pwn 0.5.783 → 0.5.785

data/lib/pwn/plugins/basic_auth.rb

@@ -17,7 +17,7 @@ module PWN
         basic_user = opts[:username]
         basic_pass = opts[:password]
         if (basic_user.nil? || basic_pass.nil?) && !opts[:host].to_s.empty?
-          hit = Array(PWN::Plugins::Vault.offer(host: opts[:host], service: opts[:service], engagement: opts[:engagement] || opts[:engagement_id])).first
+          hit = Array(PWN::Plugins::Vault.offer(host: opts[:host], service: opts[:service], engagement: opts[:engagement] || opts[:engagement_id], yubikey: opts[:yubikey])).first
           if hit
             basic_user = hit[:username] if basic_user.nil?
             basic_pass = hit[:secret] if basic_pass.nil?
@@ -63,6 +63,7 @@ module PWN
             password: 'optional - password; omitted values are filled from Vault.offer',
             host: 'optional - hostname used to offer recon loot when username or password is omitted',
             service: 'optional - service name such as http or ssh used to match loot',
+            yubikey: 'optional - YubiKey selector Hash forwarded to hardware-protected Vault loot',
             engagement: 'optional - engagement id scoping the loot file (defaults to default)',
             engagement_id: 'optional - alias for engagement'
           )

data/lib/pwn/plugins/binary_parser.rb

@@ -101,16 +101,17 @@ module PWN
         sha = Digest::SHA256.file(path).hexdigest
         sid = (opts[:session_id] || 'triage').to_s
         cache_dir = File.join(Dir.home, '.pwn', 'cache', 'triage')
-        FileUtils.mkdir_p(cache_dir)
         cache = File.join(cache_dir, "#{sha}.json")
-        if File.file?(cache)
-          cached = JSON.parse(File.read(cache), symbolize_names: true)
+        require File.expand_path('../../../etc/default_cron/session_cleanup', __dir__)
+        cached_bytes = PWN::SessionCleanup.cache(path: cache)
+        if cached_bytes
+          cached = JSON.parse(cached_bytes, symbolize_names: true)
           spilled = persist_triage(body: cached, session_id: sid)
           return cached.merge(cached: true, handle: spilled[:handle], artifact: spilled)
         end
 
         body = inspect_binary(opts.merge(path: path, sha256: sha))
-        File.write(cache, JSON.pretty_generate(body))
+        PWN::SessionCleanup.cache(path: cache, bytes: JSON.pretty_generate(body))
         facts_dir = File.join(Dir.home, '.pwn', 'engagements', 'default', 'binaries', sha)
         FileUtils.mkdir_p(facts_dir)
         File.write(File.join(facts_dir, 'facts.json'), JSON.pretty_generate(body))

data/lib/pwn/plugins/ghidra.rb

@@ -37,13 +37,14 @@ module PWN
 
         sha = Digest::SHA256.file(path).hexdigest if File.file?(path)
         cache = File.join(Dir.home, '.pwn', 'cache', 'decompile', "#{sha}.json") if sha
-        return JSON.parse(File.read(cache), symbolize_names: true).merge(cached: true) if cache && File.file?(cache)
+        require File.expand_path('../../../etc/default_cron/session_cleanup', __dir__)
+        cached = PWN::SessionCleanup.cache(path: cache) if cache
+        return JSON.parse(cached, symbolize_names: true).merge(cached: true) if cached
 
         row = analyze(opts)
         fn = opts[:function].to_s
         row[:function] = fn unless fn.empty?
-        FileUtils.mkdir_p(File.dirname(cache)) if cache
-        File.write(cache, JSON.generate(row)) if cache
+        PWN::SessionCleanup.cache(path: cache, bytes: JSON.generate(row)) if cache
         row
       end
 

data/lib/pwn/plugins/google_workspace.rb

@@ -397,25 +397,13 @@ module PWN
         dec_path = dec_path.to_s.strip
         dec_path = "#{env_path}.decryptor" if dec_path.empty?
 
