0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-RJWOYEOG.js

@@ -0,0 +1,271 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/kernel/exploit/recipes.js
+var RECIPE_LIBRARY = [
+  {
+    id: "dirtyCred",
+    title: "DirtyCred \u2014 privileged-object swap via heap reuse (data-only)",
+    // A UAF (or a refcount bug collapsing to one) on a file/cred object is the
+    // canonical DirtyCred entry; a page-UAF can also be funnelled here.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF (or refcount-to-UAF) on a `struct file` or `struct cred` \u2014 or any freeable object that can be made to alias one via same-cache reuse",
+      "ability to free the victim object while a dangling reference is still usable (the swap window)",
+      "an unprivileged path that allocates the privileged replacement (e.g. open(/etc/passwd) for a write-capable file, or a setuid exec for a privileged cred)"
+    ],
+    sprayObjects: ["file", "cred"],
+    steps: [
+      "free the unprivileged victim object through the bug, keeping the dangling reference",
+      "spray the privileged counterpart into the freed slot via same-cache reuse (open a write-protected file / trigger a privileged cred alloc)",
+      "use the dangling reference to operate on the now-privileged object (write through the privileged file / run with the swapped cred)"
+    ],
+    finalStep: "file-swap",
+    reliability: "high",
+    // Data-only: no leak, no KASLR/SMEP/SMAP dependence — the whole point.
+    caveats: [
+      "defeated by cred/file slab isolation (vendor DirtyCred mitigation, SLAB_VIRTUAL-era dedicated caches) \u2014 verify the victim shares a cache with the privileged object",
+      "needs a same-cache privileged allocation primitive reachable unprivileged"
+    ],
+    citation: "Lin, Wu, Xing \u2014 DirtyCred (CCS 2022 / Black Hat USA 2022); CVE-2021-4154, CVE-2022-2588"
+  },
+  {
+    id: "dirtyPagetable",
+    title: "Dirty Pagetable \u2014 page-UAF \u2192 PTE poison \u2192 arbitrary physical R/W",
+    appliesTo: ["page-uaf", "uaf"],
+    ceiling: "root",
+    preconditions: [
+      "page-granularity UAF: a freed page (order-0+) returned to the page allocator and reusable across caches",
+      "a dangling write into the freed page after it is reclaimed",
+      "ability to fault in a fresh page-table page (mmap + touch) so the freed page is reused as a PTE-bearing page table"
+    ],
+    sprayObjects: ["pte"],
+    steps: [
+      "free the victim page through the bug (cross-cache it back to the buddy allocator if the bug is slab-granularity \u2014 see crossCacheSlubStick)",
+      "fault in a user page table so the kernel reclaims the freed page as a page-table page",
+      "use the dangling write to forge a PTE pointing at an attacker-chosen physical frame \u2192 arbitrary physical read/write",
+      "locate kernel physmap and overwrite `core_pattern` (or `modprobe_path`) via the physical R/W"
+    ],
+    finalStep: "core_pattern",
+    reliability: "high",
+    caveats: [
+      "needs page-granularity reuse \u2014 a pure slab UAF must be widened with a cross-cache free first (crossCacheSlubStick)",
+      "physmap base discovery still wants a coarse KASLR defeat (EntryBleed prefetch in kctf.h) unless KASLR is off"
+    ],
+    citation: "Nicolas Wu \u2014 Dirty Pagetable writeup; kernelCTF LTS page-UAF winners"
+  },
+  {
+    id: "crossCacheSlubStick",
+    title: "Cross-cache SLUB stick \u2014 slab-UAF \u2192 page reuse bridge",
+    // The bridge: turns a slab-granularity bug into page-granularity reuse so a
+    // downstream recipe (Dirty Pagetable, or an unlike-cache reclaim) applies.
