JangoSteve

#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0333)
#
# ## Advisory
#
#   https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo
#
# ## Caveats
#

JangoSteve

desc "Install the latest stable release of MySql."
task :install, roles: :db, only: {primary: true} do
  #run "echo #{mysql_password}"
  run "#{sudo} apt-get -y update"
  run "#{sudo} apt-get -y install mysql-server" do |channel, stream, data|
    # prompts for mysql root password (when blue screen appears)
    channel.send_data("#{mysql_root_password}\n\r") if data =~ /password/
  end
  run "#{sudo} apt-get -y install mysql-client libmysqlclient-dev"
end

JangoSteve

# Validates whether the value of the specified attribute matches the format of an URL,
# as defined by RFC 2396. See URI#parse for more information on URI decompositon and parsing.
#
# This method doesn't validate the existence of the domain, nor it validates the domain itself.
#
# Allowed values include http://foo.bar, http://www.foo.bar and even http://foo.
# Please note that http://foo is a valid URL, as well http://localhost.
# It's up to you to extend the validation with additional constraints.
#
#   class Site < ActiveRecord::Base

JangoSteve

#!/usr/bin/env ruby

require 'open-uri'
require 'rexml/document'
require 'rexml/xpath'

url = 'http://rpm.newrelic.com/accounts.xml?include=application_health'

headers = {'x-license-key' => 'YOUR LICENSE KEY'}

JangoSteve

#!/bin/sh

echo "js-zipped-served-from-rmsr-vs-cloudfront-vs-intercepted-cloudfront"
echo " "
echo "------------------------------------------------------------------------------------------------------------------------------------------------------"
for i in {1..5}
do
  for loc in "http://cdn.ratemystudentrental.com/javascripts/all-rmsr.js?1275522132" "http://cdn0.ratemystudentrental.com/javascripts/all-rmsr.js?1275522132" "http://compressed.ratemystudentrental.com/javascripts/all-rmsr.js?1275522132" "http://cdn0.ratemystudentrental.com/javascripts/all-rmsr.js.gz?1275522132"
  do
    echo "vv $loc vv"

JangoSteve

#!/usr/bin/env ruby

# adapted for RMSR from http://gist.github.com/41713
# run every couple minutes via cron
# and output results to script_output.log
# sudo crontab -e
# then add the following:
# */2 * * * * ruby /bin/passenger_monitor_cron 2>&1 >> /var/log/script_output.log

command = '/usr/bin/passenger-memory-stats'