pwn 0.5.83 → 0.5.84

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69446d2989efc5f4bcca3ceffde6bdf663067b128cd7cccf4050051752e6b1c5
-  data.tar.gz: e9ad99571be1561a94dbe7e1775300607bb8635fddd3b648ca4b7e7eaf6abb08
+  metadata.gz: 140bec69aaf1bd6d7c4cdaa6eea7e065de1ba99d1bc19af79d647fc04c50a5f1
+  data.tar.gz: 22fa36d33db3cedbfbae8125357fc5c4385ab1d83098537ce8a454474d5456ee
 SHA512:
-  metadata.gz: a4a6c70717d34bf933326815bf454dbc7732798f766061a053ade2c9cd5dd25a991c5d6aea11520c8f8533914d3b0813f01b756e4794e6b814df68760163a243
-  data.tar.gz: afaa0614e87d9c4969e1cb3b6a4649db3c65b8086005e66c5b3f84e8ef83d37a30413202b80ae794eb3ffad65cf92facaa253edcf6cf0910334858abc11071f9
+  metadata.gz: 534ef6b2be5bbda8b98384464b16744e2a8b69a70a2e5eb3d475b513543a047a0830f9d0cb2bd9f4b2619b4b9a5d3579570721f3c46820964904c9970e8c940b
+  data.tar.gz: bafb717f2cab353ab3d9e3515bfde975d7bbab1f10769e8e54d602d0d92718ea909bebec8b1afda3b793814551287bf924df9348b252b45f9af9ac73340119d9

data/Gemfile

@@ -32,6 +32,7 @@ gem 'ffi', '1.16.3'
 gem 'fftw3', '0.3'
 gem 'gdb', '1.0.0'
 gem 'gem-wrappers', '1.4.0'
+gem 'geocoder', '1.8.2'
 gem 'gist', '6.0.0'
 gem 'gruff', '0.24.0'
 # gem 'hidapi', '0.1.9'
@@ -42,10 +43,11 @@ gem 'js-beautify', '0.1.8'
 gem 'json', '2.7.2'
 gem 'jsonpath', '1.1.5'
 gem 'jwt', '2.8.1'
-gem 'libusb', '0.6.4'
+gem 'libusb', '0.7.1'
 gem 'luhn', '1.0.2'
 gem 'mail', '2.8.1'
 gem 'metasm', '1.0.5'
+gem 'mqtt', '0.6.0'
 # gem 'mongo', '2.19.3'
 gem 'msfrpc-client', '1.1.2'
 gem 'netaddr', '2.0.6'
@@ -66,7 +68,7 @@ gem 'pry', '0.14.2'
 gem 'pry-doc', '1.5.0'
 gem 'rake', '13.2.1'
 gem 'rb-readline', '0.5.5'
-gem 'rbvmomi', '3.0.0'
+gem 'rbvmomi2', '3.7.1'
 gem 'rdoc', '6.6.3.1'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
@@ -74,7 +76,7 @@ gem 'rmagick', '5.5.0'
 gem 'rqrcode', '2.2.0'
 gem 'rspec', '3.13.0'
 gem 'rtesseract', '3.1.3'
-gem 'rubocop', '1.63.2'
+gem 'rubocop', '1.63.3'
 gem 'rubocop-rake', '0.6.0'
 gem 'rubocop-rspec', '2.29.1'
 gem 'ruby-audio', '1.6.1'
@@ -88,7 +90,7 @@ gem 'serialport', '1.3.2'
 gem 'slack-ruby-client', '2.3.0'
 gem 'socksify', '1.7.1'
 gem 'spreadsheet', '1.3.1'
-gem 'sqlite3', '1.7.3'
+gem 'sqlite3', '2.0.1'
 gem 'thin', '1.8.2'
 gem 'tty-prompt', '0.23.1'
 gem 'tty-spinner', '0.9.3'

data/README.md

@@ -37,7 +37,7 @@ $ cd /opt/pwn
 $ ./install.sh
 $ ./install.sh ruby-gem
 $ pwn
-pwn[v0.5.83]:001 >>> PWN.help
+pwn[v0.5.84]:001 >>> PWN.help
 ```
 
 [![Installing the pwn Security Automation Framework](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/pwn_install.png)](https://youtu.be/G7iLUY4FzsI)
@@ -52,7 +52,7 @@ $ rvm use ruby-3.3.0@pwn
 $ gem uninstall --all --executables pwn
 $ gem install --verbose pwn
 $ pwn
-pwn[v0.5.83]:001 >>> PWN.help
+pwn[v0.5.84]:001 >>> PWN.help
 ```
 
 If you're using a multi-user install of RVM do:
@@ -62,7 +62,7 @@ $ rvm use ruby-3.3.0@pwn
 $ rvmsudo gem uninstall --all --executables pwn
 $ rvmsudo gem install --verbose pwn
 $ pwn
-pwn[v0.5.83]:001 >>> PWN.help
+pwn[v0.5.84]:001 >>> PWN.help
 ```
 
 PWN periodically upgrades to the latest version of Ruby which is reflected in `/opt/pwn/.ruby-version`.  The easiest way to upgrade to the latest version of Ruby from a previous PWN installation is to run the following script:

data/lib/pwn/plugins/meshtastic.rb

@@ -0,0 +1,265 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'geocoder'
+require 'json'
+require 'mqtt'
+require 'openssl'
+require 'securerandom'
+
+module PWN
+  module Plugins
+    # Plugin used to interact with Meshtastic nodes
+    module Meshtastic
+      # Supported Method Parameters::
+      # mqtt_obj = PWN::Plugins::Meshtastic.connect(
