Round Two: An Updated Universal Deserialisation Gadget for Ruby 2.x-3.x
13-Apr-2022 1693
A few months ago I noticed the gadget in my previous article had been patched and no longer worked in Ruby 3.0.3, so I spent a bit of time dusting off the old tools to see if I could find another one.One of the helper scripts I used is based on the original elttam article. It first autoloads as many classes as it can, then drops into a repl:.
Round Two: An Updated Universal Deserialisation Gadget for Ruby 2.x-3.x #ruby #rubydeveloper #rubyonrails #Round #Updated #Universal #Deserialisation #Gadget #2.x-3.x https://rubyonrails.ba/link/round-two-an-updated-universal-deserialisation-gadget-for-ruby-2-x-3-x