Module: PWN::Plugins::CapabilityBroker

Defined in:
lib/pwn/plugins/capability_broker.rb,
lib/pwn/plugins/capability_broker/daemon.rb

Overview

Bounded, peer-authenticated client; never starts or elevates the helper.

Defined Under Namespace

Modules: Daemon

Class Method Summary collapse

Class Method Details

.authors ⇒ Object 



35
36
37
 
# File 'lib/pwn/plugins/capability_broker.rb', line 35

public_class_method def self.authors
  'AUTHOR(S): 0day Inc. <[email protected]>'
end

.help ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/pwn/plugins/capability_broker.rb', line 39

public_class_method def self.help
  puts "USAGE:
    # Send a typed bounded request to the authenticated local broker.
    #{self}.request(
      operation: 'required - status, raw_send, capture, arp or nd',
      socket: 'optional - local broker Unix socket path',
      iface: 'optional - administrator-allowed network interface',
      frame: 'optional - base64 Ethernet frame for raw_send',
      address: 'optional - typed IP address for neighbor lookup',
      count: 'optional - maximum packets to capture',
      timeout: 'optional - capture seconds budget'
    )
    # Print the module author information.
    #{self}.authors
  "
end

.request(opts = {}) ⇒ Object 



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/pwn/plugins/capability_broker.rb', line 13

public_class_method def self.request(opts = {})
  path = opts[:socket] || ENV.fetch('PWN_CAPD_SOCKET', '/run/pwn-capd/control.sock')
  payload = JSON.generate(opts.except(:socket)) << "\n"
  raise 'broker request too large' if payload.bytesize > 100_000

  Timeout.timeout(35) do
    UNIXSocket.open(path) do |socket|
      _pid, uid, = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).unpack('iii')
      raise 'untrusted broker peer' unless [0, Process.uid].include?(uid)

      socket.write(payload)
      line = socket.gets(2_000_001)
      raise 'invalid broker response' unless line && line.bytesize <= 2_000_000 && line.end_with?("\n")

      JSON.parse(line, symbolize_names: true)
    end
  end
rescue StandardError => e
  { ok: false, degraded: true, error: e.message,
    remediation: "sudo /usr/local/libexec/pwn-capd --uid #{Process.uid} --interface lo" }
end