ronin-exploits 1.0.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/ruby.yml +14 -0
- data/.rubocop.yml +61 -0
- data/ChangeLog.md +13 -2
- data/Gemfile +5 -1
- data/Rakefile +3 -1
- data/bin/ronin-exploits +6 -7
- data/gemspec.yml +3 -3
- data/lib/ronin/exploits/advisory.rb +1 -0
- data/lib/ronin/exploits/cli/command.rb +1 -0
- data/lib/ronin/exploits/cli/commands/irb.rb +1 -0
- data/lib/ronin/exploits/cli/commands/list.rb +1 -0
- data/lib/ronin/exploits/cli/commands/new.rb +12 -1
- data/lib/ronin/exploits/cli/commands/run.rb +40 -21
- data/lib/ronin/exploits/cli/commands/show.rb +11 -8
- data/lib/ronin/exploits/cli/exploit_command.rb +4 -0
- data/lib/ronin/exploits/cli/exploit_methods.rb +4 -0
- data/lib/ronin/exploits/cli/ruby_shell.rb +1 -0
- data/lib/ronin/exploits/cli.rb +1 -0
- data/lib/ronin/exploits/client_side_web_vuln.rb +1 -0
- data/lib/ronin/exploits/exceptions.rb +1 -0
- data/lib/ronin/exploits/exploit.rb +20 -16
- data/lib/ronin/exploits/heap_overflow.rb +1 -0
- data/lib/ronin/exploits/lfi.rb +6 -6
- data/lib/ronin/exploits/loot/file.rb +2 -1
- data/lib/ronin/exploits/loot.rb +1 -0
- data/lib/ronin/exploits/memory_corruption.rb +1 -0
- data/lib/ronin/exploits/metadata/arch.rb +4 -0
- data/lib/ronin/exploits/metadata/cookie_param.rb +4 -0
- data/lib/ronin/exploits/metadata/default_filename.rb +4 -0
- data/lib/ronin/exploits/metadata/default_port.rb +4 -0
- data/lib/ronin/exploits/metadata/header_name.rb +4 -0
- data/lib/ronin/exploits/metadata/os.rb +4 -0
- data/lib/ronin/exploits/metadata/shouts.rb +17 -9
- data/lib/ronin/exploits/metadata/url_path.rb +4 -0
- data/lib/ronin/exploits/metadata/url_query_param.rb +4 -0
- data/lib/ronin/exploits/mixins/binary.rb +1 -0
- data/lib/ronin/exploits/mixins/file_builder.rb +3 -2
- data/lib/ronin/exploits/mixins/format_string.rb +4 -3
- data/lib/ronin/exploits/mixins/has_payload.rb +4 -3
- data/lib/ronin/exploits/mixins/has_targets.rb +1 -0
- data/lib/ronin/exploits/mixins/html.rb +4 -0
- data/lib/ronin/exploits/mixins/http.rb +24 -19
- data/lib/ronin/exploits/mixins/loot.rb +3 -2
- data/lib/ronin/exploits/mixins/nops.rb +4 -4
- data/lib/ronin/exploits/mixins/remote_tcp.rb +2 -1
- data/lib/ronin/exploits/mixins/remote_udp.rb +1 -0
- data/lib/ronin/exploits/mixins/seh.rb +1 -0
- data/lib/ronin/exploits/mixins/stack_overflow.rb +2 -1
- data/lib/ronin/exploits/mixins/text.rb +1 -0
- data/lib/ronin/exploits/mixins.rb +1 -0
- data/lib/ronin/exploits/open_redirect.rb +5 -4
- data/lib/ronin/exploits/params/base_url.rb +1 -0
- data/lib/ronin/exploits/params/bind_host.rb +1 -0
- data/lib/ronin/exploits/params/bind_port.rb +1 -0
- data/lib/ronin/exploits/params/filename.rb +3 -2
- data/lib/ronin/exploits/params/host.rb +1 -0
- data/lib/ronin/exploits/params/port.rb +3 -2
- data/lib/ronin/exploits/registry.rb +4 -0
- data/lib/ronin/exploits/rfi.rb +9 -6
- data/lib/ronin/exploits/root.rb +1 -0
- data/lib/ronin/exploits/seh_overflow.rb +9 -8
- data/lib/ronin/exploits/sqli.rb +11 -10
- data/lib/ronin/exploits/ssti.rb +5 -4
