ronin-exploits 0.3.1 → 1.0.0.beta2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (338) hide show
  1. checksums.yaml +7 -0
  2. data/.document +4 -0
  3. data/.editorconfig +11 -0
  4. data/.github/workflows/ruby.yml +31 -0
  5. data/.gitignore +13 -0
  6. data/.mailmap +1 -0
  7. data/.rspec +1 -0
  8. data/.ruby-version +1 -0
  9. data/.yardopts +1 -0
  10. data/COPYING.txt +161 -335
  11. data/{History.txt → ChangeLog.md} +119 -16
  12. data/Gemfile +50 -0
  13. data/README.md +454 -0
  14. data/Rakefile +37 -23
  15. data/bin/ronin-exploits +13 -6
  16. data/data/new/exploit.rb.erb +158 -0
  17. data/gemspec.yml +44 -0
  18. data/lib/ronin/exploits/advisory.rb +84 -0
  19. data/lib/ronin/exploits/cli/command.rb +39 -0
  20. data/lib/ronin/exploits/cli/commands/irb.rb +57 -0
  21. data/lib/ronin/exploits/cli/commands/list.rb +80 -0
  22. data/lib/ronin/exploits/cli/commands/new.rb +332 -0
  23. data/lib/ronin/exploits/cli/commands/run.rb +396 -0
  24. data/lib/ronin/exploits/cli/commands/show.rb +290 -0
  25. data/lib/ronin/exploits/cli/exploit_command.rb +114 -0
  26. data/lib/ronin/exploits/cli/exploit_methods.rb +114 -0
  27. data/lib/ronin/exploits/cli/ruby_shell.rb +51 -0
  28. data/lib/ronin/exploits/cli.rb +51 -0
  29. data/lib/ronin/exploits/client_side_web_vuln.rb +69 -0
  30. data/lib/ronin/exploits/exceptions.rb +27 -17
  31. data/lib/ronin/exploits/exploit.rb +501 -582
  32. data/lib/ronin/exploits/heap_overflow.rb +50 -0
  33. data/lib/ronin/exploits/lfi.rb +141 -0
  34. data/lib/ronin/exploits/loot/file.rb +113 -0
  35. data/lib/ronin/exploits/loot.rb +119 -0
  36. data/lib/ronin/exploits/memory_corruption.rb +53 -0
  37. data/lib/ronin/exploits/metadata/arch.rb +83 -0
  38. data/lib/ronin/exploits/metadata/cookie_param.rb +80 -0
  39. data/lib/ronin/exploits/metadata/default_filename.rb +69 -0
  40. data/lib/ronin/exploits/metadata/default_port.rb +69 -0
  41. data/lib/ronin/exploits/metadata/header_name.rb +80 -0
  42. data/lib/ronin/exploits/metadata/os.rb +117 -0
  43. data/lib/ronin/exploits/metadata/shouts.rb +85 -0
  44. data/lib/ronin/exploits/metadata/url_path.rb +82 -0
  45. data/lib/ronin/exploits/metadata/url_query_param.rb +80 -0
  46. data/lib/ronin/exploits/mixins/binary.rb +106 -0
  47. data/lib/ronin/exploits/mixins/build_dir.rb +61 -0
  48. data/lib/ronin/exploits/mixins/file_builder.rb +102 -0
  49. data/lib/ronin/exploits/mixins/format_string.rb +87 -0
  50. data/lib/ronin/exploits/mixins/has_payload.rb +202 -0
  51. data/lib/ronin/exploits/mixins/has_targets.rb +297 -0
  52. data/lib/ronin/exploits/mixins/html.rb +213 -0
  53. data/lib/ronin/exploits/mixins/http.rb +866 -0
  54. data/lib/ronin/exploits/mixins/loot.rb +84 -0
  55. data/lib/ronin/exploits/mixins/nops.rb +121 -0
  56. data/lib/ronin/exploits/mixins/remote_tcp.rb +272 -0
  57. data/lib/ronin/exploits/mixins/remote_udp.rb +264 -0
  58. data/lib/ronin/exploits/mixins/seh.rb +136 -0
  59. data/lib/ronin/exploits/mixins/stack_overflow.rb +124 -0
  60. data/lib/ronin/exploits/mixins/text.rb +65 -0
  61. data/lib/ronin/exploits/mixins.rb +32 -0
  62. data/lib/ronin/exploits/open_redirect.rb +103 -0
  63. data/lib/ronin/exploits/params/base_url.rb +84 -0
  64. data/lib/ronin/exploits/params/bind_host.rb +53 -0
  65. data/lib/ronin/exploits/params/bind_port.rb +53 -0
  66. data/lib/ronin/exploits/params/filename.rb +71 -0
  67. data/lib/ronin/exploits/params/host.rb +56 -0
  68. data/lib/ronin/exploits/params/port.rb +71 -0
  69. data/lib/ronin/exploits/registry.rb +32 -0
  70. data/lib/ronin/exploits/rfi.rb +106 -0
  71. data/lib/ronin/exploits/root.rb +28 -0
  72. data/lib/ronin/exploits/seh_overflow.rb +90 -0
  73. data/lib/ronin/exploits/sqli.rb +172 -0
