone.assemble(opts)
+            return row if assembled_matches?(bytes: row[:bytes], asm: asm, arch: opts[:arch])
           rescue StandardError
             nil
           end
@@ -222,7 +223,7 @@ module PWN
         if opts[:engine].to_s != 'metasm' && PWN::FFI.available?(mod: :Capstone)
           begin
             row = PWN::FFI::Capstone.disassemble(opts)
-            return row if Array(row[:insns]).any?
+            return row if plausible_insns?(insns: row[:insns])
           rescue StandardError
             nil
           end
@@ -231,14 +232,34 @@ module PWN
         arch_obj = arch_object(opts)
         text = Metasm::Shellcode.disassemble(arch_obj, raw.to_s.b).to_s
         insns = text.lines.filter_map do |line|
-          match = line.match(/^\s*(?:0x)?([0-9a-f]+)\s+(\S+)\s*(.*)$/i)
-          next unless match
-
-          { address: match[1].to_i(16), mnemonic: match[2], op_str: match[3].to_s.strip }
+          if (match = line.match(/^\s*([A-Za-z][A-Za-z0-9.]*)\s*(.*?)\s*;\s*@([0-9a-f]+)/))
+            { address: match[3].to_i(16), mnemonic: match[1], op_str: match[2].to_s.strip }
+          elsif (match = line.match(/^\s*(?:0x)?([0-9a-f]+)\s+(\S+)\s*(.*)$/i))
+            { address: match[1].to_i(16), mnemonic: match[2], op_str: match[3].to_s.strip }
+          end
         end
         { engine: 'metasm', insns: insns, count: insns.length, text: text }
       end
 
+      # A mis-laid-out libcapstone still returns rows. Reject those and use Metasm.
+      private_class_method def self.plausible_insns?(opts = {})
+        insns = Array(opts[:insns])
+        return false if insns.empty?
+
+        insns.all? do |insn|
+          insn[:mnemonic].to_s.match?(/\A[A-Za-z][A-Za-z0-9.]{0,15}\z/) && insn[:size].to_i.between?(1, 15)
+        end
+      end
+
+      # Keystone ABI mismatches can return bytes that are not the requested instructions.
+      private_class_method def self.assembled_matches?(opts = {})
+        token = opts[:asm].to_s.lines.filter_map { |line| line.strip.split(/\s+/, 2).first }.find { |word| !word.end_with?(':') }
+        return false if token.to_s.empty?
+
+        dis = disassemble(bytes: opts[:bytes], arch: opts[:arch], engine: 'metasm')
+        Array(dis[:insns]).any? { |insn| insn[:mnemonic].to_s.casecmp?(token) }
+      end
+
       public_class_method def self.list_supported_archs
         [
           { name: 'i386', endian: 'little' },

data/lib/pwn/plugins/binary_parser.rb

@@ -578,6 +578,8 @@ module PWN
         pltrelsz = dyn[2].to_i
         relaent = bits == 64 ? 24 : 12
         plt_base = sections['.plt.sec']&.[](:addr) || sections['.plt']&.[](:addr)
+        # .plt.sec slots start at the section base. Classic .plt reserves the first 16 bytes for the lazy resolver.
+        plt_bias = sections['.plt.sec'] ? 0 : 1
         if jmprel && pltrelsz.positive?
           rel_off = v2off.call(jmprel)
           idx = 0
@@ -593,7 +595,7 @@ module PWN
             end
             unless name.to_s.empty?
               got[name] = r_offset
-              plt[name] = plt_base + (16 * (idx + 1)) if plt_base
+              plt[name] = plt_base + (16 * (idx + plt_bias)) if plt_base
             end
             idx += 1
           end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.748'
+  VERSION = '0.5.749'
 end

data/spec/lib/pwn/ai/agent/tools/exploitdev_spec.rb

@@ -38,7 +38,9 @@ describe 'PWN::AI::Agent::Tools exploitdev' do
           return 0;
         }
       C
-      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src)
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-Wl,-z,ibt', '-o', bin, src)
+      linked = status.success? && File.binread(bin).include?('.plt.sec')
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src) unless linked
       expect(status.success?).to eq(true), out
       elf = File.binread(bin)
       expect(elf[16, 2].unpack1('v')).to eq(2), 'cc produced a PIE binary; file addresses would not be the runtime addresses'