- data/lib/ronin/exploits/stack_overflow.rb +9 -8
- data/lib/ronin/exploits/target.rb +1 -0
- data/lib/ronin/exploits/test_result.rb +2 -1
- data/lib/ronin/exploits/use_after_free.rb +1 -0
- data/lib/ronin/exploits/version.rb +2 -1
- data/lib/ronin/exploits/web.rb +1 -0
- data/lib/ronin/exploits/web_vuln.rb +1 -0
- data/lib/ronin/exploits/xss.rb +5 -4
- data/lib/ronin/exploits.rb +1 -0
- data/man/ronin-exploits-irb.1 +1 -1
- data/man/ronin-exploits-irb.1.md +1 -1
- data/man/ronin-exploits-list.1 +1 -1
- data/man/ronin-exploits-list.1.md +1 -1
- data/man/ronin-exploits-new.1 +1 -1
- data/man/ronin-exploits-new.1.md +2 -2
- data/man/ronin-exploits-run.1 +1 -1
- data/man/ronin-exploits-run.1.md +1 -1
- data/man/ronin-exploits-show.1 +1 -1
- data/man/ronin-exploits-show.1.md +1 -1
- data/man/ronin-exploits.1 +1 -1
- data/man/ronin-exploits.1.md +1 -1
- data/ronin-exploits.gemspec +4 -3
- metadata +21 -2
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,26 +31,26 @@ module Ronin
|
|
30
31
|
#
|
31
32
|
# require 'ronin/exploits/seh_overflow'
|
32
33
|
# require 'ronin/exploits/mixins/remote_tcp'
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# module Ronin
|
35
36
|
# module Exploits
|
36
37
|
# class MyExploit < SEHOverflow
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# register 'my_exploit'
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# include Mixins::RemoteTCP
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# def build
|
43
44
|
# nseh = 0x06eb9090 # short jump 6 bytes
|
44
45
|
# seh = 0x1001ae86 # pop pop ret 1001AE86 SSLEAY32.DLL
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# @buffer = seh_buffer_overflow(length: 1024, nops: 16, payload: payload, nseh: nseh, seh: seh)
|
47
48
|
# end
|
48
|
-
#
|
49
|
+
#
|
49
50
|
# def launch
|
50
51
|
# tcp_send "USER #{@buffer}"
|
51
52
|
# end
|
52
|
-
#
|
53
|
+
#
|
53
54
|
# end
|
54
55
|
# end
|
55
56
|
# end
|
@@ -59,7 +60,7 @@ module Ronin
|
|
59
60
|
# def build
|
60
61
|
# nseh = 0x06eb9090 # short jump 6 bytes
|
61
62
|
# seh = 0x1001ae86 # pop pop ret 1001AE86 SSLEAY32.DLL
|
62
|
-
#
|
63
|
+
#
|
63
64
|
# @buffer = junk(1024) + seh_record(nseh,seh) + nops(16) + payload
|
64
65
|
# end
|
65
66
|
#
|
data/lib/ronin/exploits/sqli.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -34,17 +35,17 @@ module Ronin
|
|
34
35
|
# ## Example
|
35
36
|
#
|
36
37
|
# require 'ronin/exploits/sqli'
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# module Ronin
|
39
40
|
# module Exploits
|
40
41
|
# class MyExploit < SQLI
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# register 'my_exploit'
|
43
|
-
#
|
44
|
+
#
|
44
45
|
# base_path '/path/to/page.php'
|
45
46
|
# query_param 'id'
|
46
47
|
# escape_quote true
|
47
|
-
#
|
48
|
+
#
|
48
49
|
# end
|
49
50
|
# end
|
50
51
|
# end
|
@@ -87,10 +88,10 @@ module Ronin
|
|
87
88
|
# Specifies whether to escape quotation marks.
|
88
89
|
#
|
89
90
|
def self.escape_quote(new_escape_quote=nil)
|
90
|
-
if new_escape_quote
|
91
|
+
if !new_escape_quote.nil?
