Remote Ruby Code Execution in Ruby on Rails Action Pack render

This repository is a proof-of-concept exploit for CVE-2016-10033, targeting ERB template injection vulnerabilities in web applications (notably those using PHPMailer). The main file, script.py, is a Python script that automates the exploitation process: it takes a target URL, identifies injectable parameters, and attempts to inject a payload that executes arbitrary system commands on the server. If successful, it provides an interactive shell for the attacker to run further commands. The exploit works by injecting ERB code that executes a command and marks its output with a unique string, making it easy to extract from the HTTP response. The repository includes a README with usage instructions and an example, a requirements.txt for dependencies, and standard project files. The exploit is operational and provides a working shell if the target is vulnerable. No hardcoded IPs or domains are present, but the script is designed to target arbitrary URLs provided by the user.

This repository contains a single Metasploit module: 'rails_actionpack_inline_exec.rb', which exploits a remote code execution vulnerability (CVE-2016-2098) in the Ruby on Rails ActionPack component. The exploit works by sending a specially crafted JSON request to a vulnerable Rails application, injecting base64-encoded Ruby code into a specified parameter (default: 'id'). The vulnerable inline ERB processor evaluates this code, resulting in arbitrary code execution on the server. The module is highly configurable, allowing the attacker to specify the target URI and parameter. The exploit is weaponized, as it is part of the Metasploit framework and supports customizable payloads. The only file in the repository is the exploit module itself, written in Ruby.

This repository contains a proof-of-concept exploit for CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails applications that improperly handle user input in inline ERB templates. The main file, CVE-2016-2098.py, is a short Python script that takes three command-line arguments: a system command to execute, a target URL, and a vulnerable parameter name. It crafts an HTTP GET request to the target, injecting a Ruby ERB payload that executes the specified command on the server. The script then prints the server's response, which should contain the output of the executed command if the target is vulnerable. The repository also includes a minimal README. No hardcoded endpoints are present; the script is generic and requires the user to supply the target URL and parameter. The exploit demonstrates remote command execution via network attack vector and is a typical POC for this vulnerability.

This repository contains a Python-based exploit for CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails applications that use 'render' on user-supplied data. The exploit consists of two files: a README.md with usage instructions and exploit.py, the main exploit script. The script takes a vulnerable URL endpoint as input (e.g., 'page?id') and allows the user to interactively send arbitrary system commands to the target by injecting a Ruby template payload (e.g., '<%= %x(whoami) %>') via the '[inline]' parameter. The exploit leverages a template injection vulnerability to execute commands on the server and prints the output. The only fingerprintable endpoint is the HTTP parameter '[inline]' in the target URL. The exploit is operational, requiring the attacker to know a vulnerable endpoint and have network access to the target.