-        unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
+        unless File.exist?(env_path)
           puts '[*] INFO: Google Workspace OAuth tokens updated in this session only; ' \
-               "persistence to #{env_path} skipped (missing decryption artifacts)."
+               "persistence to #{env_path} skipped (missing vault)."
           return false
         end
 
-        decryptor = YAML.load_file(dec_path, symbolize_names: true)
-        key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
-        iv = decryptor.is_a?(Hash) ? decryptor[:iv] : nil
-        unless real_config_value?(value: key) && real_config_value?(value: iv)
-          puts '[*] INFO: Google Workspace OAuth tokens updated in this session only; ' \
-               'decryptor has no usable key/iv.'
-          return false
-        end
-
-        PWN::Plugins::Vault.decrypt(file: env_path, key: key, iv: iv)
-        begin
-          vault = YAML.load_file(env_path, symbolize_names: true)
-          vault = {} unless vault.is_a?(Hash)
+        PWN::Plugins::Vault.update(file: env_path, decryptor_file: dec_path) do |vault|
           vault[:plugins] = {} unless vault[:plugins].is_a?(Hash)
           vault[:plugins][:google_workspace] = {} unless vault[:plugins][:google_workspace].is_a?(Hash)
           slot = vault[:plugins][:google_workspace][:oauth]
@@ -423,15 +411,10 @@ module PWN
           %i[bearer_token refresh_token expires_at client_id client_secret redirect_uri scope].each do |k|
             slot[k] = oauth[k] if oauth.key?(k) && !oauth[k].nil?
           end
-          yaml_env = YAML.dump(vault).gsub(/^(\s*):/, '\1')
-          File.write(env_path, yaml_env)
-          File.chmod(0o600, env_path)
-        ensure
-          PWN::Plugins::Vault.encrypt(file: env_path, key: key, iv: iv)
         end
         true
       rescue StandardError => e
-        warn "[!] Google Workspace OAuth vault persistence failed (session tokens still updated): #{e.class}: #{e.message}"
+        warn "[!] Google Workspace OAuth vault persistence failed (session tokens still updated): #{e.class}"
         false
       end
 

data/lib/pwn/plugins/jobs.rb

@@ -26,7 +26,7 @@ module PWN
 
         root = File.expand_path(JOBS_DIR)
         FileUtils.mkdir_p(root, mode: 0o700)
-        File.chmod(0o700, root)
+        File.chmod(0o700, root) unless (File.stat(root).mode & 0o777) == 0o700
         runtime = Float(opts[:max_runtime] || 0)
         raise ArgumentError, 'max_runtime must be finite and nonnegative' unless runtime.finite? && runtime >= 0
 

data/lib/pwn/plugins/log.rb

@@ -27,7 +27,7 @@ module PWN
         PWN::AI::Agent::Loop
         PWN::AI::Agent::Dispatch
       ].freeze
-      SECRET_KEY_RX = /password|passwd|secret|token|api[_-]?key|authorization|bearer|cookie|session[_-]?id|private[_-]?key|decryptor|credential|ssh[_-]?key|client[_-]?secret|refresh[_-]?token|access[_-]?token|id[_-]?token|vault|csrf/i
+      SECRET_KEY_RX = Regexp.union(PWN::Redaction::MASKED_FIELD, /password|passwd|secret|token|api[_-]?key|authorization|bearer|cookie|session[_-]?id|private[_-]?key|decryptor|credential|ssh[_-]?key|client[_-]?secret|refresh[_-]?token|access[_-]?token|id[_-]?token|vault|csrf/i)
       SECRET_VALUE_RX = %r{
         -----BEGIN\ [A-Z ]*PRIVATE\ KEY----- |
         Bearer\s+[A-Za-z0-9\-._~+/]+=* |
@@ -60,8 +60,9 @@ module PWN
           log_file_path = "/tmp/pwn-ai-#{session}.json" if level == :learning
           log_file = File.open(log_file_path, 'w')
         else
-          log_file_path = '/tmp/pwn.log'
-          log_file = File.open(log_file_path, 'a')
+          require 'stringio'
+          log_file_path = File.join(Dir.home, '.pwn', 'logs', 'pwn.log')
+          log_file = StringIO.new
         end
 
         # Leave 10 "old" log files where
@@ -124,6 +125,10 @@ module PWN
         end
 
         logger.add(logger.level, PWN::Redaction.redact(value: log_event), PWN::Redaction.redact(value: which_self))
+        unless level == :learning
+          require File.expand_path('../../../etc/default_cron/session_cleanup', __dir__)
+          PWN::SessionCleanup.append_log(path: log_file_path, bytes: log_file.string)
+        end
         logger.close
       rescue Interrupt
         note_interrupt!(where: 'CTRL+C', which_self: self) if debug_enabled?
@@ -424,9 +429,18 @@ module PWN
           unless @debug_file.nil? || @debug_file.closed?
             @debug_file.puts(PWN::Redaction.token(kind: 'stream', value: @stderr_redaction_buffer)) unless @stderr_redaction_buffer.to_s.empty?
             @debug_file.close
+            @debug_lease&.close
+            @debug_lease = nil
+            if @debug_path.to_s.start_with?("#{File.join(Dir.home, '.pwn', 'logs')}/")
+              require File.expand_path('../../../etc/default_cron/session_cleanup', __dir__)
+              PWN::SessionCleanup.register_disposable(path: @debug_path, category: 'logs')
+            end
           end
         rescue StandardError
           nil
+        ensure
+          @debug_lease&.close
+          @debug_lease = nil
         end
         @debug_file = nil
         @stderr_redaction_buffer = ''
@@ -439,6 +453,8 @@ module PWN
 