  74. data/lib/ronin/exploits/ssti.rb +108 -0
  75. data/lib/ronin/exploits/stack_overflow.rb +90 -0
  76. data/lib/ronin/exploits/target.rb +63 -103
  77. data/lib/ronin/exploits/test_result.rb +80 -0
  78. data/lib/ronin/exploits/use_after_free.rb +50 -0
  79. data/lib/ronin/exploits/version.rb +11 -12
  80. data/lib/ronin/exploits/web.rb +18 -89
  81. data/lib/ronin/exploits/web_vuln.rb +378 -0
  82. data/lib/ronin/exploits/xss.rb +102 -0
  83. data/lib/ronin/exploits.rb +19 -26
  84. data/man/ronin-exploits-irb.1 +31 -0
  85. data/man/ronin-exploits-irb.1.md +22 -0
  86. data/man/ronin-exploits-list.1 +37 -0
  87. data/man/ronin-exploits-list.1.md +27 -0
  88. data/man/ronin-exploits-new.1 +98 -0
  89. data/man/ronin-exploits-new.1.md +73 -0
  90. data/man/ronin-exploits-run.1 +117 -0
  91. data/man/ronin-exploits-run.1.md +87 -0
  92. data/man/ronin-exploits-show.1 +45 -0
  93. data/man/ronin-exploits-show.1.md +33 -0
  94. data/man/ronin-exploits.1 +55 -0
  95. data/man/ronin-exploits.1.md +41 -0
  96. data/ronin-exploits.gemspec +62 -0
  97. data/spec/advisory_spec.rb +71 -0
  98. data/spec/cli/exploit_command_spec.rb +68 -0
  99. data/spec/cli/exploit_methods_spec.rb +208 -0
  100. data/spec/cli/ruby_shell_spec.rb +14 -0
  101. data/spec/client_side_web_vuln_spec.rb +117 -0
  102. data/spec/exploit_spec.rb +538 -0
  103. data/spec/exploits_spec.rb +3 -4
  104. data/spec/heap_overflow_spec.rb +14 -0
  105. data/spec/lfi_spec.rb +162 -0
  106. data/spec/loot/file_spec.rb +131 -0
  107. data/spec/loot_spec.rb +138 -0
  108. data/spec/memory_corruption_spec.rb +22 -0
  109. data/spec/metadata/arch_spec.rb +82 -0
  110. data/spec/metadata/cookie_param_spec.rb +67 -0
  111. data/spec/metadata/default_filename_spec.rb +62 -0
  112. data/spec/metadata/default_port_spec.rb +62 -0
  113. data/spec/metadata/header_name_spec.rb +67 -0
  114. data/spec/metadata/os_spec.rb +164 -0
  115. data/spec/metadata/shouts_spec.rb +100 -0
  116. data/spec/metadata/url_path_spec.rb +67 -0
  117. data/spec/metadata/url_query_param_spec.rb +67 -0
  118. data/spec/mixins/binary_spec.rb +129 -0
  119. data/spec/mixins/build_dir.rb +66 -0
  120. data/spec/mixins/file_builder_spec.rb +67 -0
  121. data/spec/mixins/format_string_spec.rb +44 -0
  122. data/spec/mixins/has_payload_spec.rb +333 -0
  123. data/spec/mixins/has_targets_spec.rb +434 -0
  124. data/spec/mixins/html_spec.rb +772 -0
  125. data/spec/mixins/http_spec.rb +1227 -0
  126. data/spec/mixins/loot_spec.rb +20 -0
  127. data/spec/mixins/nops_spec.rb +165 -0
  128. data/spec/mixins/remote_tcp_spec.rb +217 -0
  129. data/spec/mixins/remote_udp_spec.rb +217 -0
  130. data/spec/mixins/seh_spec.rb +89 -0
  131. data/spec/mixins/stack_overflow_spec.rb +87 -0
  132. data/spec/mixins/text_spec.rb +43 -0
  133. data/spec/open_redirect_spec.rb +71 -0
  134. data/spec/params/base_url_spec.rb +71 -0
  135. data/spec/params/bind_host_spec.rb +34 -0
  136. data/spec/params/bind_port_spec.rb +35 -0
  137. data/spec/params/filename_spec.rb +77 -0
  138. data/spec/params/host_spec.rb +34 -0
  139. data/spec/params/port_spec.rb +77 -0
  140. data/spec/rfi_spec.rb +107 -0
  141. data/spec/seh_overflow_spec.rb +18 -0
  142. data/spec/spec_helper.rb +6 -10
  143. data/spec/sqli_spec.rb +306 -0
  144. data/spec/ssti_spec.rb +121 -0
  145. data/spec/stack_overflow_spec.rb +18 -0
  146. data/spec/target_spec.rb +92 -0
  147. data/spec/test_result_spec.rb +32 -0
  148. data/spec/use_after_free_spec.rb +14 -0
  149. data/spec/web_spec.rb +12 -0
  150. data/spec/web_vuln_spec.rb +854 -0
  151. data/spec/xss_spec.rb +69 -0
  152. metadata +361 -324
  153. data/Manifest.txt +0 -196
  154. data/README.txt +0 -274
  155. data/bin/ronin-exploit +0 -12