+      #   host: 'optional - mqtt host (default: mqtt.meshtastic.org)',
+      #   port: 'optional - mqtt port (defaults: 1883)',
+      #   username: 'optional - mqtt username (default: meshdev)',
+      #   password: 'optional - (default: large4cats)'
+      # )
+
+      public_class_method def self.connect(opts = {})
+        # Publicly available MQTT server / credentials by default
+        host = opts[:host] ||= 'mqtt.meshtastic.org'
+        port = opts[:port] ||= 1883
+        username = opts[:username] ||= 'meshdev'
+        password = opts[:password] ||= 'large4cats'
+
+        mqtt_obj = MQTT::Client.connect(
+          host: host,
+          port: port,
+          username: username,
+          password: password
+        )
+
+        mqtt_obj.client_id = SecureRandom.random_bytes(8).unpack1('H*')
+
+        mqtt_obj
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # PWN::Plugins::Meshtastic.subscribe(
+      #   mqtt_obj: 'required - mqtt_obj returned from #connect method'
+      #   region: 'optional - region (default: US)',
+      #   channel: 'optional - channel name (default: LongFast)',
+      #   psk: 'optional - channel pre-shared key (default: AQ==)',
+      #   qos: 'optional - quality of service (default: 0)',
+      #   json: 'optional - JSON output (default: false)'
+      # )
+
+      public_class_method def self.subscribe(opts = {})
+        mqtt_obj = opts[:mqtt_obj]
+        region = opts[:region] ||= 'US'
+        channel = opts[:channel] ||= 'LongFast'
+        psk = opts[:psk] ||= 'AQ=='
+        qos = opts[:qos] ||= 0
+        json = opts[:json] ||= false
+
+        # TODO: Find JSON URI for this
+        root_topic = "msh/#{region}/2/json" if json
+        # root_topic = "msh/#{region}/2/e" unless json
+        root_topic = "msh/#{region}/2/c" unless json
+        mqtt_obj.subscribe("#{root_topic}/#{channel}/#", qos)
+
+        # Decrypt the message
+        # Our AES key is 128 or 256 bits, shared as part of the 'Channel' specification.
+
+        # Actual pre-shared key for LongFast channel
+        psk = '1PG7OiApB1nwvP+rz05pAQ==' if channel == 'LongFast'
+        padded_psk = psk.ljust(psk.length + ((4 - (psk.length % 4)) % 4), '=')
+        replaced_psk = padded_psk.gsub('-', '+').gsub('_', '/')
+        psk = replaced_psk
+        dec_psk = Base64.strict_decode64(psk)
+
+        # cipher = OpenSSL::Cipher.new('AES-256-CTR')
+        cipher = OpenSSL::Cipher.new('AES-128-CTR')
+
+        if json
+          mqtt_obj.get_packet do |json_packet|
+            puts '-' * 80
+            packet = JSON.parse(json_packet.payload, symbolize_names: true)
+            puts JSON.pretty_generate(packet)
+            puts '-' * 80
+            puts "\n\n\n"
+          end
+        else
+          mqtt_obj.get_packet do |packet|
+            puts '-' * 80
+
+            payload = packet.payload.to_s
+
+            # Convert raw packet to hex-escaped bytes
+            # puts "PSK: #{psk.inspect} | Length: #{psk.length}"
+            # puts "Dec PSK: #{dec_psk.inspect} | Length: #{dec_psk.length}"
+            packet_from_backwards = payload[3..6]
+            if packet_from_backwards
+              packet_from_str = packet_from_backwards.reverse
+              packet_from_hex = packet_from_str.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              packet_from = packet_from_hex.to_i(16)
+              puts "\nFrom: #{packet_from_str.inspect} >> #{packet_from_hex} >> #{packet_from}"
+            end
+
+            packet_to_backwards = payload[8..11]
+            if packet_to_backwards
+              packet_to_str = packet_to_backwards.reverse