         close_debug_file!
         FileUtils.mkdir_p(File.dirname(path))
+        @debug_lease = File.open("#{path}.lease", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
+        @debug_lease.flock(File::LOCK_EX)
         io = File.open(path, 'a', 0o600)
         io.chmod(0o600)
         io.sync = true
@@ -628,11 +644,13 @@ module PWN
       private_class_method def self.inspect_debug(opts = {})
         val = opts[:value]
         key = opts[:key]
+        return PWN::Redaction::CONSTANT_MASK if key.to_s.match?(PWN::Redaction::MASKED_FIELD)
         return PWN::Redaction.token(kind: 'credential', value: val.to_s) if secret_key?(key: key)
         return PWN::Redaction.token(kind: 'opaque', value: val) if opaque_secret?(key: key, value: val)
         return format_debug_hash(hash: val) if val.is_a?(Hash)
         return sanitize_debug_text(text: val) if val.is_a?(String) && val.match?(SECRET_VALUE_RX)
 
+        val = PWN::Redaction.redact(value: val) if val.is_a?(Array)
         raw = sanitize_debug_text(text: val.inspect)
         raw = "#{raw[0, DEBUG_VALUE_MAX]}…" if raw.length > DEBUG_VALUE_MAX
         raw

data/lib/pwn/plugins/preflight_checker.rb

@@ -6,9 +6,9 @@ require 'time'
 
 module PWN
   module Plugins
-    # Plugin/binary/capability preflight. Plugins declare required_bins /
-    # required_caps; HOST summaries list degraded modules without autoloading
-    # the whole plugin tree.
+    # Plugin/binary/capability preflight. Native probes load host libraries
+    # only: no device enumeration, authentication or I/O. HOST summaries list
+    # degraded modules without autoloading the whole plugin tree.
     module PreflightChecker
       class MissingBinary < StandardError; end
       class MissingCapability < StandardError; end
@@ -32,6 +32,13 @@ module PWN
         'PWN::Plugins::Semgrep' => { bins: %w[semgrep] },
         'PWN::Plugins::ExploitDB' => { bins: %w[searchsploit] },
         'PWN::Plugins::Recon' => { bins: %w[subfinder httpx] },
+        'PWN::Plugins::YubiKey' => {
+          bins: [],
+          native: [
+            { name: 'FIDO native transport', probe: 'PWN::Plugins::YubiKey', options: { application: :fido } },
+            { name: 'PC/SC native transport', probe: 'PWN::Plugins::YubiKey', options: { application: :oath } }
+          ]
+        },
         'PWN::Plugins::CredentialAttack' => { bins: %w[hydra john hashcat] }
       }.freeze
 
@@ -97,6 +104,11 @@ module PWN
         PLUGIN_DEPS.each do |mod, dep|
           missing = Array(dep[:bins]).reject { |b| bin?(name: b) }
           caps[mod] = { bins: dep[:bins], missing: missing, ok: missing.empty?, caps: Array(dep[:caps]) }
+          next unless dep[:native]
+
+          missing_native = Array(dep[:native]).reject { |probe| native_available?(probe: probe) }.map { |probe| probe[:name] }
+          caps[mod][:missing_native] = missing_native
+          caps[mod][:ok] &&= missing_native.empty?
         end
         row = {
           at: Time.now.utc.iso8601,
@@ -164,21 +176,25 @@ module PWN
           bins = Array(dep[:bins])
           caps = Array(dep[:caps])
           services = Array(dep[:services])
+          native = Array(dep[:native])
           missing_bins = bins.reject { |b| bin?(name: b) }
+          missing_native = native.reject { |probe| native_available?(probe: probe) }.map { |probe| probe[:name] }
           missing_caps = []
           if caps.include?('CAP_NET_RAW')
             pkt_ok = defined?(PWN::Plugins::Packet) && PWN::Plugins::Packet.respond_to?(:health) && PWN::Plugins::Packet.health[:ok]
             missing_caps << 'CAP_NET_RAW' unless pkt_ok || cap_net_raw?
           end
           missing_services = services.reject { |s| service?(name: s[:name] || s['name'], path: s[:path] || s['path']) }.map { |s| s[:name] || s['name'] }
-          status = if missing_bins.empty? && missing_caps.empty? && missing_services.empty?
+          status = if missing_bins.empty? && missing_caps.empty? && missing_services.empty? && missing_native.empty?
                      :ok
-                   elsif bins.any? && missing_bins.length == bins.length
+                   elsif (bins.any? && missing_bins.length == bins.length) || (native.any? && missing_native.length == native.length)
                      :dead
                    else
                      :degraded
                    end
-          { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps, missing_services: missing_services }
+          row = { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps, missing_services: missing_services }
+          row[:missing_native] = missing_native if dep[:native]
+          row
         end
       end
 