  156. data/bin/ronin-gen-binary-payload +0 -12
  157. data/bin/ronin-gen-exploit +0 -12
  158. data/bin/ronin-gen-ftp-exploit +0 -12
  159. data/bin/ronin-gen-http-exploit +0 -12
  160. data/bin/ronin-gen-local-exploit +0 -12
  161. data/bin/ronin-gen-nops +0 -12
  162. data/bin/ronin-gen-payload +0 -12
  163. data/bin/ronin-gen-remote-exploit +0 -12
  164. data/bin/ronin-gen-remote-tcp-exploit +0 -12
  165. data/bin/ronin-gen-remote-udp-exploit +0 -12
  166. data/bin/ronin-gen-shellcode +0 -12
  167. data/bin/ronin-gen-web-exploit +0 -12
  168. data/bin/ronin-payload +0 -12
  169. data/bin/ronin-payloads +0 -12
  170. data/lib/ronin/controls/behaviors.rb +0 -133
  171. data/lib/ronin/controls/exceptions/not_implemented.rb +0 -27
  172. data/lib/ronin/controls/exceptions/program_not_found.rb +0 -27
  173. data/lib/ronin/controls/exceptions.rb +0 -23
  174. data/lib/ronin/controls/file_system.rb +0 -145
  175. data/lib/ronin/controls/helpers/command_exec.rb +0 -143
  176. data/lib/ronin/controls/helpers/dir_create.rb +0 -42
  177. data/lib/ronin/controls/helpers/dir_listing.rb +0 -62
  178. data/lib/ronin/controls/helpers/dir_remove.rb +0 -42
  179. data/lib/ronin/controls/helpers/file_ctime.rb +0 -52
  180. data/lib/ronin/controls/helpers/file_mtime.rb +0 -53
  181. data/lib/ronin/controls/helpers/file_ownership.rb +0 -53
  182. data/lib/ronin/controls/helpers/file_read.rb +0 -62
  183. data/lib/ronin/controls/helpers/file_remove.rb +0 -51
  184. data/lib/ronin/controls/helpers/file_write.rb +0 -62
  185. data/lib/ronin/controls/helpers/memory_read.rb +0 -39
  186. data/lib/ronin/controls/helpers/memory_write.rb +0 -39
  187. data/lib/ronin/controls/helpers.rb +0 -33
  188. data/lib/ronin/controls.rb +0 -23
  189. data/lib/ronin/exploits/control.rb +0 -47
  190. data/lib/ronin/exploits/exceptions/exception.rb +0 -27
  191. data/lib/ronin/exploits/exceptions/exploit_not_built.rb +0 -29
  192. data/lib/ronin/exploits/exceptions/payload_size.rb +0 -29
  193. data/lib/ronin/exploits/exceptions/restricted_char.rb +0 -29
  194. data/lib/ronin/exploits/exceptions/target_data_missing.rb +0 -29
  195. data/lib/ronin/exploits/exceptions/target_unspecified.rb +0 -29
  196. data/lib/ronin/exploits/exceptions/unknown_helper.rb +0 -29
  197. data/lib/ronin/exploits/exploit_author.rb +0 -33
  198. data/lib/ronin/exploits/ftp.rb +0 -42
  199. data/lib/ronin/exploits/helpers/binary.rb +0 -50
  200. data/lib/ronin/exploits/helpers/buffer_overflow.rb +0 -115
  201. data/lib/ronin/exploits/helpers/file_based.rb +0 -112
  202. data/lib/ronin/exploits/helpers/format_string.rb +0 -117
  203. data/lib/ronin/exploits/helpers/padding.rb +0 -101
  204. data/lib/ronin/exploits/helpers.rb +0 -26
  205. data/lib/ronin/exploits/http.rb +0 -49
  206. data/lib/ronin/exploits/local.rb +0 -40
  207. data/lib/ronin/exploits/remote.rb +0 -40
  208. data/lib/ronin/exploits/remote_tcp.rb +0 -87
  209. data/lib/ronin/exploits/remote_udp.rb +0 -87
  210. data/lib/ronin/exploits/targets/buffer_overflow.rb +0 -46
  211. data/lib/ronin/exploits/targets/format_string.rb +0 -43
  212. data/lib/ronin/exploits/targets.rb +0 -27
  213. data/lib/ronin/exploits/verifiers.rb +0 -121
  214. data/lib/ronin/generators/exploits/exploit.rb +0 -70
  215. data/lib/ronin/generators/exploits/ftp.rb +0 -42
  216. data/lib/ronin/generators/exploits/http.rb +0 -42
  217. data/lib/ronin/generators/exploits/local.rb +0 -42
  218. data/lib/ronin/generators/exploits/remote.rb +0 -42
  219. data/lib/ronin/generators/exploits/remote_tcp.rb +0 -44
  220. data/lib/ronin/generators/exploits/remote_udp.rb +0 -44
  221. data/lib/ronin/generators/exploits/static.rb +0 -30
  222. data/lib/ronin/generators/exploits/web.rb +0 -45