+              packet_to_hex = packet_to_str.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              packet_to = packet_to_hex.to_i(16)
+              puts "To: #{packet_to_str.inspect} >> #{packet_to_hex} >> #{packet_to}"
+            end
+
+            mystery_byte = payload[12]
+            if mystery_byte
+              mystery_hex = mystery_byte.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              mystery = mystery_hex.to_i(16)
+              puts "Mystery 1: #{mystery_byte.inspect} >> #{mystery_hex} >> #{mystery}"
+            end
+
+            msg_len = 0
+            msg_len_byte = payload[13]
+            if msg_len_byte
+              msg_len_hex = msg_len_byte.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              msg_len = msg_len_hex.to_i(16)
+            end
+            puts "Message Length: #{msg_len_byte.inspect} >> #{msg_len}"
+
+            channel_byte = payload[14]
+            if channel_byte
+              channel_hex = channel_byte.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              channel = channel_hex.to_i(16)
+              puts "Channel: #{channel_byte.inspect} >> #{channel_hex} >> #{channel}"
+            end
+
+            mystery_byte = payload[15]
+            if mystery_byte
+              mystery_hex = mystery_byte.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              mystery = mystery_hex.to_i(16)
+              puts "Mystery 2: #{mystery_byte.inspect} >> #{mystery_hex} >> #{mystery}"
+            end
+
+            pid_id_backwards = payload.b[-34..-31]
+            if pid_id_backwards
+              pid_str = pid_id_backwards.reverse
+              pid_hex = pid_str.bytes.map { |byte| byte.to_s(16).rjust(2, '0') }.join
+              packet_id = pid_hex.to_i(16)
+              puts "ID: #{pid_str.inspect} >> #{pid_hex} >> #{packet_id}"
+            end
+
+            topic = packet.topic
+            puts "\nTopic: #{topic}"
+
+            if msg_len.positive?
+              begin
+                puts "Payload: #{payload.inspect}"
+                puts "Payload Length: #{payload.length}"
+
+                nonce_packet_id = [packet_id].pack('V').ljust(8, "\x00")
+                nonce_from_node = [packet_from].pack('V').ljust(8, "\x00")
+                # puts "Nonce from Node: #{nonce_from_node.inspect} | Length: #{nonce_from_node.length}"
+                nonce = "#{nonce_packet_id}#{nonce_from_node}".b
+                puts "Nonce: #{nonce.inspect} | Length: #{nonce.length}"
+
+                # Decrypt the message
+                # Key must be 32 bytes
+                # IV mustr be 16 bytes
+                cipher.decrypt
+                cipher.key = dec_psk
+                cipher.iv = nonce
+                first_byte = 16
+                last_byte = first_byte + msg_len - 1
+                encrypted_payload = payload[first_byte..last_byte]
+                puts "\nEncrypted Payload:\n#{encrypted_payload.inspect}"
+                puts "Length: #{encrypted_payload.length}" if encrypted_payload
+
+                decrypted = cipher.update(encrypted_payload) + cipher.final
+                puts "\nDecrypted Payload:\n#{decrypted.inspect}"
+                puts "Length: #{decrypted.length}" if decrypted
+              rescue StandardError => e
+                puts "Error decrypting message: #{e}"
+              end
+            end
+            raw_packet = packet.to_s.b
+            puts "\nRaw Packet: #{raw_packet.inspect}"
+            puts "Length: #{packet.to_s.length}"
+            puts '-' * 80
+            puts "\n\n\n"
+          end
+        end
+      rescue Interrupt
+        puts "\nCTRL+C detected. Exiting..."