data/spec/lib/pwn/plugins/assembly_spec.rb

@@ -24,4 +24,18 @@ describe PWN::Plugins::Assembly do
     expect(blob).to match(/nop/i)
     expect(%w[capstone metasm]).to include(dis[:engine].to_s)
   end
+
+  it 'falls back to metasm when capstone returns a mis-laid-out mnemonic' do
+    allow(PWN::FFI).to receive(:available?).and_call_original
+    allow(PWN::FFI).to receive(:available?).with(mod: :Capstone).and_return(true)
+    allow(PWN::FFI::Capstone).to receive(:disassemble).and_return(
+      engine: 'capstone',
+      insns: [{ mnemonic: "L\xCB\xEFy", op_str: "L\xCB\xEFy", size: 4 }]
+    )
+    asm = described_class.assemble(asm: "nop\nret", arch: 'x86_64', engine: 'metasm')
+    dis = described_class.disassemble(bytes: asm[:bytes], arch: 'x86_64')
+    expect(dis[:engine]).to eq('metasm')
+    blob = dis[:insns].map { |row| row[:mnemonic] }.join(' ')
+    expect(blob).to match(/nop/i)
+  end
 end

data/spec/lib/pwn/plugins/binary_parser_spec.rb

@@ -89,4 +89,21 @@ describe PWN::Plugins::BinaryParser do
       expect(row[:symbols]['main'] || row[:symbols][:main]).to be_a(Integer)
     end
   end
+
+  it 'elf_resolve points system at the .plt.sec stub, not the next slot' do
+    Dir.mktmpdir('pwn-elf-ibt-') do |dir|
+      src = File.join(dir, 't.c')
+      path = File.join(dir, 't')
+      File.write(src, "#include <stdlib.h>\nint main(void) { return system(\"x\"); }\n")
+      out, status = Open3.capture2e('cc', '-O0', '-fno-pie', '-no-pie', '-Wl,-z,ibt', '-o', path, src)
+      expect(status.success?).to eq(true), out
+      expect(File.binread(path)).to include('.plt.sec')
+      row = described_class.elf_resolve(path: path)
+      dump, dump_status = Open3.capture2('objdump', '-d', path)
+      expect(dump_status.success?).to eq(true), dump
+      real = dump[/^([0-9a-f]+) <system@plt>:/, 1]
+      expect(real).not_to be_nil
+      expect(row[:plt]['system']).to eq(real.to_i(16))
+    end
+  end
 end

data/third_party/pwn_rdoc.jsonl

@@ -1952,6 +1952,7 @@
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.available? Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.available?`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.disassemble Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.disassemble`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::Capstone.help Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.help`: "}]}
+{"messages":[{"role":"user","content":"PWN::FFI::Capstone.insn_class Usage"},{"role":"assistant","content":"`PWN::FFI::Capstone.insn_class`: "}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.authors Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.available? Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.available?`: Supported Method Parameters\n\nPWN::FFI::DSPNative.available?\n"}]}
 {"messages":[{"role":"user","content":"PWN::FFI::DSPNative.cfft_mag Usage"},{"role":"assistant","content":"`PWN::FFI::DSPNative.cfft_mag`: Supported Method Parameters\n\nmagnitudes = PWN::FFI::DSPNative.cfft_mag(iq:, n:) Power-of-two FFT; input is zero-padded/truncated, output unshifted.\n"}]}
@@ -2188,11 +2189,13 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.arch_object Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.arch_object`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.asm_to_opcodes Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.asm_to_opcodes`: Supported Method Parameters\n\nPWN::Plugins::Assembly.asm_to_opcodes(\n\nasm: 'required - assembly instruction(s) (e.g. 'nop\\nnop\\nnop\\njmp rsp\\n)',\narch: 'optional - architecture returned from objdump --info (defaults to PWN::Plugins::DetectOS.arch)',\nendian: 'optional - endianess :big|:little (defaults to current system endianess)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.assemble Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.assemble`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::Assembly.assembled_matches? Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.assembled_matches?`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.disassemble Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.disassemble`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.help Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.list_supported_archs Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.list_supported_archs`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Assembly.opcodes_to_asm Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.opcodes_to_asm`: Supported Method Parameters\n\nPWN::Plugins::Assembly.opcodes_to_asm(\n\nopcodes: 'required - hex escaped opcode(s) (e.g. \"\\x90\\x90\\x90\")',\nopcodes_always_string_obj: 'optional - always interpret opcodes passed in as a string object (defaults to false)',\narch: 'optional - architecture returned from objdump --info (defaults to PWN::Plugins::DetectOS.arch)',\nendian: 'optional - endianess :big|:little (defaults to current system endianess)'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::Assembly.plausible_insns? Usage"},{"role":"assistant","content":"`PWN::Plugins::Assembly.plausible_insns?`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.help Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::AuthenticationHelper.mask_password Usage"},{"role":"assistant","content":"`PWN::Plugins::AuthenticationHelper.mask_password`: Supported Method Parameters\n\nPWN::Plugins::AuthenticationHelper.mask_password(\n\nprompt: 'optional - string to display at prompt (Default: Password)'\n\n)\n"}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.748
+  version: 0.5.749
 platform: ruby
 authors:
 - 0day Inc.
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4
 - !ruby/object:Gem::Dependency
   name: anemone
   requirement: !ruby/object:Gem::Requirement