  223. data/lib/ronin/generators/exploits.rb +0 -23
  224. data/lib/ronin/generators/payloads/binary_payload.rb +0 -42
  225. data/lib/ronin/generators/payloads/nops.rb +0 -42
  226. data/lib/ronin/generators/payloads/payload.rb +0 -66
  227. data/lib/ronin/generators/payloads/shellcode.rb +0 -42
  228. data/lib/ronin/generators/payloads/static.rb +0 -30
  229. data/lib/ronin/generators/payloads.rb +0 -23
  230. data/lib/ronin/model/has_default_port.rb +0 -54
  231. data/lib/ronin/model/targets_arch.rb +0 -68
  232. data/lib/ronin/model/targets_os.rb +0 -69
  233. data/lib/ronin/model/targets_product.rb +0 -68
  234. data/lib/ronin/payloads/asm_payload.rb +0 -40
  235. data/lib/ronin/payloads/binary_payload.rb +0 -42
  236. data/lib/ronin/payloads/control.rb +0 -47
  237. data/lib/ronin/payloads/encoders/encoder.rb +0 -92
  238. data/lib/ronin/payloads/encoders/xor.rb +0 -79
  239. data/lib/ronin/payloads/encoders.rb +0 -32
  240. data/lib/ronin/payloads/exceptions/exception.rb +0 -27
  241. data/lib/ronin/payloads/exceptions/not_implemented.rb +0 -29
  242. data/lib/ronin/payloads/exceptions/unknown_helper.rb +0 -29
  243. data/lib/ronin/payloads/exceptions.rb +0 -23
  244. data/lib/ronin/payloads/has_payload.rb +0 -111
  245. data/lib/ronin/payloads/helpers/chained.rb +0 -61
  246. data/lib/ronin/payloads/helpers/rpc.rb +0 -93
  247. data/lib/ronin/payloads/helpers.rb +0 -23
  248. data/lib/ronin/payloads/nops.rb +0 -39
  249. data/lib/ronin/payloads/payload.rb +0 -350
  250. data/lib/ronin/payloads/payload_author.rb +0 -33
  251. data/lib/ronin/payloads/shellcode.rb +0 -40
  252. data/lib/ronin/payloads/web_payload.rb +0 -41
  253. data/lib/ronin/payloads.rb +0 -36
  254. data/lib/ronin/ui/command_line/commands/exploit.rb +0 -193
  255. data/lib/ronin/ui/command_line/commands/exploits.rb +0 -154
  256. data/lib/ronin/ui/command_line/commands/gen_binary_payload.rb +0 -34
  257. data/lib/ronin/ui/command_line/commands/gen_exploit.rb +0 -34
  258. data/lib/ronin/ui/command_line/commands/gen_ftp_exploit.rb +0 -34
  259. data/lib/ronin/ui/command_line/commands/gen_http_exploit.rb +0 -34
  260. data/lib/ronin/ui/command_line/commands/gen_local_exploit.rb +0 -34
  261. data/lib/ronin/ui/command_line/commands/gen_nops.rb +0 -34
  262. data/lib/ronin/ui/command_line/commands/gen_payload.rb +0 -34
  263. data/lib/ronin/ui/command_line/commands/gen_remote_exploit.rb +0 -34
  264. data/lib/ronin/ui/command_line/commands/gen_remote_tcp_exploit.rb +0 -34
  265. data/lib/ronin/ui/command_line/commands/gen_remote_udp_exploit.rb +0 -34
  266. data/lib/ronin/ui/command_line/commands/gen_shellcode.rb +0 -34
  267. data/lib/ronin/ui/command_line/commands/gen_web_exploit.rb +0 -34
  268. data/lib/ronin/ui/command_line/commands/payload.rb +0 -129
  269. data/lib/ronin/ui/command_line/commands/payloads.rb +0 -128
  270. data/lib/ronin/vuln/behavior.rb +0 -165
  271. data/spec/controls/behaviors_examples.rb +0 -38
  272. data/spec/exploits/binary_exploit_spec.rb +0 -44
  273. data/spec/exploits/buffer_overflow_exploit_spec.rb +0 -70
  274. data/spec/exploits/exploit_spec.rb +0 -313
  275. data/spec/exploits/file_based_exploit_spec.rb +0 -48
  276. data/spec/exploits/format_string_exploit_spec.rb +0 -32
  277. data/spec/exploits/ftp_spec.rb +0 -13
  278. data/spec/exploits/http_spec.rb +0 -17
  279. data/spec/exploits/padding_exploit_spec.rb +0 -44
  280. data/spec/exploits/remote_tcp_spec.rb +0 -28
  281. data/spec/exploits/remote_udp_spec.rb +0 -28
  282. data/spec/exploits/target_spec.rb +0 -98
  283. data/spec/exploits/targets/buffer_overflow_spec.rb +0 -22
  284. data/spec/exploits/web_spec.rb +0 -35
  285. data/spec/generators/exploits/exploit_examples.rb +0 -24