+    appliesTo: ["uaf", "oob-write", "page-uaf"],
+    ceiling: "arb-write",
+    preconditions: [
+      "a slab-cache UAF/OOB whose victim slab can be drained so the whole slab page is freed back to the buddy allocator",
+      "control over allocation/free timing to empty the victim slab"
+    ],
+    sprayObjects: ["msg_msg", "pipe_buffer"],
+    steps: [
+      "groom the victim slab so the bug's object is the last live one",
+      "free the remaining objects so the empty slab page returns to the buddy allocator (the cross-cache free)",
+      "immediately allocate the target page in a DIFFERENT cache (or a page-table page) so it reclaims the freed slab page",
+      "drive the dangling slab-relative write into the reclaimed cross-cache object \u2014 hand off to dirtyPagetable / dirtyCred for the root tail"
+    ],
+    finalStep: "modprobe_path",
+    reliability: "medium",
+    caveats: [
+      "RANDOM_KMALLOC_CACHES and freelist randomization raise the grooming cost (more sprays, lower landing rate)",
+      "a bridge, not a complete chain \u2014 pair it with a root-tail recipe"
+    ],
+    citation: "kernelCTF LTS cross-cache (SLUB) technique; kctf.h sprays"
+  },
+  {
+    id: "msgMsgArbRW",
+    title: "msg_msg / pipe_buffer spray \u2192 arbitrary R/W \u2192 modprobe_path",
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "root",
+    preconditions: [
+      "UAF or OOB-write in a generic `kmalloc-N` bucket reachable unprivileged",
+      "the victim cache is not bucket-isolated from the spray (SLAB_BUCKETS off, or an accounted spray for a `-cg-` victim)"
+    ],
+    sprayObjects: ["msg_msg", "pipe_buffer", "setxattr"],
+    steps: [
+      "spray msg_msg (or pipe_buffer) to reclaim the freed/adjacent slot",
+      "corrupt the reclaiming object's length/next field to widen into an out-of-bounds read (leak) and then an arbitrary write",
+      "overwrite `modprobe_path` (or `core_pattern`) and trigger it for root"
+    ],
+    finalStep: "modprobe_path",
+    reliability: "medium",
+    caveats: [
+      "SLAB_BUCKETS isolates msg_msg from a plain victim \u2014 see spray-selector.ts",
+      "setxattr is a transient (race) reclaim window; prefer the persistent sprays"
+    ],
+    citation: "kernelCTF LTS msg_msg/pipe_buffer winners; kctf.h sprays"
+  },
+  {
+    id: "fdTableSpray",
+    title: "fd-table spray \u2014 open()-flood grooms `struct file *` fd-arrays",
+    // The bridge/grooming vector: an open() flood expands a task's fdtable so
+    // the kernel allocates fresh `struct file *[]` arrays in a target kmalloc
+    // bucket — a controllable, persistent reclaim object for a slab UAF/OOB, and
+    // the layout target that feeds the fileOpsVtableConfusion tail.
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "arb-write",
+    preconditions: [
+      "a slab UAF/OOB in a `kmalloc-N` bucket the `struct fdtable` fd-array (`struct file *[]`) can be steered to reclaim",
+      "an unprivileged path to open() many descriptors so `files_struct` grows its `fdtable` and reallocates the fd-array into the victim bucket"
+    ],
+    sprayObjects: ["fdtable", "files_struct", "file"],
+    steps: [
+      "open() a flood of descriptors so the task's `files_struct` expands its `fdtable` and allocates a fresh `struct file *[]` fd-array in the target kmalloc bucket (dup2/dup to size the array precisely)",
+      "free the victim object through the bug, then trigger another fdtable grow so the `struct file *` fd-array reclaims the freed slot",
+      "drive the dangling/OOB write to corrupt a `struct file *` entry in the reclaimed fd-array so a live fd aliases an attacker-shaped `struct file`",
+      "operate through the confused fd \u2014 hand off to fileOpsVtableConfusion for the control-flow / privileged-object tail"
+    ],
+    finalStep: "file-swap",
+    reliability: "medium",
+    caveats: [
+      "the fd-array shares generic `kmalloc-N` \u2014 SLAB_BUCKETS / RANDOM_KMALLOC_CACHES isolate it from a plain victim (groom same-call-site instead)",
+      "a bridge, not a complete chain \u2014 pair it with fileOpsVtableConfusion or a DirtyCred file swap for the root tail"
+    ],
