ronin-exploits 1.0.0 → 1.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/ruby.yml +14 -0
- data/.rubocop.yml +61 -0
- data/ChangeLog.md +13 -2
- data/Gemfile +5 -1
- data/Rakefile +3 -1
- data/bin/ronin-exploits +6 -7
- data/gemspec.yml +3 -3
- data/lib/ronin/exploits/advisory.rb +1 -0
- data/lib/ronin/exploits/cli/command.rb +1 -0
- data/lib/ronin/exploits/cli/commands/irb.rb +1 -0
- data/lib/ronin/exploits/cli/commands/list.rb +1 -0
- data/lib/ronin/exploits/cli/commands/new.rb +12 -1
- data/lib/ronin/exploits/cli/commands/run.rb +40 -21
- data/lib/ronin/exploits/cli/commands/show.rb +11 -8
- data/lib/ronin/exploits/cli/exploit_command.rb +4 -0
- data/lib/ronin/exploits/cli/exploit_methods.rb +4 -0
- data/lib/ronin/exploits/cli/ruby_shell.rb +1 -0
- data/lib/ronin/exploits/cli.rb +1 -0
- data/lib/ronin/exploits/client_side_web_vuln.rb +1 -0
- data/lib/ronin/exploits/exceptions.rb +1 -0
- data/lib/ronin/exploits/exploit.rb +20 -16
- data/lib/ronin/exploits/heap_overflow.rb +1 -0
- data/lib/ronin/exploits/lfi.rb +6 -6
- data/lib/ronin/exploits/loot/file.rb +2 -1
- data/lib/ronin/exploits/loot.rb +1 -0
- data/lib/ronin/exploits/memory_corruption.rb +1 -0
- data/lib/ronin/exploits/metadata/arch.rb +4 -0
- data/lib/ronin/exploits/metadata/cookie_param.rb +4 -0
- data/lib/ronin/exploits/metadata/default_filename.rb +4 -0
- data/lib/ronin/exploits/metadata/default_port.rb +4 -0
- data/lib/ronin/exploits/metadata/header_name.rb +4 -0
- data/lib/ronin/exploits/metadata/os.rb +4 -0
- data/lib/ronin/exploits/metadata/shouts.rb +17 -9
- data/lib/ronin/exploits/metadata/url_path.rb +4 -0
- data/lib/ronin/exploits/metadata/url_query_param.rb +4 -0
- data/lib/ronin/exploits/mixins/binary.rb +1 -0
- data/lib/ronin/exploits/mixins/file_builder.rb +3 -2
- data/lib/ronin/exploits/mixins/format_string.rb +4 -3
- data/lib/ronin/exploits/mixins/has_payload.rb +4 -3
- data/lib/ronin/exploits/mixins/has_targets.rb +1 -0
- data/lib/ronin/exploits/mixins/html.rb +4 -0
- data/lib/ronin/exploits/mixins/http.rb +24 -19
- data/lib/ronin/exploits/mixins/loot.rb +3 -2
- data/lib/ronin/exploits/mixins/nops.rb +4 -4
- data/lib/ronin/exploits/mixins/remote_tcp.rb +2 -1
- data/lib/ronin/exploits/mixins/remote_udp.rb +1 -0
- data/lib/ronin/exploits/mixins/seh.rb +1 -0
- data/lib/ronin/exploits/mixins/stack_overflow.rb +2 -1
- data/lib/ronin/exploits/mixins/text.rb +1 -0
- data/lib/ronin/exploits/mixins.rb +1 -0
- data/lib/ronin/exploits/open_redirect.rb +5 -4
- data/lib/ronin/exploits/params/base_url.rb +1 -0
- data/lib/ronin/exploits/params/bind_host.rb +1 -0
- data/lib/ronin/exploits/params/bind_port.rb +1 -0
- data/lib/ronin/exploits/params/filename.rb +3 -2
- data/lib/ronin/exploits/params/host.rb +1 -0
- data/lib/ronin/exploits/params/port.rb +3 -2
- data/lib/ronin/exploits/registry.rb +4 -0
- data/lib/ronin/exploits/rfi.rb +9 -6
- data/lib/ronin/exploits/root.rb +1 -0
- data/lib/ronin/exploits/seh_overflow.rb +9 -8
- data/lib/ronin/exploits/sqli.rb +11 -10
- data/lib/ronin/exploits/ssti.rb +5 -4