  286. data/spec/generators/exploits/exploit_spec.rb +0 -42
  287. data/spec/generators/exploits/ftp_spec.rb +0 -42
  288. data/spec/generators/exploits/http_spec.rb +0 -42
  289. data/spec/generators/exploits/local_spec.rb +0 -42
  290. data/spec/generators/exploits/remote_spec.rb +0 -42
  291. data/spec/generators/exploits/remote_tcp_spec.rb +0 -47
  292. data/spec/generators/exploits/remote_udp_spec.rb +0 -47
  293. data/spec/generators/exploits/web_spec.rb +0 -52
  294. data/spec/generators/payloads/binary_payload_spec.rb +0 -31
  295. data/spec/generators/payloads/nops_spec.rb +0 -31
  296. data/spec/generators/payloads/payload_examples.rb +0 -16
  297. data/spec/generators/payloads/payload_spec.rb +0 -31
  298. data/spec/generators/payloads/shellcode_spec.rb +0 -31
  299. data/spec/helpers/database.rb +0 -5
  300. data/spec/helpers/objects.rb +0 -22
  301. data/spec/model/has_default_port_spec.rb +0 -27
  302. data/spec/model/models/default_port_model.rb +0 -13
  303. data/spec/model/models/non_default_port_model.rb +0 -11
  304. data/spec/model/models/targets_arch_model.rb +0 -11
  305. data/spec/model/models/targets_os_model.rb +0 -11
  306. data/spec/model/models/targets_product_model.rb +0 -11
  307. data/spec/model/targets_arch_spec.rb +0 -32
  308. data/spec/model/targets_os_spec.rb +0 -33
  309. data/spec/model/targets_product_spec.rb +0 -35
  310. data/spec/objects/exploits/example.rb +0 -25
  311. data/spec/objects/exploits/simple.rb +0 -24
  312. data/spec/objects/payloads/simple.rb +0 -19
  313. data/spec/payloads/encoders/encoder_spec.rb +0 -30
  314. data/spec/payloads/encoders/xor_spec.rb +0 -20
  315. data/spec/payloads/payload_spec.rb +0 -156
  316. data/spec/vuln/behavior_spec.rb +0 -15
  317. data/static/ronin/generators/exploits/_cache.erb +0 -14
  318. data/static/ronin/generators/exploits/_header.erb +0 -1
  319. data/static/ronin/generators/exploits/_helpers.erb +0 -4
  320. data/static/ronin/generators/exploits/exploit.erb +0 -24
  321. data/static/ronin/generators/exploits/ftp.erb +0 -24
  322. data/static/ronin/generators/exploits/http.erb +0 -26
  323. data/static/ronin/generators/exploits/local.erb +0 -24
  324. data/static/ronin/generators/exploits/remote.erb +0 -24
  325. data/static/ronin/generators/exploits/remote_tcp.erb +0 -26
  326. data/static/ronin/generators/exploits/remote_udp.erb +0 -26
  327. data/static/ronin/generators/exploits/web.erb +0 -28
  328. data/static/ronin/generators/payloads/_cache.erb +0 -10
  329. data/static/ronin/generators/payloads/_header.erb +0 -1
  330. data/static/ronin/generators/payloads/_helpers.erb +0 -2
  331. data/static/ronin/generators/payloads/binary_payload.erb +0 -25
  332. data/static/ronin/generators/payloads/nops.erb +0 -19
  333. data/static/ronin/generators/payloads/payload.erb +0 -25
  334. data/static/ronin/generators/payloads/shellcode.erb +0 -25
  335. data/tasks/spec.rb +0 -10
  336. data/tasks/yard.rb +0 -13
  337. data.tar.gz.sig +0 -0
  338. metadata.gz.sig +0 -0
data/Rakefile CHANGED
@@ -1,26 +1,40 @@
1
- # -*- ruby -*-
2
-
3
1
  require 'rubygems'
4
- require 'hoe'
5
- require 'hoe/signing'
6
- require './tasks/spec.rb'
7
- require './tasks/yard.rb'
8
-
9
- Hoe.spec('ronin-exploits') do
10
- self.rubyforge_name = 'ronin'
11
- self.developer('Postmodern', 'postmodern.mod3@gmail.com')
12
- self.remote_rdoc_dir = 'docs/ronin-exploits'
13
- self.extra_deps = [
14
- ['ronin', '>=0.3.0'],
15
- ['ronin-gen', '>=0.2.0']
16
- ]
17
-
18
- self.extra_dev_deps = [
19
- ['rspec', '>=1.2.8'],
20
- ['yard', '>=0.2.3.5']
21
- ]
22
-
23
- self.spec_extras = {:has_rdoc => 'yard'}
2
+
3
+ begin
4
+ require 'bundler'
5
+ rescue LoadError => e
6
+ warn e.message
7
+ warn "Run `gem install bundler` to install Bundler."