|
91
92
|
@escape_quote = new_escape_quote
|
92
93
|
else
|
93
|
-
if
|
94
|
+
if !@escape_quote.nil?
|
94
95
|
@escape_quote
|
95
96
|
elsif superclass < SQLI
|
96
97
|
superclass.escape_quote
|
@@ -110,10 +111,10 @@ module Ronin
|
|
110
111
|
# Specifies whether to escape parenthesis.
|
111
112
|
#
|
112
113
|
def self.escape_parens(new_escape_parens=nil)
|
113
|
-
if new_escape_parens
|
114
|
+
if !new_escape_parens.nil?
|
114
115
|
@escape_parens = new_escape_parens
|
115
116
|
else
|
116
|
-
if
|
117
|
+
if !@escape_parens.nil?
|
117
118
|
@escape_parens
|
118
119
|
elsif superclass < SQLI
|
119
120
|
superclass.escape_parens
|
@@ -133,10 +134,10 @@ module Ronin
|
|
133
134
|
# Specifies whether to terminate the injected SQL expression.
|
134
135
|
#
|
135
136
|
def self.terminate(new_terminate=nil)
|
136
|
-
if new_terminate
|
137
|
+
if !new_terminate.nil?
|
137
138
|
@terminate = new_terminate
|
138
139
|
else
|
139
|
-
if
|
140
|
+
if !@terminate.nil?
|
140
141
|
@terminate
|
141
142
|
elsif superclass < SQLI
|
142
143
|
superclass.terminate
|
data/lib/ronin/exploits/ssti.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -32,17 +33,17 @@ module Ronin
|
|
32
33
|
# ## Example
|
33
34
|
#
|
34
35
|
# require 'ronin/exploits/ssti'
|
35
|
-
#
|
36
|
+
#
|
36
37
|
# module Ronin
|
37
38
|
# module Exploits
|
38
39
|
# class MyExploit < SSTI
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# register 'my_exploit'
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# base_path '/path/to/page.php'