- data/lib/ronin/exploits/stack_overflow.rb +9 -8
- data/lib/ronin/exploits/target.rb +1 -0
- data/lib/ronin/exploits/test_result.rb +2 -1
- data/lib/ronin/exploits/use_after_free.rb +1 -0
- data/lib/ronin/exploits/version.rb +2 -1
- data/lib/ronin/exploits/web.rb +1 -0
- data/lib/ronin/exploits/web_vuln.rb +1 -0
- data/lib/ronin/exploits/xss.rb +5 -4
- data/lib/ronin/exploits.rb +1 -0
- data/man/ronin-exploits-irb.1 +1 -1
- data/man/ronin-exploits-irb.1.md +1 -1
- data/man/ronin-exploits-list.1 +1 -1
- data/man/ronin-exploits-list.1.md +1 -1
- data/man/ronin-exploits-new.1 +1 -1
- data/man/ronin-exploits-new.1.md +2 -2
- data/man/ronin-exploits-run.1 +1 -1
- data/man/ronin-exploits-run.1.md +1 -1
- data/man/ronin-exploits-show.1 +1 -1
- data/man/ronin-exploits-show.1.md +1 -1
- data/man/ronin-exploits.1 +1 -1
- data/man/ronin-exploits.1.md +1 -1
- data/ronin-exploits.gemspec +4 -3
- metadata +21 -2
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,26 +31,26 @@ module Ronin
|
|
30
31
|
#
|
31
32
|
# require 'ronin/exploits/seh_overflow'
|
32
33
|
# require 'ronin/exploits/mixins/remote_tcp'
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# module Ronin
|
35
36
|
# module Exploits
|
36
37
|
# class MyExploit < SEHOverflow
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# register 'my_exploit'
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# include Mixins::RemoteTCP
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# def build
|
43
44
|
# nseh = 0x06eb9090 # short jump 6 bytes
|
44
45
|
# seh = 0x1001ae86 # pop pop ret 1001AE86 SSLEAY32.DLL
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# @buffer = seh_buffer_overflow(length: 1024, nops: 16, payload: payload, nseh: nseh, seh: seh)
|
47
48
|
# end
|
48
|
-
#
|
49
|
+
#
|
49
50
|
# def launch
|
50
51
|
# tcp_send "USER #{@buffer}"
|
51
52
|
# end
|
52
|
-
#
|
53
|
+
#
|
53
54
|
# end
|
54
55
|
# end
|
55
56
|
# end
|
@@ -59,7 +60,7 @@ module Ronin
|
|
59
60
|
# def build
|
60
61
|
# nseh = 0x06eb9090 # short jump 6 bytes
|
61
62
|
# seh = 0x1001ae86 # pop pop ret 1001AE86 SSLEAY32.DLL
|
62
|
-
#
|
63
|
+
#
|
63
64
|
# @buffer = junk(1024) + seh_record(nseh,seh) + nops(16) + payload
|
64
65
|
# end
|
65
66
|
#
|
data/lib/ronin/exploits/sqli.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -34,17 +35,17 @@ module Ronin
|
|
34
35
|
# ## Example
|
35
36
|
#
|
36
37
|
# require 'ronin/exploits/sqli'
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# module Ronin
|
39
40
|
# module Exploits
|
40
41
|
# class MyExploit < SQLI
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# register 'my_exploit'
|
43
|
-
#
|
44
|
+
#
|
44
45
|
# base_path '/path/to/page.php'
|
45
46
|
# query_param 'id'
|
46
47
|
# escape_quote true
|
47
|
-
#
|
48
|
+
#
|
48
49
|
# end
|
49
50
|
# end
|
50
51
|
# end
|
@@ -87,10 +88,10 @@ module Ronin
|
|
87
88
|
# Specifies whether to escape quotation marks.
|
88
89
|
#
|
89
90
|
def self.escape_quote(new_escape_quote=nil)
|
90
|
-
if new_escape_quote
|
91
|
+
if !new_escape_quote.nil?