8
+ exit -1
9
+ end
10
+
11
+ begin
12
+ Bundler.setup(:development)
13
+ rescue Bundler::BundlerError => e
14
+ warn e.message
15
+ warn "Run `bundle install` to install missing gems"
16
+ exit e.status_code
24
17
  end
25
18
 
26
- # vim: syntax=Ruby
19
+ require 'rake'
20
+
21
+ require 'rubygems/tasks'
22
+ Gem::Tasks.new(sign: {checksum: true, pgp: true})
23
+
24
+ require 'rspec/core/rake_task'
25
+ RSpec::Core::RakeTask.new
26
+
27
+ namespace :spec do
28
+ RSpec::Core::RakeTask.new(:network) do |t|
29
+ t.rspec_opts = '--tag network'
30
+ end
31
+ end
32
+
33
+ task :test => :spec
34
+ task :default => :spec
35
+
36
+ require 'yard'
37
+ YARD::Rake::YardocTask.new
38
+
39
+ require 'kramdown/man/task'
40
+ Kramdown::Man::Task.new
data/bin/ronin-exploits CHANGED
@@ -2,11 +2,18 @@
2
2
 
3
3
  require 'rubygems'
4
4
 
5
- lib_dir = File.expand_path(File.join(File.dirname(__FILE__),'..','lib'))
6
- unless $LOAD_PATH.include?(lib_dir)
7
- $LOAD_PATH << lib_dir
5
+ root = File.expand_path(File.join(File.dirname(__FILE__),'..'))
6
+ if File.file?(File.join(root,'Gemfile.lock'))
7
+ Dir.chdir(root) do
8
+ begin
9
+ require 'bundler/setup'
10
+ rescue LoadError => e
11
+ warn e.message
12
+ warn "Run `gem install bundler` to install Bundler"
13
+ exit -1
14
+ end
15
+ end
8
16
  end
9
17
 
10
- require 'ronin/ui/command_line/commands/exploits'
11
-
12
- Ronin::UI::CommandLine::Commands::Exploits.start
18
+ require 'ronin/exploits/cli'
19
+ Ronin::Exploits::CLI.start
@@ -0,0 +1,158 @@
1
+ #!/usr/bin/env -S ronin-exploits run -f
2
+
3
+ require 'ronin/exploits/<%= @exploit_type[:file] -%>'
4
+ <%- if @networking_mixin -%>
5
+ require 'ronin/exploits/mixins/<%= @networking_mixin[:file] -%>'
6
+ <%- end -%>
7
+ <%- if @target -%>
8
+ require 'ronin/exploits/mixins/has_target'
9
+ <%- end -%>
10
+ <%- if @has_payload -%>
11
+ require 'ronin/exploits/mixins/has_payload'
12
+ require 'ronin/payloads/<%= @has_payload[:file] -%>'
13
+ <%- end -%>
14
+ <%- if @loot -%>
15
+ require 'ronin/exploits/mixins/loot'
16
+ <%- end -%>
17
+
18
+ module Ronin
19
+ module Exploits
20
+ class <%= @class_name -%> < <%= @exploit_type[:class] %>
21
+ <%- if @networking_mixin || @has_payload || @target -%>
22
+
23
+ <%- if @networking_mixin -%>
24
+ include Mixins::<%= @networking_mixin[:module] %>
25
+ <%- end -%>
26
+ <%- if @has_payload -%>
27
+ include Mixins::HasPayload
28
+ <%- end -%>
29
+ <%- if @target -%>
30
+ include Mixins::HasTargets
31
+ <%- end -%>
32
+ <%- end -%>
33
+ <%- if @loot -%>
34
+ include Mixins::Loot
35
+ <%- end -%>
36
+
37
+ register '<%= @file_name -%>'
38
+
39
+ quality :poc
40
+ # release_date 'YYYY-MM-DD'
41
+ # disclosure_date 'YYYY-MM-DD'
42
+ <%- unless @advisories.empty? -%>
43
+ <%- @advisories.each do |advisory| -%>
44
+ advisory '<%= advisory -%>'
45
+ <%- end -%>
46
+ <%- else -%>
47
+ # advisory 'CVE-YYYY-NNNN'
48
+ # advisory 'GHSA-XXXXXX'
49
+ <%- end -%>
50
+
51
+ <%- if @author_email -%>
52
+ author '<%= @author_name %>', email: '<%= @author_email -%>'
53
+ <%- else -%>
54
+ author '<%= @author_name %>'
55
+ <%- end -%>
56
+ <%- if @summary -%>
57
+ summary "<%= @summary %>"
58
+ <%- else -%>
59
+ # summary "FIX ME"
60
+ <%- end -%>
61
+ <%- if @description -%>
62
+ description <<~DESC
63
+ <%= @description %>
64
+ DESC
65
+ <%- else -%>
66
+ # description <<~DESC
67
+ # FIX ME
68
+ # DESC
69
+ <%- end -%>
70
+ <%- unless @references.empty? -%>
71
+ references [
72
+ <%- @references.each do |url| -%>
73
+ <%= url.inspect -%><% if index < @references.length-1 %>,<% end %>
74
+ <%- end -%>
75
+ ]
76
+ <%- else -%>
77
+ # references [
78
+ # "https://...",
79
+ # "https://..."