|
43
44
|
# query_param 'name'
|
44
45
|
# escape_expr ->(expr) { "${{#{expr}}}" }
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# end
|
47
48
|
# end
|
48
49
|
# end
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,26 +31,26 @@ module Ronin
|
|
30
31
|
#
|
31
32
|
# require 'ronin/exploits/stack_overflow'
|
32
33
|
# require 'ronin/exploits/mixins/remote_tcp'
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# module Ronin
|
35
36
|
# module Exploits
|
36
37
|
# class MyExploit < StackOverflow
|
37
|
-
#
|
38
|
+
#
|
38
39
|
# register 'my_exploit'
|
39
|
-
#
|
40
|
+
#
|
40
41
|
# include Mixins::RemoteTCP
|
41
|
-
#
|
42
|
+
#
|
42
43
|
# def build
|
43
44
|
# ebp = 0x06eb9090
|
44
45
|
# eip = 0x1001ae86
|
45
|
-
#
|
46
|
+
#
|
46
47
|
# @buffer = buffer_overflow(length: 1024, nops: 16, payload: payload, bp: ebp, ip: eip)
|
47
48
|
# end
|
48
|
-
#
|
49
|
+
#
|
49
50
|
# def launch
|
50
51
|
# tcp_send "USER #{@buffer}"
|
51
52
|
# end
|
52
|
-
#
|
53
|
+
#
|
53
54
|
# end
|
54
55
|
# end
|
55
56
|
# end
|
@@ -59,7 +60,7 @@ module Ronin
|
|
59
60
|
# def build
|
60
61
|
# ebp = 0x06eb9090
|
61
62
|
# eip = 0x1001ae86
|
62
|
-
#
|
63
|
+
#
|
63
64
|
# @buffer = junk(1024) + nops(16) + payload + stack_frame(ebp,eip)
|
64
65
|
# end
|
65
66
|
#
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -30,7 +31,7 @@ module Ronin
|
|
30
31
|
class TestResult
|
31
32
|
|
32
33
|
# The descriptive message of the test result.
|
33
|
-
#
|
34
|
+
#
|
34
35
|
# @api public
|
35
36
|
attr_reader :message
|
36
37
|
|
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -21,6 +22,6 @@
|
|
21
22
|
module Ronin
|
22
23
|
module Exploits
|
23
24
|
# ronin-exploits version
|
24
|
-
VERSION = '1.0.
|
25
|
+
VERSION = '1.0.1'
|
25
26
|
end
|
26
27
|
end
|
data/lib/ronin/exploits/web.rb
CHANGED
data/lib/ronin/exploits/xss.rb
CHANGED
@@ -1,3 +1,4 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
#
|
2
3
|
# ronin-exploits - A Ruby library for ronin-rb that provides exploitation and
|
3
4
|
# payload crafting functionality.
|
@@ -35,16 +36,16 @@ module Ronin
|
|
35
36
|
# ## Example
|
36
37
|
#
|
37
38
|
# require 'ronin/exploits/xss'
|
38
|
-
#
|
39
|
+
#
|
39
40
|
# module Ronin
|
40
41
|
# module Exploits
|
41
42
|
# class MyExploit < XSS
|
42
|
-
#
|
43
|
+
#
|
43
44
|
# register 'my_exploit'
|
44
|
-
#
|
45
|
+
#
|
45
46
|
# base_path '/path/to/page.php'
|
46
47
|
# query_param 'title'
|
47
|
-
#
|
48
|
+
#
|
48
49
|
# end
|
49
50
|
# end
|
50
51
|
# end
|
data/lib/ronin/exploits.rb
CHANGED
data/man/ronin-exploits-irb.1
CHANGED
data/man/ronin-exploits-irb.1.md
CHANGED
data/man/ronin-exploits-list.1
CHANGED
data/man/ronin-exploits-new.1
CHANGED
data/man/ronin-exploits-new.1.md
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
# ronin-exploits-new 1 "
|
1
|
+
# ronin-exploits-new 1 "2023-02-01" Ronin "User Manuals"
|
2
2
|
|
3
3
|
## SYNOPSIS
|
4
4
|
|
@@ -57,7 +57,7 @@ Creates a new exploit file.
|
|
57
57
|
|
58
58
|
`-V`, `--software-version` *VERSION*
|
59
59
|
The software version to target.
|
60
|
-
|
60
|
+
|
61
61
|
`-L`, `--loot`
|
62
62
|
Adds the loot mixin.
|
63
63
|
|
data/man/ronin-exploits-run.1
CHANGED
data/man/ronin-exploits-run.1.md
CHANGED
data/man/ronin-exploits-show.1
CHANGED
data/man/ronin-exploits.1
CHANGED
data/man/ronin-exploits.1.md
CHANGED
data/ronin-exploits.gemspec
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
#
|
1
|
+
# frozen_string_literal: true
|
2
2
|
|
3
3
|
require 'yaml'
|
4
4
|
|
@@ -22,7 +22,7 @@ Gem::Specification.new do |gem|
|
|
22
22
|
gem.homepage = gemspec['homepage']
|
23
23
|
gem.metadata = gemspec['metadata'] if gemspec['metadata']
|
24
24
|
|
25
|
-
glob =
|
25
|
+
glob = ->(patterns) { gem.files & Dir[*patterns] }
|
26
26
|
|
27
27
|
gem.files = `git ls-files`.split($/)
|
28
28
|
gem.files = glob[gemspec['files']] if gemspec['files']
|
@@ -33,6 +33,7 @@ Gem::Specification.new do |gem|
|
|
33
33
|
gem.executables = gemspec.fetch('executables') do
|
34
34
|
glob['bin/*'].map { |path| File.basename(path) }
|
35
35
|
end
|
36
|
+
|
36
37
|
gem.default_executable = gem.executables.first if Gem::VERSION < '1.7.'