|
91
92
|
@escape_quote = new_escape_quote
|
92
93
|
else
|
93
|
-
if
|
94
|
+
if !@escape_quote.nil?
|
94
95
|
@escape_quote
|
95
96
|
elsif superclass < SQLI
|
96
97
|
superclass.escape_quote
|
@@ -110,10 +111,10 @@ module Ronin
|
|
110
111
|
# Specifies whether to escape parenthesis.
|
111
112
|
#
|
112
113
|
def self.escape_parens(new_escape_parens=nil)
|
113
|
-
if new_escape_parens
|
114
|
+
if !new_escape_parens.nil?
|
114
115
|
@escape_parens = new_escape_parens
|
115
116
|
else
|
116
|
-
if
|
117
|
+
if !@escape_parens.nil?
|
117
118
|
@escape_parens
|
118
119
|
elsif superclass < SQLI
|
119
120
|
superclass.escape_parens
|
@@ -133,10 +134,10 @@ module Ronin
|
|
133
134
|
# Specifies whether to terminate the injected SQL expression.
|
134
135
|
#
|
135
136
|
def self.terminate(new_terminate=nil)
|
136
|
-
if new_terminate
|
137
|
+
if !new_terminate.nil?
|
137
138
|
@terminate = new_terminate
|
138
139
|
else
|
139
|
-
if
|
140
|
+
if !@terminate.nil?
|
140
141
|
@terminate
|
141
142
|
elsif superclass < SQLI
|
142
143
|
superclass.terminate
|
data/lib/ronin/exploits/ssti.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -32,17 +33,17 @@ module Ronin
|
|
32
33
|
# ## Example
|
33
34
|
#
|
34
35
|
# require 'ronin/exploits/ssti'
|
35
|
-
#
|
36
|
+
#
|
36
37
|
# module Ronin
|
37
38
|
# module Exploits
|
38
39
|
# class MyExploit < SSTI
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# register 'my_exploit'
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# base_path '/path/to/page.php'
|
43
44
|
# query_param 'name'
|
44
45
|
# escape_expr ->(expr) { "${{#{expr}}}" }
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# end
|
47
48
|
# end
|
48
49
|
# end
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,26 +31,26 @@ module Ronin
|
|
30
31
|
#
|
31
32
|
# require 'ronin/exploits/stack_overflow'
|
32
33
|
# require 'ronin/exploits/mixins/remote_tcp'
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# module Ronin
|
35
36
|
# module Exploits
|
36
37
|
# class MyExploit < StackOverflow
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# register 'my_exploit'
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# include Mixins::RemoteTCP
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# def build
|
43
44
|
# ebp = 0x06eb9090
|
44
45
|
# eip = 0x1001ae86
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# @buffer = buffer_overflow(length: 1024, nops: 16, payload: payload, bp: ebp, ip: eip)