@@ -189,7 +205,7 @@ module PWN
         degraded = rows.select { |r| r[:status] == :degraded }
         lines = ["HOST plugins ok=#{rows.count { |r| r[:status] == :ok }} degraded=#{degraded.length} dead=#{dead.length}"]
         (degraded + dead).first(cap).each do |r|
-          miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services])).join(',')
+          miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services]) + Array(r[:missing_native])).join(',')
           fb = Array(FALLBACKS[r[:plugin]]).join(',')
           extra = fb.empty? ? '' : " fallback=#{fb}"
           anchor = r[:plugin].to_s.downcase.gsub(/[^a-z0-9]+/, '-').gsub(/\A-+|-+\z/, '')
@@ -198,6 +214,15 @@ module PWN
         lines.join("\n")
       end
 
+      # Only trusted declarations above may supply a host-only available? probe.
+      private_class_method def self.native_available?(opts = {})
+        probe = opts[:probe]
+        provider = probe.fetch(:probe).split('::').inject(Object) { |scope, name| scope.const_get(name, false) }
+        provider.available?(probe.fetch(:options, {})) == true
+      rescue LoadError, StandardError
+        false
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -247,7 +272,7 @@ module PWN
             path: 'required - unix socket path (e.g. /var/run/docker.sock)'
           )
 
-          # Run check and return its result
+          # Report dependencies; native rows add missing_native from host-only library probes, never device readiness.
           #{self}.check(
             names: 'optional - Array names value consumed by #check'
           )
@@ -258,7 +283,7 @@ module PWN
             limit: 'optional - limit value consumed by #host_summary'
           )
 
-          # Refresh ~/.pwn/capabilities.json with bin/CAP_* presence.
+          # Refresh ~/.pwn/capabilities.json with bin/CAP_* and host-native-library presence; no device discovery.
           #{self}.manifest(
             refresh: 'optional - unused reserved refresh flag'
           )

data/lib/pwn/plugins/recon.rb

@@ -138,7 +138,7 @@ module PWN
           File.rename(temp, path)
         end
         result = JSON.parse(File.read(path), symbolize_names: true).merge(path: path)
-        result[:loot] = harvest_loot(assets: result[:assets], engagement_id: engagement)
+        result[:loot] = harvest_loot(assets: result[:assets], engagement_id: engagement, yubikey: opts[:yubikey])
         if opts[:ingest]
           begin
             ingestor = opts[:ingestor] || PWN::AI::Context.method(:ingest)
@@ -285,6 +285,7 @@ module PWN
               source: 'recon',
               where: opts[:where] || "banner:#{obs[:port] || asset[:port]}",
               engagement: eng,
+              yubikey: opts[:yubikey],
               finding_id: opts[:finding_id]
             )
           end
@@ -354,6 +355,7 @@ module PWN
             modules: 'optional - Array nmap/banner/tls/subfinder/nuclei; defaults nmap/banner',
             ports: 'optional - Array of integer ports; defaults 80 and 443',
             engagement_id: 'optional - simple identifier; defaults default',
+            yubikey: 'optional - hardware selector Hash for harvested loot; device failure raises without software fallback',
             root: 'optional - engagements directory; defaults ~/.pwn/engagements',
             timeout: 'optional - per-operation timeout seconds; defaults 15, maximum 300',
             ingest: 'optional - invoke Context.ingest after persistence; defaults false',
@@ -366,6 +368,7 @@ module PWN
             assets: 'required - Array of recon asset hashes with address and observations',
             engagement_id: 'optional - engagement id scoping the loot file (defaults to default)',
             engagement: 'optional - alias for engagement_id',
+            yubikey: 'optional - hardware selector Hash forwarded to Vault.ingest for captured secrets',
             where: 'optional - provenance path overlay when observation port is missing',
             finding_id: 'optional - finding id linked onto harvested secrets'
           )