+      rescue StandardError => e
+        raise e
+      ensure
+        mqtt_obj.disconnect if mqtt_obj
+      end
+
+      # Supported Method Parameters::
+      # mqtt_obj = PWN::Plugins::Meshtastic.gps_search(
+      #   lat: 'required - latitude float (e.g. 37.7749)',
+      #   lon: 'required - longitude float (e.g. -122.4194)',
+      # )
+      public_class_method def self.gps_search(opts = {})
+        lat = opts[:lat]
+        lon = opts[:lon]
+
+        raise 'ERROR: Latitude and Longitude are required' unless lat && lon
+
+        gps_arr = [lat.to_f, lon.to_f]
+
+        Geocoder.search(gps_arr)
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # mqtt_obj = PWN::Plugins::Meshtastic.disconnect(
+      #   mqtt_obj: 'required - mqtt_obj returned from #connect method'
+      # )
+      public_class_method def self.disconnect(opts = {})
+        mqtt_obj = opts[:mqtt_obj]
+
+        mqtt_obj.disconnect if mqtt_obj
+        nil
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <request.pentest@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <request.pentest@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          mqtt_obj = #{self}.connect(
+            host: 'optional - mqtt host (default: mqtt.meshtastic.org)',
+            port: 'optional - mqtt port (defaults: 1883)',
+            username: 'optional - mqtt username (default: meshdev)',
+            password: 'optional - (default: large4cats)'
+          )
+
+          #{self}.subscribe(
+            mqtt_obj: 'required - mqtt_obj object returned from #connect method',
+            region: 'optional - region (default: US)',
+            channel: 'optional - channel name (default: LongFast)',
+            psk: 'optional - channel pre-shared key (default: AQ==)',
+            qos: 'optional - quality of service (default: 0)'
+          )
+
+          mqtt_obj = #{self}.disconnect(
+            mqtt_obj: 'required - mqtt_obj object returned from #connect method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end

data/lib/pwn/plugins/repl.rb

@@ -135,6 +135,7 @@ module PWN
 
           def process
             pi = pry_instance
+            pi.config.color = true
             pi.config.pwn_asm = false if pi.config.pwn_asm
             pi.config.pwn_ai = false if pi.config.pwn_ai
             pi.config.pwn_ai_debug = false if pi.config.pwn_ai_debug

data/lib/pwn/plugins.rb

@@ -37,6 +37,7 @@ module PWN
     autoload :JSONPathify, 'pwn/plugins/json_pathify'
     autoload :Log, 'pwn/plugins/log'
     autoload :MailAgent, 'pwn/plugins/mail_agent'
+    autoload :Meshtastic, 'pwn/plugins/meshtastic'
     autoload :Metasploit, 'pwn/plugins/metasploit'
     autoload :MonkeyPatch, 'pwn/plugins/monkey_patch'
     autoload :MSR206, 'pwn/plugins/msr206'

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.83'
+  VERSION = '0.5.84'
 end

data/spec/lib/pwn/plugins/meshtastic_spec.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Meshtastic do
+  it 'should display information for authors' do
+    authors_response = PWN::Plugins::Meshtastic
+    expect(authors_response).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    help_response = PWN::Plugins::Meshtastic
+    expect(help_response).to respond_to :help
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.83
+  version: 0.5.84
 platform: ruby
 authors:
 - 0day Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-04-16 00:00:00.000000000 Z
+date: 2024-04-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -290,6 +290,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.4.0
+- !ruby/object:Gem::Dependency
+  name: geocoder
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.8.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.8.2
 - !ruby/object:Gem::Dependency
   name: gist
   requirement: !ruby/object:Gem::Requirement
@@ -422,14 +436,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.4
+        version: 0.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.4
+        version: 0.7.1
 - !ruby/object:Gem::Dependency
   name: luhn
   requirement: !ruby/object:Gem::Requirement
@@ -472,6 +486,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.0.5
+- !ruby/object:Gem::Dependency
+  name: mqtt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.6.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.6.0
 - !ruby/object:Gem::Dependency
   name: msfrpc-client
   requirement: !ruby/object:Gem::Requirement
@@ -739,19 +767,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.5.5
 - !ruby/object:Gem::Dependency
-  name: rbvmomi
+  name: rbvmomi2
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 3.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: 3.7.1
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
@@ -856,14 +884,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.63.2
+        version: 1.63.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.63.2
+        version: 1.63.3
 - !ruby/object:Gem::Dependency
   name: rubocop-rake
   requirement: !ruby/object:Gem::Requirement
@@ -1038,14 +1066,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.7.3
+        version: 2.0.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.7.3
+        version: 2.0.1
 - !ruby/object:Gem::Dependency
   name: thin
   requirement: !ruby/object:Gem::Requirement
@@ -1767,6 +1795,7 @@ files:
 - lib/pwn/plugins/json_pathify.rb
 - lib/pwn/plugins/log.rb
 - lib/pwn/plugins/mail_agent.rb
+- lib/pwn/plugins/meshtastic.rb
 - lib/pwn/plugins/metasploit.rb
 - lib/pwn/plugins/monkey_patch.rb
 - lib/pwn/plugins/msr206.rb
@@ -2097,6 +2126,7 @@ files:
 - spec/lib/pwn/plugins/json_pathify_spec.rb
 - spec/lib/pwn/plugins/log_spec.rb
 - spec/lib/pwn/plugins/mail_agent_spec.rb
+- spec/lib/pwn/plugins/meshtastic_spec.rb
 - spec/lib/pwn/plugins/metasploit_spec.rb
 - spec/lib/pwn/plugins/monkey_patch_spec.rb
 - spec/lib/pwn/plugins/msr206_spec.rb