pwn 0.5.718 → 0.5.719

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c9afec4ab615d169982f573cf42ccd571c2593eec77e5905c131adf0bfb7660
-  data.tar.gz: 12d38fd2f938a1d6a68dc0418da107207297d23e0bd4d6a4561e9080f943875b
+  metadata.gz: 898622177b06081e32121144c9ae5461d510482e70a85b62de425967933e4e24
+  data.tar.gz: ddfe5cac2e3db9bab8ab9cafdb1f48a2e2191545a2d0ad5bb7245cb7f45ab45f
 SHA512:
-  metadata.gz: bfceaf016937af5fe50f5a47b3e4b23bda9c9dc3395c602bd17d36bea8dc9e18eec1b0372d11aea34fe5f856ce323b02368b31094ca28817b5a5beedacae89e7
-  data.tar.gz: 3896ef7de35eae9e17c043ea36b1f9258db192f776ee977aa37dde2f5470cd1441109caea605a631bea5ca7a5446aa3a231db779dd83423a003793989c55eca9
+  metadata.gz: 2751aa2984fe13fe852a6f12577bd840f097e5d84f240a05642e374938bbf8fe9095dcaee15a607b0b1c3c4b90d65b787f041ffbda26ec3868f26f68a400b28b
+  data.tar.gz: db70fe6f75eaa22625849d30ab0e1a73dec982e160db005cce3096e625346eaea5d68653a4fb27a6e452f4ba01c63ab0313a5bd484b54a874f95bf44944ea149

data/lib/pwn/ai/agent/loop.rb

@@ -661,7 +661,6 @@ module PWN
 
         private_class_method def self.declared_contract_unsatisfied?(opts = {})
           return false if verify_passed?(messages: opts[:messages])
-          return false if write_or_read_evidenced?(messages: opts[:messages])
 
           completion_unmet(opts).any?
         rescue StandardError
@@ -670,7 +669,6 @@ module PWN
 
         private_class_method def self.completion_unmet(opts = {})
           return [] if verify_passed?(messages: opts[:messages])
-          return [] if write_or_read_evidenced?(messages: opts[:messages])
 
           contract = declared_contract(request: opts[:request])
           request = opts[:request].to_s

data/lib/pwn/plugins/detect_os.rb

@@ -182,8 +182,7 @@ module PWN
                end
           found << name if ok
         end
-        owned = pwn_installed_bins(pwn_bins: opts[:pwn_bins])
-        native = (found.map(&:to_s) - owned).reject(&:empty?).uniq.sort
+        native = found.map(&:to_s).reject(&:empty?).uniq.sort
         cap = if opts.key?(:cap_net_raw)
                 opts[:cap_net_raw]
               else

data/lib/pwn/plugins/exploit_db.rb

@@ -207,27 +207,51 @@ module PWN
       end
 
       private_class_method def self.gtfobins_json(opts = {})
-        body = opts[:body].to_s
-        stripped = body.lstrip
-        return body if stripped.start_with?('{', '[')
+        raw = opts[:body]
+        raw = raw.to_s.b unless raw.nil?
+        stripped = raw.to_s.lstrip
+        if stripped.start_with?('{', '[')
+          parsed = JSON.parse(stripped)
+          raise 'ERROR: GTFOBins JSON was empty' if parsed.nil? || parsed.empty?
+
+          return stripped
+        end
 
         bins = {}
-        Zlib::GzipReader.wrap(StringIO.new(body)) do |gz|
+        Zlib::GzipReader.wrap(StringIO.new(raw)) do |gz|
           Gem::Package::TarReader.new(gz) do |tar|
             tar.each do |entry|
               next unless entry.file?
-              next unless entry.full_name.include?('_gtfobins/') && entry.full_name.end_with?('.md')
 
-              name = File.basename(entry.full_name, '.md')
+              path = entry.full_name.to_s
+              next unless path.include?('/_gtfobins/') || path.start_with?('_gtfobins/')
+
+              base = File.basename(path)
+              next if base.empty? || base.start_with?('.')
+
+              name = base.sub(/\.md\z/i, '')
               text = entry.read.to_s
-              funcs = text.scan(/^##\s+(.+)$/).flatten.map(&:strip)
+              funcs = gtfobins_functions(text: text)
               bins[name] = { 'binary' => name, 'functions' => funcs }
             end
           end
         end
+        raise 'ERROR: GTFOBins archive contained no _gtfobins entries' if bins.empty?
+
         JSON.generate(bins)
-      rescue StandardError
-        body.start_with?('{') ? body : JSON.generate({})
+      end
+
+      private_class_method def self.gtfobins_functions(opts = {})
+        text = opts[:text].to_s
+        headed = text.scan(/^##\s+(.+)$/).flatten.map(&:strip)
+        return headed unless headed.empty?
+
+        if text =~ /^functions:\s*$/
+          keys = text.scan(/^(?:  |\t)([A-Za-z0-9._-]+):\s*$/).flatten
+          return keys unless keys.empty?
+        end
+
+        []
       end
     end
   end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.718'
+  VERSION = '0.5.719'
 end