80
+ # ]
81
+ <%- end -%>
82
+ <%- if web_vuln_exploit? -%>
83
+
84
+ <%- if @exploit_type[:class] == 'LFI' -%>
85
+ # depth 7
86
+ <%- elsif @exploit_type[:class] == 'SQLI' -%>
87
+ # escape_quote true
88
+ # escape_parens true
89
+ # terminate true
90
+ <%- elsif @exploit_type[:class] == 'SSTI' -%>
91
+ # escape_expr ->(expr) { "{{${expr}}}" }
92
+ <%- end -%>
93
+ <%- else -%>
94
+ <%- if @has_payload -%>
95
+
96
+ payload_class Payloads::<%= @has_payload[:class] %>
97
+ <%- end -%>
98
+ <%- if @target -%>
99
+
100
+ target <%= format_kwargs(@target) -%>
101
+
102
+ # target arch: '...', os: '...', software_version: '...' do |t|
103
+ # t.var1 = 'foo'
104
+ # t.var2 = 0x1234
105
+ # end
106
+ <%- end -%>
107
+
108
+ # #
109
+ # # Test whether the target systme is vulnerable.
110
+ # #
111
+ # def test
112
+ # # return Vulnerable('host is vulnerable')
113
+ # # return NotVulnerable('host is patched')
114
+ # # return Unknown('host may or may not be vulnerable')
115
+ # end
116
+
117
+ def build
118
+ <%- if stack_overflow_exploit? -%>
119
+ bp = 0x11223344
120
+ ip = 0xAABBCCEE
121
+
122
+ @buffer = buffer_overflow(length: 1024, nops: 16, payload: @payload, bp: bp, ip: ip)
123
+ <%- elsif seh_overflow_exploit? -%>
124
+ nseh = 0x11223344
125
+ seh = 0xAABBCCEE
126
+
127
+ @buffer = seh_buffer_overflow(length: 1024, nops: 16, payload: @payload, nseh: nseh, seh: seh)
128
+ <%- elsif @has_payload -%>
129
+ @buffer = "EXPLOIT #{@payload}"
130
+ <%- else -%>
131
+ @buffer = "EXPLOIT"
132
+ <%- end -%>
133
+ end
134
+
135
+ def launch
136
+ <%- case @networking -%>
137
+ <%- when :remote_tcp -%>
138
+ @socket = tcp_connect
139
+ @socket.write(@buffer)
140
+ <%- when :remote_udp -%>
141
+ @socket = udp_connect
142
+ @socket.write(@buffer)
143
+ <%- when :http -%>
144
+ http_get(query_params: {'foo' => @buffer})
145
+ <%- end -%>
146
+ end
147
+
148
+ def cleanup
149
+ <%- case @networking -%>
150
+ <%- when :remote_tcp, :remote_udp -%>
151
+ @socket.close
152
+ <%- end -%>
153
+ end
154
+ <%- end -%>
155
+
156
+ end
157
+ end
158
+ end
data/gemspec.yml ADDED
@@ -0,0 +1,44 @@
1
+ name: ronin-exploits
2
+ summary: A Ruby micro-framework for writing and running exploits and payloads.
3
+ description:
4
+ ronin-exploits is a Ruby micro-framework for writing and running exploits.
5
+ ronin-exploits allows one to write exploits as plain old Ruby classes.
6
+ ronin-exploits can be distributed as Ruby files or as git repositories that
7
+ can be installed using ronin-reps.
8
+
9
+ license: LGPL-3.0
10
+ authors: Postmodern
11
+ email: postmodern.mod3@gmail.com
12
+ homepage: https://ronin-rb.dev/exploits/
13
+ has_yard: true
14
+
15
+ required_ruby_version: ">= 3.0.0"
16
+
17
+ metadata:
18
+ documentation_uri: https://ronin-rb.dev/docs/ronin-exploits
19
+ source_code_uri: https://github.com/ronin-rb/ronin-exploits
20
+ bug_tracker_uri: https://github.com/ronin-rb/ronin-exploits/issues
21
+ changelog_uri: https://github.com/ronin-rb/ronin-exploits/blob/main/ChangeLog.md
22
+ rubygems_mfa_required: 'true'
23
+
24
+ generated_files:
25
+ - man/ronin-exploits.1
26
+ - man/ronin-exploits-irb.1
27
+ - man/ronin-exploits-list.1
28
+ - man/ronin-exploits-new.1
29
+ - man/ronin-exploits-run.1
30
+ - man/ronin-exploits-show.1
31
+
32
+ dependencies:
33
+ uri-query_params: ~> 0.6
34
+ # Ronin dependencies:
35
+ ronin-support: ~> 1.0.0.beta1
36
+ ronin-code-sql: ~> 2.0.0.beta1
37
+ ronin-payloads: ~> 0.1.0.beta1
38
+ ronin-vulns: ~> 0.1.0.beta1
39
+ ronin-post_ex: ~> 0.1.0.beta1
40
+ ronin-core: ~> 0.1.0.beta1
41
+ ronin-repos: ~> 0.1.0.beta1
42
+
43
+ development_dependencies:
44
+ bundler: ~> 2.0
@@ -0,0 +1,84 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ module Ronin
22
+ module Exploits
23
+ #
24
+ # Represents a security advisory.
25
+ #
26
+ # @api semipublic
27
+ #
28
+ # @since 1.0.0
29
+ #
30
+ class Advisory
31
+
32
+ # The advisory ID.
33
+ #
34
+ # @return [String]
35
+ attr_reader :id
36
+
37
+ # The advisory URL.
38
+ #
39
+ # @return [String]
40
+ attr_reader :url
41
+
42
+ #
43
+ # Initializes the advisory.
