Package: pwnchain
PwnChainIntroduction and GoalsPwnChain is a tool for cascading different tools in an automated fashion. Modules with specified input and output domains are linked in a tree structure to fulfill a certain task.The application is designed for the automatization of penetration testing sequences. Yet the application is aimed to be flexible enough to be used in any scenario where different interdependent CLI tools are processed in order.PwnChain uses .json configuration files to determine which tools shall be executed in a certain way, using regular expressions to parse the output of a tool to be used as input for subsequent tools. Its goal is to be easily customizable to fulfill different repetitive tasks.WarningPwnChain executes shell commands as instructed by the configuration file.You should never use configuration files that you do not fully understand.InstallationPwnChain requires at least Python 3.8 to run.pip (Recommended)python3 -m pip install --upgrade pwnchainBuild Packagecd $PWNCHAIN_ROOT
python3 -m pip install --upgrade build
python3 -m build
python3 -m pip install --upgrade dist/pwnchain-*.tar.gzRun Testspytestorcd src
python3 -m pytest ../testsThe latter is especially helpful during development.Usagepython3 -m pwnchainYou can use the-hor--helpoption to display the various command line options available.Example usagepython3 -m pwnchain cfg/enumerate.json -sserv:host:10.0.0.1ConfigurationConfiguration files are composed in .json format. You can check out thecfg/directory of this repository for some usage examples.The configuration file uses nested module descriptions.Using VariablesIn the various configuration strings, variables can be used by{var_name}. All variables collected are carried into all subsequent tool executions, defined in thepostattribute of a module. Redeclaring a variable will override its value for all subsequent tool executions.Variables can either be declared explicitly using thevarsattribute, or they can be captured from the tool execution output using thepatternsattribute.AttributesDescription of a module, identical for the root module, and any modules in thepostlist.AttributeDescriptionExamplenameUsed for output logging. Mandatory."name": "service-discovery"enabledA boolean value indicating whether a module is executed. Defaults to true."enabled": falseconditionPre-condition which is evaluated to decide whether a module is executed. Can be any python expression."condition": "'{protocol}' == 'ssh'"filesList of files embedded within the module configuration.See separate description belowcmdCommand to be executed. Mandatory."cmd": "nmap -sV {host}"varsDictionary of variables directly injected into a module."vars": { "host": "10.0.0.1" }patternsList of pattern dictionaries for capturing variables from module output.See separate description belowlogfileName of file to use if the-ooption is used for saving tool output to files."logfile": "nmap-{host}.log"submodulesDictionary of submodules to be executed after the command has run.See separate description belowThe files list shall contain of dictionaries with the following attributes:AttributeDescriptionExamplenameName of the file, which can be used as a variable by the module and its submodules. Mandatory."name": "wordlist.txt"typeOne oftext,base64,wget, for raw text, base64 encoded content, or URI of remote content. Mandatory."type": "wget"contentContent as specified bytype. Mandatory."content": "http://localhost/w.txt"The patterns list consists of dictionaries with the following attributes:AttributeDescriptionExamplepatternRegular expression using capture groups for variable extraction. Mandatory."pattern": "^(\\d+)"groupsList of variable names for the capture groups in order of declaration in the regex. Mandatory."groups": [ "port" ]logMessage format to output if a pattern was successfully matched."log": "Port {port} identified!"The submodules dictionary may consist of the following attributes:AttributeDescriptionExampleon_matchList of modules to be run when matching a pattern from thepatternslist."on_match": []"alwaysList of modules to always run aftercmdhas been executed."always": []"LicensePwnChain is available under the GPLv3 license. Please see theLICENSEfile supplied with the software, or athttps://www.gnu.org/licenses/