|
47
48
|
# end
|
48
|
-
#
|
49
|
+
#
|
49
50
|
# def launch
|
50
51
|
# tcp_send "USER #{@buffer}"
|
51
52
|
# end
|
52
|
-
#
|
53
|
+
#
|
53
54
|
# end
|
54
55
|
# end
|
55
56
|
# end
|
@@ -59,7 +60,7 @@ module Ronin
|
|
59
60
|
# def build
|
60
61
|
# ebp = 0x06eb9090
|
61
62
|
# eip = 0x1001ae86
|
62
|
-
#
|
63
|
+
#
|
63
64
|
# @buffer = junk(1024) + nops(16) + payload + stack_frame(ebp,eip)
|
64
65
|
# end
|
65
66
|
#
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,7 +31,7 @@ module Ronin
|
|
30
31
|
class TestResult
|
31
32
|
|
32
33
|
# The descriptive message of the test result.
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# @api public
|
35
36
|
attr_reader :message
|
36
37
|
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -21,6 +22,6 @@
|
|
21
22
|
module Ronin
|
22
23
|
module Exploits
|
23
24
|
# ronin-exploits version
|
24
|
-
VERSION = '1.0.
|
25
|
+
VERSION = '1.0.1'
|
25
26
|
end
|
26
27
|
end
|
data/lib/ronin/exploits/web.rb
CHANGED
data/lib/ronin/exploits/xss.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -35,16 +36,16 @@ module Ronin
|
|
35
36
|
# ## Example
|
36
37
|
#
|
37
38
|
# require 'ronin/exploits/xss'
|
38
|
-
#
|
39
|
+
#
|
39
40
|
# module Ronin
|
40
41
|
# module Exploits
|
41
42
|
# class MyExploit < XSS
|
42
|
-
#
|
43
|
+
#
|
43
44
|
# register 'my_exploit'
|
44
|
-
#
|
45
|
+
#
|
45
46
|
# base_path '/path/to/page.php'
|
46
47
|
# query_param 'title'
|
47
|
-
#
|
48
|
+
#
|
48
49
|
# end
|
49
50
|
# end
|
50
51
|
# end
|
data/lib/ronin/exploits.rb
CHANGED
data/man/ronin-exploits-irb.1
CHANGED
data/man/ronin-exploits-irb.1.md
CHANGED
data/man/ronin-exploits-list.1
CHANGED
data/man/ronin-exploits-new.1
CHANGED
data/man/ronin-exploits-new.1.md
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
# ronin-exploits-new 1 "
|
1
|
+
# ronin-exploits-new 1 "2023-02-01" Ronin "User Manuals"
|
2
2
|
|
3
3
|
## SYNOPSIS
|
4
4
|
|
@@ -57,7 +57,7 @@ Creates a new exploit file.
|
|
57
57
|
|
58
58
|
`-V`, `--software-version` *VERSION*
|
59
59
|
The software version to target.
|
60
|
-
|
60
|
+
|
61
61
|
`-L`, `--loot`
|
62
62
|
Adds the loot mixin.
|
63
63
|
|
data/man/ronin-exploits-run.1
CHANGED
data/man/ronin-exploits-run.1.md
CHANGED
data/man/ronin-exploits-show.1
CHANGED
data/man/ronin-exploits.1
CHANGED
data/man/ronin-exploits.1.md
CHANGED
data/ronin-exploits.gemspec
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
#
|
1
|
+
# frozen_string_literal: true
|
2
2
|
|
3
3
|
require 'yaml'
|
4
4
|
|
@@ -22,7 +22,7 @@ Gem::Specification.new do |gem|
|
|
22
22
|
gem.homepage = gemspec['homepage']
|
23
23
|
gem.metadata = gemspec['metadata'] if gemspec['metadata']
|
24
24
|
|
25
|
-
glob =
|
25
|
+
glob = ->(patterns) { gem.files & Dir[*patterns] }
|
26
26
|
|
27
27
|
gem.files = `git ls-files`.split($/)
|
28
28
|
gem.files = glob[gemspec['files']] if gemspec['files']
|
@@ -33,6 +33,7 @@ Gem::Specification.new do |gem|
|
|
33
33
|
gem.executables = gemspec.fetch('executables') do
|
34
34
|
glob['bin/*'].map { |path| File.basename(path) }
|
35
35
|
end
|
36
|
+
|
36
37
|
gem.default_executable = gem.executables.first if Gem::VERSION < '1.7.'