+    citation: "kernelCTF fd-array (files_struct/fdtable) grooming; classic `struct file *` reclaim vector"
+  },
+  {
+    id: "fakeCredOneShot",
+    title: "fake-cred one-shot \u2014 timer/ops UAF \u2192 forged cred + commit_creds hijack (data-only root)",
+    // A UAF (or a refcount bug collapsing to one) on an object that owns an
+    // embedded `timer_list` / callback the kernel re-arms and fires after free.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF (or refcount-to-UAF) on an object that owns an embedded `timer_list` (or a work/tasklet/ops callback) which the kernel re-arms (mod_timer) and fires AFTER the free",
+      "a same-cache spray that lands in the freed object's kmalloc bucket with fully attacker-controlled bytes (msg_msg via msgsnd is the canonical one \u2014 persists until msgrcv, header 48B)",
+      "the freed object's layout overlaps a forgeable `struct cred`: the callback pointer aliases `cred.euid/egid` (== the indirect-call target) and the object's slack covers cred caps + user/user_ns/ucounts/group_info",
+      "an unprivileged child that can busy-spin so the timer softirq fires in ITS task context (commit_creds escalates `current`)"
+    ],
+    sprayObjects: ["msg_msg"],
+    steps: [
+      "free the victim object through the bug while its timer is still re-armable",
+      "spray a forged `msg_msg` into the freed slot: inject ONLY the `timer_list.function = commit_creds` (leave entry.next/pprev/expires zeroed so detach is safe and timer_pending()==false), and lay a forged cred in the slack (caps=~0, user/user_ns/ucounts/group_info=&init_*)",
+      "let the kernel re-arm the timer (mod_timer on the reclaimed object) \u2014 the re-arm leaves the timer base/flags intact and takes .function from the forged bytes",
+      "the busy-spinning unprivileged child receives the timer softirq: call_timer_fn runs commit_creds(&obj) \u2192 the child is root; normalize euid/fsuid via CAP_SETUID from the forged cap_effective and drop a shell"
+    ],
+    finalStep: "cred-forge",
+    reliability: "high",
+    caveats: [
+      "CFI_CLANG / FineIBT rejects an indirect call to commit_creds from call_timer_fn \u2014 the forward-edge check requires a type-matching target; this one-shot assumes CFI is OFF (as on the proven hid-sony target)",
+      "hardened / KASLR-ON root needs a companion kernel-TEXT infoleak: the physmap leak (MODE_LEAK) recovers page_offset_base (defeats RANDOMIZE_MEMORY) but NOT .text, so commit_creds's slid address is still unknown without a paired text leak",
+      "needs the spray to share a cache with the victim (MEMCG off, or an accounted spray for a -cg- victim) \u2014 verify the bucket match"
+    ],
+    citation: "0sec hid-sony ghl_poke_timer UAF \u2192 LPE (fake-cred one-shot, 9/9 root); DirtyCred-family credential forge without arbitrary R/W"
+  },
+  {
+    id: "workqueueBounceRoot",
+    title: "timer-UAF \u2192 forge-pwq \u2192 kworker process-context bounce \u2192 WWW \u2192 modprobe_path",
+    // The GuitarZero full clean chain (0sec#1215): the poison-tolerant, no-arb-
+    // read sibling of fakeCredOneShot. Where the one-shot fires commit_creds in a
+    // softirq (fatal-fault on any miss), this bounces into PROCESS context via a
+    // real kworker, so a survivable WWW gadget can overwrite modprobe_path and a
+    // miss leaves the box ALIVE. See guitarzero-primitives.ts for the primitives.
+    appliesTo: ["uaf", "refcount"],
+    ceiling: "root",
+    preconditions: [
+      "UAF on an object owning an embedded `timer_list` the kernel re-arms after free (as fakeCredOneShot), reclaimed via a self-address-leakable object (user_key_payload \u2014 keyctl_read exposes the reclaimed bytes)",
+      "a self-address leak (N-object same-bucket timer linkage \u2192 chunk = leaked\u2212344) and the leaked timer-bucket per-CPU pointer",
+      "a kernel-text base (EntryBleed unprivileged, or a companion leak on a virtualized-TSC box) to slide cpu_worker_pools/delayed_work_timer_fn/gadget",
+      "CFI off: the forged work->func indirect call is not forward-edge-checked"
+    ],
+    sprayObjects: ["user_key", "msg_msg"],
+    steps: [
