Module: PWN::Plugins::Detonate

Defined in:
lib/pwn/plugins/detonate.rb

Overview

Isolated sample detonation. Refuses if podman/isolation is missing.

Class Method Summary collapse

Class Method Details

.authors ⇒ Object 



41
42
43
 
# File 'lib/pwn/plugins/detonate.rb', line 41

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <[email protected]>\n"
end

.detonate(opts = {}) ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/pwn/plugins/detonate.rb', line 12

public_class_method def self.detonate(opts = {})
  path = (opts[:path] || opts[:sample]).to_s
  raise 'ERROR: path is required' if path.empty?
  raise "ERROR: sample not found: #{path}" unless File.file?(path)

  timeout = (opts[:timeout] || 30).to_i
  net = (opts[:network] || :none).to_s
  return { error: 'isolation preconditions unmet', hint: 'install podman (rootless); never falling back to host', path: path } unless PWN::Plugins::PreflightChecker.bin?(name: 'podman')

  home = Dir.home
  Dir.mktmpdir('pwn-detonate') do |tmp|
    FileUtils.cp(path, File.join(tmp, File.basename(path)))
    cmd = [
      'podman', 'run', '--rm', '--network', 'none',
      '--timeout', timeout.to_s, '-v', "#{tmp}:/sample:ro", 'alpine:latest',
      'sh', '-c', 'touch /tmp/ioc; echo attempted_write_home=$HOME'
    ]
    stdout, stderr, status = Open3.capture3(*cmd)
    iocs = {
      stdout: stdout,
      stderr: stderr,
      exit: status.exitstatus,
      home_untouched: File.directory?(home),
      attempted_home_write: stdout.include?('attempted_write_home')
    }
    { iocs: iocs, network: net, timeout: timeout, isolated: true }
  end
end

.help ⇒ Object 



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/pwn/plugins/detonate.rb', line 45

public_class_method def self.help
  puts "USAGE:
    # Run a sample in a network-isolated ephemeral container.
    #{self}.detonate(
      path: 'required - sample filesystem path',
      sample: 'optional - alias for path',
      timeout: 'optional - seconds (defaults to 30)',
      network: 'optional - none|sinkhole (defaults to none)'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end