44
+ #
45
+ # @param [String] id
46
+ # The advisory ID.
47
+ #
48
+ # @param [String] url
49
+ # The advisory URL.
50
+ #
51
+ def initialize(id,url=self.class.url_for(id))
52
+ @id = id
53
+ @url = url
54
+ end
55
+
56
+ #
57
+ # Generates a default URL for the given advisory ID.
58
+ #
59
+ # @param [String] id
60
+ # The advisory ID.
61
+ #
62
+ # @return [String, nil]
63
+ # The URL for the advisory.
64
+ #
65
+ def self.url_for(id)
66
+ case id
67
+ when /\ACVE-/ then "https://nvd.nist.gov/vuln/detail/#{id}"
68
+ when /\AGHSA-/ then "https://github.com/advisories/#{id}"
69
+ end
70
+ end
71
+
72
+ #
73
+ # Converts the advisory to a String.
74
+ #
75
+ # @return [String]
76
+ # The advisory ID.
77
+ #
78
+ def to_s
79
+ @id.to_s
80
+ end
81
+
82
+ end
83
+ end
84
+ end
@@ -0,0 +1,39 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ require 'ronin/exploits/root'
22
+ require 'ronin/core/cli/command'
23
+
24
+ module Ronin
25
+ module Exploits
26
+ class CLI
27
+ #
28
+ # Base class for all `ronin-exploits` commands.
29
+ #
30
+ class Command < Core::CLI::Command
31
+
32
+ man_dir File.join(ROOT,'man')
33
+
34
+ bug_report_url 'https://github.com/ronin-rb/ronin-exploits/issues/new'
35
+
36
+ end
37
+ end
38
+ end
39
+ end
@@ -0,0 +1,57 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ require 'ronin/exploits/cli/exploit_command'
22
+ require 'ronin/exploits/cli/ruby_shell'
23
+
24
+ module Ronin
25
+ module Exploits
26
+ class CLI
27
+ module Commands
28
+ #
29
+ # Starts an interactive Ruby shell with `ronin-exploits` loaded.
30
+ #
31
+ # ## Usage
32
+ #
33
+ # ronin-exploits irb [options]
34
+ #
35
+ # ## Options
36
+ #
37
+ # -h, --help Print help information
38
+ #
39
+ class Irb < Command
40
+
41
+ description "Starts an interactive Ruby shell with ronin-exploits loaded"
42
+
43
+ man_page 'ronin-exploits-irb.1'
44
+
45
+ #
46
+ # Runs the `ronin-exploits irb` command.
47
+ #
48
+ def run
49
+ require 'ronin/exploits'
50
+ CLI::RubyShell.start
51
+ end
52
+
53
+ end
54
+ end
55
+ end
56
+ end
57
+ end
@@ -0,0 +1,80 @@
1
+ #
2
+ # ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
3
+ # payload crafting functionality.
4
+ #
5
+ # Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6
+ #
7
+ # ronin-exploits is free software: you can redistribute it and/or modify
8
+ # it under the terms of the GNU Lesser General Public License as published
9
+ # by the Free Software Foundation, either version 3 of the License, or
10
+ # (at your option) any later version.
11
+ #
12
+ # ronin-exploits is distributed in the hope that it will be useful,
13
+ # but WITHOUT ANY WARRANTY; without even the implied warranty of
14
+ # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
+ # GNU Lesser General Public License for more details.
16
+ #
17
+ # You should have received a copy of the GNU Lesser General Public License
18
+ # along with ronin-exploits. If not, see <https://www.gnu.org/licenses/>.
19
+ #
20
+
21
+ require 'ronin/exploits/cli/command'
22
+ require 'ronin/exploits/registry'
23
+
24
+ module Ronin
25
+ module Exploits
26
+ class CLI
27
+ module Commands
28
+ #
29
+ # Lists the available exploits.
30
+ #
31
+ # ## Usage
32
+ #
33
+ # ronin-exploits list [options] [NAME]
34
+ #
35
+ # ## Options
36
+ #
37
+ # -h, --help Print help information
38
+ #
39
+ # ## Arguments
40
+ #
41
+ # [NAME] The optional exploit name to list
42
+ #
43
+ class List < Command
44
+
45
+ usage '[options] [NAME]'
46
+
47
+ argument :name, required: false,
48
+ desc: 'The optional exploit name to list'
49
+
50
+ description 'Lists the available exploits'
51
+
52
+ man_page 'ronin-exploits-list.1'
53
+
54
+ #
55
+ # Runs the `ronin-exploits list` command.
56
+ #
57
+ # @param [String, nil] dir
58
+ # The optional exploit directory to list.
59
+ #
60
+ def run(dir=nil)
61
+ files = if dir
62
+ dir = "#{dir}/" unless name.end_with?('/')
63
+
64
+ Exploits.list_files.select do |file|
65
+ file.start_with?(dir)
66
+ end
67
+ else
68
+ Exploits.list_files
69
+ end
70
+
71
+ files.each do |file|
72
+ puts " #{file}"
73
+ end
74
+ end
75
+
76
+ end
77
+ end
78
+ end
79
+ end
80
+ end