chore(deps): update pwntools requirement from >=4.9.0 to >=4.15.0

[dependabot]

Updates the requirements on pwntools to permit the latest version.

Release notes

Sourced from pwntools's releases.

Release 4.15.0

This is the last release supporting Python 2 and Python <3.10. See #2495

This release comes with a bunch of fixes, some new features, and a few deprecations. Thank you to every contributing their features and fixes!

Highlights

• Added context.gdb_binary to specify which gdb command to use. Useful to specify e.g. pwndbg. Checkout the pwn.conf config file to set it globally. (@​Ninja3047)
• Added tube.upload_manually to upload data to a shell using shell commands. Quickly upload your exploit into that kernel pwn challenge without manually typing the echo {chunk} | base64 -d >> exploit loop.
• Improved libcdb handling of a local libc-database without relying on external services. (@​the-soloist)
• Cache the output of asm() to speed up subsequent exploit runs. (Disable the cache using context.cache_dir = None)
• Improve documentation regarding which ELF functions run the binary internally. (Thanks to @​Hackrrr who made a CTF challenge for it at Compete With Team Europe CTF 2025)

Deprecations

Removal of some CLI command scripts

Many of the CLI utilities coming with pwntools had ambiguous names and caused problems while packaging in different distributions. Most of the commands are deprecated now and print a warning suggesting to use pwn <thecommand> instead.

Only checksec, constgrep, libcdb, phd, pwnstrip, and shellcraft stay as standalone CLI scripts. The rest will be removed and only accessible through the pwn wrapper in the future.

$ debug
/home/user/.local/bin/debug:8: DeprecationWarning: The 'debug' command is deprecated and will be removed in a future version. Please use 'pwn debug' instead.
  sys.exit(deprecated_main())
usage: pwn debug [-h] [-x GDBSCRIPT] [--pid PID] [-c context] [--exec EXECUTABLE] [--process PROCESS_NAME] [--sysroot SYSROOT]

Deprecate 'keepends' argument in favor of 'drop' in tube.recvline*

tube.recvline used the keepends argument to specify whether to include the trailing newline in the return value while tube.recvuntil uses drop to specify inclusion of the delimiter. The semantics are inversed for both functions causing confusion:

io.recvuntil(b'pwn', drop=True) # Don't include `pwn` at the end.
io.recvline(keepends=False) # Don't include `\n` at the end.

Since drop is a more generic name (and shorter to type), tube.recvline* accepts a drop parameter now and usage of keepends is deprecated.

The detailed changelog is as follows:

• Allow setting debugger path via context.gdb_binary by @​Ninja3047 in Gallopsled/pwntools#2602
• Cache output of asm() by @​peace-maker in Gallopsled/pwntools#2358
• docs: warn that .libs/.libc/.maps are dangerous by @​Arusekk in Gallopsled/pwntools#2626
• Add tube.upload_manually to upload files in chunks by @​peace-maker in Gallopsled/pwntools#2410
• Deprecate direct commandline scripts invocation and exclude nonsense ones by @​tkmikan in Gallopsled/pwntools#2364
• Extract libraries from Docker image by @​lcian in Gallopsled/pwntools#2479
• libcdb-cli: add --offline-only, refactor unstrip and add fetch parser for download libc-database by @​the-soloist in Gallopsled/pwntools#2478
• darwin: Bump syscalls from sdk 15.1 by @​patryk4815 in Gallopsled/pwntools#2448
• Support longer function names in Windows getexport shellcode by @​peace-maker in Gallopsled/pwntools#2587
• Fix attaching to a gdbserver with tuple gdb.attach(('0.0.0.0',12345)) by @​ckxckx in Gallopsled/pwntools#2291
• regsort: respect register aliases by @​Arusekk in Gallopsled/pwntools#2576
• Nicely handle non ELF files in checksec by @​tesuji in Gallopsled/pwntools#2457
• Add ELF.close() to release resources by @​peace-maker in Gallopsled/pwntools#2444

... (truncated)

Changelog

Sourced from pwntools's changelog.

4.15.0 (stable)

• #25082508 Ignore a warning when compiling with asm on nix
• #24712471 Properly close spawned kitty window
• #23582358 Cache output of asm()
• #24572457 Catch exception of non-ELF files in checksec.
• #24442444 Add ELF.close() to release resources
• #24132413 libcdb: improve the search speed of search_by_symbol_offsets in local libc-database
• #24702470 Fix waiting for gdb under WSL2
• #24792479 Support extracting libraries from Docker image in pwn template
• #24832483 Only print checksec output of ELF.libc when it was printed for the ELF already
• #24822482 Throw error when using sni and setting server_hostname manually in remote
• #24782478 libcdb-cli: add --offline-only, refactor unstrip and add fetch parser for download libc-database
• #24842484 Allow to disable caching
• #22912291 Fix attaching to a gdbserver with tuple gdb.attach(('0.0.0.0',12345))
• #24102410 Add tube.upload_manually to upload files in chunks
• #25022502 Fix loading ELF files without valid .dynamic section
• #24762476 Deprecate 'keepends' argument in favor of 'drop' in tube.recvline*
• #23642364 Deprecate direct commandline scripts invocation and exclude nonsense ones
• #2570[2570] Fix pwn template to skip Docker library extraction for statically linked binaries
• #2545[2545] SSH: fix download/upload with -1 exit status
• #2567[2567] Fix mistakenly parsing of ld-linux error messages.
• #2576[2576] regsort: respect register aliases
• #2595[2595] libcdb: Add Ubuntu and Debian debuginfod servers to default list
• #2593[2593] Use unicorn on macOS w/ SIP enabled
• #2587[2587] Support longer function names in Windows getexport shellcode
• #2596[2596] Ignore colored_traceback error when TERM envvar is unset
• #2579[2579] Fix poll error in process.libs() and clean up maps parsing
• #2602[2602] Allow setting debugger path via context.gdb_binary
• #2609[2609] Fix log level of child remotes of server tube
• #2612[2612] Fix lookup of binutils for mipsel architecture
• #2624[2624] Fix regression: gdbserver can't handle command-line argument containing whitespace

... (truncated)

Commits

• 3ad86ec Release 4.15.0
• b5076d9 Merge branch 'stable' into beta
• 77b4f06 docs: warn that .libs/.libc/.maps are dangerous (#2626)
• 4968499 ffix: ugly ELF docs (whitespace only)
• f38991b Merge branch 'stable' into beta
• d0e6ee4 Fix regression: gdbserver can't handle command-line argument containing white...
• 48ea09b Fix lookup of binutils for mipsel architecture (#2612)
• 9f22a2f Merge branch 'stable' into beta
• 7413a3d Exclude Unicorn versions segfaulting on MIPS PLT (#2621)
• 95aac6e Merge branch 'stable' into beta
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)