|
37
38
|
|
38
39
|
gem.extensions = glob[gemspec['extensions'] || 'ext/**/extconf.rb']
|
@@ -47,7 +48,7 @@ Gem::Specification.new do |gem|
|
|
47
48
|
gem.required_rubygems_version = gemspec['required_rubygems_version']
|
48
49
|
gem.post_install_message = gemspec['post_install_message']
|
49
50
|
|
50
|
-
split =
|
51
|
+
split = ->(string) { string.split(/,\s*/) }
|
51
52
|
|
52
53
|
if gemspec['dependencies']
|
53
54
|
gemspec['dependencies'].each do |name,versions|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: ronin-exploits
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0.
|
4
|
+
version: 1.0.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Postmodern
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-02
|
11
|
+
date: 2023-03-02 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: uri-query_params
|
@@ -31,6 +31,9 @@ dependencies:
|
|
31
31
|
- - "~>"
|
32
32
|
- !ruby/object:Gem::Version
|
33
33
|
version: '1.0'
|
34
|
+
- - ">="
|
35
|
+
- !ruby/object:Gem::Version
|
36
|
+
version: 1.0.1
|
34
37
|
type: :runtime
|
35
38
|
prerelease: false
|
36
39
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -38,6 +41,9 @@ dependencies:
|
|
38
41
|
- - "~>"
|
39
42
|
- !ruby/object:Gem::Version
|
40
43
|
version: '1.0'
|
44
|
+
- - ">="
|
45
|
+
- !ruby/object:Gem::Version
|
46
|
+
version: 1.0.1
|
41
47
|
- !ruby/object:Gem::Dependency
|
42
48
|
name: ronin-code-sql
|
43
49
|
requirement: !ruby/object:Gem::Requirement
|
@@ -59,6 +65,9 @@ dependencies:
|
|
59
65
|
- - "~>"
|
60
66
|
- !ruby/object:Gem::Version
|
61
67
|
version: '0.1'
|
68
|
+
- - ">="
|
69
|
+
- !ruby/object:Gem::Version
|
70
|
+
version: 0.1.1
|
62
71
|
type: :runtime
|
63
72
|
prerelease: false
|
64
73
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -66,6 +75,9 @@ dependencies:
|
|
66
75
|
- - "~>"
|
67
76
|
- !ruby/object:Gem::Version
|
68
77
|
version: '0.1'
|
78
|
+
- - ">="
|
79
|
+
- !ruby/object:Gem::Version
|
80
|
+
version: 0.1.1
|
69
81
|
- !ruby/object:Gem::Dependency
|
70
82
|
name: ronin-vulns
|
71
83
|
requirement: !ruby/object:Gem::Requirement
|
@@ -73,6 +85,9 @@ dependencies:
|
|
73
85
|
- - "~>"
|
74
86
|
- !ruby/object:Gem::Version
|
75
87
|
version: '0.1'
|
88
|
+
- - ">="
|
89
|
+
- !ruby/object:Gem::Version
|
90
|
+
version: 0.1.1
|
76
91
|
type: :runtime
|
77
92
|
prerelease: false
|
78
93
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -80,6 +95,9 @@ dependencies:
|
|
80
95
|
- - "~>"
|
81
96
|
- !ruby/object:Gem::Version
|
82
97
|
version: '0.1'
|
98
|
+
- - ">="
|
99
|
+
- !ruby/object:Gem::Version
|
100
|
+
version: 0.1.1
|
83
101
|
- !ruby/object:Gem::Dependency
|
84
102
|
name: ronin-post_ex
|
85
103
|
requirement: !ruby/object:Gem::Requirement
|
@@ -158,6 +176,7 @@ files:
|
|
158
176
|
- ".gitignore"
|
159
177
|
- ".mailmap"
|
160
178
|
- ".rspec"
|
179
|
+
- ".rubocop.yml"
|
161
180
|
- ".ruby-version"
|
162
181
|
- ".yardopts"
|
163
182
|
- COPYING.txt
|