+      "free the timer-owning victim; reclaim with a user_key_payload carrying the forged timer/work layout (leak-then-reoccupy bakes the self-address in)",
+      "leak the chunk self-address + timer-bucket pointer; recover __per_cpu_offset[0] from the bucket + read-back expires",
+      "forge workqueue_struct+pool_workqueue at chunk+256 (256-aligned; get_work_pwq masks the low 8 bits) and point pwq->pool at the computed real cpu_worker_pools[0][0] \u2014 no arbitrary read",
+      "timer.function=delayed_work_timer_fn \u2192 __queue_work \u2192 process_one_work runs work->func in a real kworker (PROCESS context); the self-address-baked work->entry passes the workqueue.c list_empty gate",
+      'work->func = perf_swevent_del (survivable unlink-WWW) writes *(modprobe_path)="/tmp/x"; socket() over an unregistered family fires request_module \u2192 /tmp/x runs as root'
+    ],
+    finalStep: "modprobe_path",
+    reliability: "high",
+    caveats: [
+      "CFI_CLANG / FineIBT forward-edge-checks the work->func indirect call \u2014 the WWW gadget must be a type-matching signed target; the proven chain assumes CFI OFF (kCFI \u21D2 a data-only tail is needed)",
+      "EntryBleed (CVE-2022-4543) supplies the text base bare-metal; it is marginal on a virtualized-TSC (KVM) box (rdtscp buries the prefetch delta) \u2014 supply the base via a companion leak there",
+      "one probabilistic reoccupy race per boot (~2/3; ~96% within 3 boots); a miss bakes clockevents_handle_noop (endbr64;ret) so the box stays ALIVE for retry"
+    ],
+    citation: "0sec hid-sony ghl_poke_timer UAF \u2192 clean unprivileged LPE (/root/ghl-clean/ghl_lpe_clean.c, uid=0 5/7 boots; /root/ghl-full FULL-ROOT); EntryBleed CVE-2022-4543"
+  },
+  {
+    id: "fileOpsVtableConfusion",
+    title: "pipe_buffer/file \u2192 fake file_operations vtable \u2192 fileops hijack (control transfer)",
+    // Type-confusion tail: with an arb-write or UAF over a `struct file` (or a
+    // `pipe_buffer` aliased onto one), overwrite `f_op` / the fd-array's
+    // `fde_file[0]` to point at an attacker-shaped `file_operations`, then invoke
+    // a fileop (->unlocked_ioctl / ->release) to hijack the slot and transfer
+    // control (commit_creds(prepare_kernel_cred(0)) or a stack pivot).
+    appliesTo: ["uaf", "oob-write"],
+    ceiling: "root",
+    preconditions: [
+      "an arbitrary write, or a UAF/OOB, over a `struct file` (or a `pipe_buffer` that can be aliased onto one \u2014 see fdTableSpray)",
+      "a kernel-readable location holding an attacker-shaped `file_operations` (sprayed pipe_buffer/msg_msg payload, or a known writable global)",
+      "an unprivileged path to invoke a fileop on the confused fd (ioctl/read/close) so the hijacked slot is called"
+    ],
+    sprayObjects: ["file", "pipe_buffer", "fdtable"],
+    steps: [
+      "overwrite the victim `struct file`'s `f_op` (or the fd-array's `fde_file[0]` \u2192 its `f_op`) with a pointer to a fake `file_operations`",
+      "populate the fake `file_operations` so the targeted slot (`->unlocked_ioctl` / `->release`) points at the control-transfer gadget",
+      "invoke the fileop on the confused fd (ioctl / close) to call the hijacked slot \u2014 transfer control to the gadget",
+      "run `commit_creds(prepare_kernel_cred(0))` (or pivot) from the hijacked fileop to overwrite the current task's creds \u2192 root"
+    ],
+    finalStep: "cred-overwrite",
+    reliability: "medium",
+    caveats: [
+      "CFI / FineIBT rejects an arbitrary indirect call target \u2014 the fake `->ioctl` must land on a type-matching signed gadget, not raw shellcode",
+      "KASLR requires a text/heap leak first to place the fake vtable + gadget (pair with a leak primitive in library.ts)",
+      "read-only `struct file.f_op` in some builds \u2014 confuse via a controllable `pipe_buffer`/fd-array alias rather than an in-place `f_op` write"
+    ],
+    citation: "classic fake-file_operations / vtable hijack; pipe_buffer & fd-array type-confusion (kernelCTF fileops slot hijack)"
+  }
+];
+function getRecipe(id) {
+  return RECIPE_LIBRARY.find((r) => r.id === id);
+}
+
+// packages/core/dist/kernel/exploit/strategy.js
+var ESCALATION_LADDER = [
+  "none",
+  "attempted",
+  "triggered",
+  "reclaim",