data/spec/lib/pwn/ai/agent/loop_spec.rb

@@ -931,7 +931,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
         {
           role: 'tool',
           name: 'pwn_eval',
-          content: '{"success":true,"result":{"stdout":"Report saved to /tmp/pentest_report.json"},"effect":"write"}'
+          content: '{"success":true,"result":{"stdout":"Report saved to /tmp/pwn-spec-report.json"},"effect":"write"}'
         },
         {
           role: 'assistant',

data/spec/lib/pwn/plugins/detect_os_spec.rb

@@ -76,8 +76,6 @@ describe PWN::Plugins::DetectOS do
       expect(row[:version]).to eq('2026.3')
       expect(row[:arch]).to be_a(String)
       expect(row[:endian]).to be_a(Symbol)
-      expect(row[:native]).to include('jq', 'yara')
-      expect(row[:native]).not_to include('gdb', 'r2', 'nuclei')
       expect(row).not_to have_key(:missing)
       expect(row[:summary]).to include('kali')
       expect(row[:summary]).not_to include('missing=')
@@ -94,17 +92,5 @@ describe PWN::Plugins::DetectOS do
       expect(row[:version]).to eq('3.20.0')
       expect(row[:native]).to eq([])
     end
-
-    it 'does not treat plugin required_bins gaps as the inventory' do
-      row = described_class.living_off_the_land(
-        os_release: "ID=debian\nVERSION_ID=12\n",
-        type: :linux,
-        pwn_bins: %w[gdb r2],
-        bins: %w[jq],
-        which: { 'jq' => true, 'gdb' => false }
-      )
-      expect(row[:native]).to include('jq')
-      expect(row[:native]).not_to include('gdb')
-    end
   end
 end

data/spec/lib/pwn/plugins/exploit_db_spec.rb

@@ -3,6 +3,9 @@
 require 'spec_helper'
 require 'tmpdir'
 require 'fileutils'
+require 'stringio'
+require 'zlib'
+require 'rubygems/package'
 
 describe PWN::Plugins::ExploitDB do
   it 'should display information for authors' do
@@ -36,23 +39,55 @@ describe PWN::Plugins::ExploitDB do
     end
   end
 
+  def gtfobins_tarball(opts = {})
+    name = (opts[:name] || 'tar').to_s
+    md = (opts[:body] || "---\nfunctions:\n  file-read:\n  - code: tar xf -\n  SUID:\n  - code: tar\n").to_s
+    sio = StringIO.new
+    sio.binmode
+    gz = Zlib::GzipWriter.new(sio)
+    Gem::Package::TarWriter.new(gz) do |tar|
+      path = "GTFOBins.github.io-master/_gtfobins/#{name}"
+      tar.add_file_simple(path, 0o644, md.bytesize) { |io| io.write(md) }
+    end
+    gz.close
+    sio.string
+  end
+
   it 'sync fetches latest ExploitDB CSV and GTFOBins into ~/.pwn/intel' do
     Dir.mktmpdir do |dir|
       allow(Dir).to receive(:home).and_return(dir)
       csv = "id,file,description,cve\n1,e.rb,Apache Log4j RCE,CVE-2021-44228\n"
-      json = '{"tar":{"binary":"tar","functions":["file-read"]}}'
+      tgz = gtfobins_tarball
       get = lambda do |url|
-        url.to_s.include?('files_exploits') ? csv : json
+        url.to_s.include?('files_exploits') ? csv : tgz
       end
       out = described_class.sync(get: get)
       intel = File.join(dir, '.pwn', 'intel')
       expect(out[:dest]).to eq(intel)
       expect(File.read(File.join(intel, 'files_exploits.csv'))).to include('CVE-2021-44228')
-      expect(File.read(File.join(intel, 'gtfobins.json'))).to include('tar')
+      json = File.read(File.join(intel, 'gtfobins.json'))
+      expect(json).not_to eq('{}')
+      expect(json).to include('tar')
+      expect(json).to include('file-read')
       expect(out[:fetched]).to include('files_exploits.csv', 'gtfobins.json')
     end
   end
 
+  it 'refuses to write an empty gtfobins.json when the archive has no bins' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      sio = StringIO.new
+      sio.binmode
+      gz = Zlib::GzipWriter.new(sio)
+      Gem::Package::TarWriter.new(gz) { |tar| tar.mkdir('empty', 0o755) }
+      gz.close
+      get = lambda do |url|
+        url.to_s.include?('files_exploits') ? "id,file\n1,a\n" : sio.string
+      end
+      expect { described_class.sync(get: get) }.to raise_error(/GTFOBins/)
+    end
+  end
+
   it 'does not copy from a tree-bundled etc/intel directory' do
     src = File.read(described_class.method(:sync).source_location.first)
     expect(src).not_to include('etc/intel')

data/third_party/pwn_rdoc.jsonl

@@ -2002,6 +2002,7 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.authors`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.cve_for_cpe Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.cve_for_cpe`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.gtfobins Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.gtfobins`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.gtfobins_functions Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.gtfobins_functions`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.gtfobins_json Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.gtfobins_json`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.help Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::ExploitDB.http_get Usage"},{"role":"assistant","content":"`PWN::Plugins::ExploitDB.http_get`: "}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.718
+  version: 0.5.719
 platform: ruby
 authors:
 - 0day Inc.