|
37
38
|
|
38
39
|
gem.extensions = glob[gemspec['extensions'] || 'ext/**/extconf.rb']
|
@@ -47,7 +48,7 @@ Gem::Specification.new do |gem|
|
|
47
48
|
gem.required_rubygems_version = gemspec['required_rubygems_version']
|
48
49
|
gem.post_install_message = gemspec['post_install_message']
|
49
50
|
|
50
|
-
split =
|
51
|
+
split = ->(string) { string.split(/,\s*/) }
|
51
52
|
|
52
53
|
if gemspec['dependencies']
|
53
54
|
gemspec['dependencies'].each do |name,versions|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: ronin-exploits
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Postmodern
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-02
|
11
|
+
date: 2023-03-02 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: uri-query_params
|
@@ -31,6 +31,9 @@ dependencies:
|
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
33
|
version: '1.0'
|
34
|
+
- - ">="
|
35
|
+
- !ruby/object:Gem::Version
|
36
|
+
version: 1.0.1
|
34
37
|
type: :runtime
|
35
38
|
prerelease: false
|
36
39
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -38,6 +41,9 @@ dependencies:
|
|
38
41
|
- - "~>"
|
39
42
|
- !ruby/object:Gem::Version
|
40
43
|
version: '1.0'
|
44
|
+
- - ">="
|
45
|
+
- !ruby/object:Gem::Version
|
46
|
+
version: 1.0.1
|
41
47
|
- !ruby/object:Gem::Dependency
|
42
48
|
name: ronin-code-sql
|
43
49
|
requirement: !ruby/object:Gem::Requirement
|
@@ -59,6 +65,9 @@ dependencies:
|
|
59
65
|
- - "~>"
|
60
66
|
- !ruby/object:Gem::Version
|
61
67
|
version: '0.1'
|
68
|
+
- - ">="
|
69
|
+
- !ruby/object:Gem::Version
|
70
|
+
version: 0.1.1
|
62
71
|
type: :runtime
|
63
72
|
prerelease: false
|
64
73
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -66,6 +75,9 @@ dependencies:
|
|
66
75
|
- - "~>"
|
67
76
|
- !ruby/object:Gem::Version
|
68
77
|
version: '0.1'
|
78
|
+
- - ">="
|
79
|
+
- !ruby/object:Gem::Version
|
80
|
+
version: 0.1.1
|
69
81
|
- !ruby/object:Gem::Dependency
|
70
82
|
name: ronin-vulns
|
71
83
|
requirement: !ruby/object:Gem::Requirement
|
@@ -73,6 +85,9 @@ dependencies:
|
|
73
85
|
- - "~>"
|
74
86
|
- !ruby/object:Gem::Version
|
75
87
|
version: '0.1'
|
88
|
+
- - ">="
|
89
|
+
- !ruby/object:Gem::Version
|
90
|
+
version: 0.1.1
|
76
91
|
type: :runtime
|
77
92
|
prerelease: false
|
78
93
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -80,6 +95,9 @@ dependencies:
|
|
80
95
|
- - "~>"
|
81
96
|
- !ruby/object:Gem::Version
|
82
97
|
version: '0.1'
|
98
|
+
- - ">="
|
99
|
+
- !ruby/object:Gem::Version
|
100
|
+
version: 0.1.1
|
83
101
|
- !ruby/object:Gem::Dependency
|
84
102
|
name: ronin-post_ex
|
85
103
|
requirement: !ruby/object:Gem::Requirement
|
@@ -158,6 +176,7 @@ files:
|
|
158
176
|
- ".gitignore"
|
159
177
|
- ".mailmap"
|
160
178
|
- ".rspec"
|
179
|
+
- ".rubocop.yml"
|
161
180
|
- ".ruby-version"
|
162
181
|
- ".yardopts"
|
163
182
|
- COPYING.txt
|