+  "arb-read",
+  "arb-write",
+  "root"
+];
+function rungRank(rung) {
+  const rank = ESCALATION_LADDER.indexOf(rung);
+  return rank < 0 ? 0 : rank;
+}
+function maxRung(a, b) {
+  return rungRank(a) >= rungRank(b) ? a : b;
+}
+function ratchet(current, observed) {
+  return maxRung(current, observed);
+}
+function rungAtLeast(rung, floor) {
+  return rungRank(rung) >= rungRank(floor);
+}
+function ladderUpTo(ceiling) {
+  const ceil = rungRank(ceiling);
+  return ESCALATION_LADDER.filter((rung) => rung !== "none" && rungRank(rung) <= ceil);
+}
+
+export {
+  ESCALATION_LADDER,
+  rungRank,
+  maxRung,
+  ratchet,
+  rungAtLeast,
+  ladderUpTo,
+  RECIPE_LIBRARY,
+  getRecipe
+};

package/chunks/chunk-RRMJC3ZE.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/agent/output-truncation.js
+var BYTES_PER_TOKEN = 4;
+var DEFAULT_TOOL_OUTPUT_TOKENS = 1e4;
+function utf8Size(codePoint) {
+  if (codePoint < 128)
+    return 1;
+  if (codePoint < 2048)
+    return 2;
+  if (codePoint < 65536)
+    return 3;
+  return 4;
+}
+function headSlice(text, byteBudget) {
+  let bytes = 0;
+  let i = 0;
+  while (i < text.length) {
+    const cp = text.codePointAt(i);
+    const size = utf8Size(cp);
+    if (bytes + size > byteBudget)
+      break;
+    bytes += size;
+    i += cp > 65535 ? 2 : 1;
+  }
+  return text.slice(0, i);
+}
+function tailSlice(text, byteBudget) {
+  let bytes = 0;
+  let end = text.length;
+  while (end > 0) {
+    let start = end - 1;
+    const unit = text.charCodeAt(start);
+    if (unit >= 56320 && unit <= 57343 && start > 0) {
+      const prev = text.charCodeAt(start - 1);
+      if (prev >= 55296 && prev <= 56319)
+        start -= 1;
+    }
+    const size = utf8Size(text.codePointAt(start));
+    if (bytes + size > byteBudget)
+      break;
+    bytes += size;
+    end = start;
+  }
+  return text.slice(end);
+}
+function truncateMiddle(text, options = {}) {
+  const limit = options.limit ?? DEFAULT_TOOL_OUTPUT_TOKENS;
+  const mode = options.mode ?? "tokens";
+  const byteBudget = Math.max(0, mode === "tokens" ? limit * BYTES_PER_TOKEN : limit);
+  const totalBytes = Buffer.byteLength(text, "utf8");
+  const originalTokens = Math.ceil(totalBytes / BYTES_PER_TOKEN);
+  const originalLines = text.length === 0 ? 0 : text.split("\n").length;
+  if (totalBytes <= byteBudget) {
+    return { text, truncated: false, originalTokens, originalLines, truncatedTokens: 0 };
+  }
+  const headBudget = Math.floor(byteBudget / 2);
+  const head = headSlice(text, headBudget);
+  const tail = tailSlice(text, byteBudget - headBudget);
+  const keptBytes = Buffer.byteLength(head, "utf8") + Buffer.byteLength(tail, "utf8");
+  const truncatedTokens = Math.ceil((totalBytes - keptBytes) / BYTES_PER_TOKEN);
+  return {
+    text: `${head}
+\u2026${truncatedTokens} tokens truncated\u2026
+${tail}`,
+    truncated: true,
+    originalTokens,
+    originalLines,
+    truncatedTokens
+  };
+}
+function formatTruncated(text, policy = {}) {
+  const initial = truncateMiddle(text, policy);
+  if (!initial.truncated)
+    return initial.text;
+  const limit = policy.limit ?? DEFAULT_TOOL_OUTPUT_TOKENS;
+  const mode = policy.mode ?? "tokens";
+  const byteBudget = Math.max(0, mode === "tokens" ? limit * BYTES_PER_TOKEN : limit);
+  const header = [
+    `Warning: truncated output (original token count: ${initial.originalTokens})`,
+    `Total output lines: ${initial.originalLines}`,
+    ""
+  ].join("\n");
+  const headerBytes = Buffer.byteLength(header, "utf8");
+  if (headerBytes >= byteBudget)
+    return headSlice(header, byteBudget);
+  let bodyBudget = byteBudget - headerBytes;
+  let body = truncateMiddle(text, { mode: "bytes", limit: bodyBudget });
+  let rendered = `${header}
+${body.text}`;
+  while (Buffer.byteLength(rendered, "utf8") > byteBudget && bodyBudget > 0) {
+    bodyBudget = Math.max(0, bodyBudget - (Buffer.byteLength(rendered, "utf8") - byteBudget));
+    body = truncateMiddle(text, { mode: "bytes", limit: bodyBudget });
+    rendered = `${header}
+${body.text}`;
+  }
+  return Buffer.byteLength(rendered, "utf8") <= byteBudget ? rendered : headSlice(rendered, byteBudget);
+}
+
+export {
+  truncateMiddle,
+  formatTruncated
+};