CVE-2015-3224 PoC — Ruby on Rails Web Console 代码注入漏洞

Source

https://github.com/0x00-0x00/CVE-2015-3224

Associated Vulnerability

Title:Ruby on Rails Web Console 代码注入漏洞 (CVE-2015-3224)
Description:Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。Web Console是一套基于Web的用于在服务器上执行shell命令的应用程序。 Ruby on Rails中使用的Web Console中的request.rb文件存在安全漏洞，该漏洞源于程序确定客户端IP地址时没有限制使用X-Forwarded-For头。远程攻击者可通过发送特制的请求利用该

Description

Modification of Metasploit module for RCE in Ruby-On-Rails Console CVE-2015-3224

Readme

# CVE-2015-3224
## Ruby-On-Rails Web Console RCE

# What is this?
This is a metasploit module for Metasploit.

# I already have this module.
Yes, this is packaged into metasploit. But with that module you can't get arbitrary command execution.

I mean, you can only establish reverse/bind shell payloads with it. I needed to execute commands right to the shell. So I modified the metasploit module in a manner that it is now able to execute single commands into the system.

# Good. How do I use it?
To install this module you can run the automatic installation script I developed to install it quickly to your metasploit.
```bash
./install.sh
```

Then the exploit will be into your metasploit framework! Just search for it using "search ruby-on-rails" or "search cve-2015-3224"

# Screenshot
![Module](img/screenshot.JPG?raw=true)

# Author Rights
I got no rights to this CVE neither to the metasploit module itself. This is just a hack I've done it so it can fit into my needs and may be just what you have been looking for.

File Snapshot


 [4.0K]  /data/pocs/394d456459df29607e5a1469536c95d4c9c6af0f
├── [4.0K]  img
│   └── [ 40K]  screenshot.JPG
├── [1.2K]  install.sh
├── [1.0K]  README.md
└── [4.0K]  ruby-on-rails-web-console2-rce.rb

1 directory, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!