This project is for educational and research purposes only. Unauthorized use against systems you do not own is illegal and may result in severe legal consequences.

🛠️ How It Works

1️⃣ Generate a Secret Key

• The script derives a `` from a known Rails application name using MD5 hashing.

2️⃣ Create an ActiveStorage Secret

• Uses ActiveSupport::KeyGenerator to generate a signing key.

3️⃣ Create a Malicious ERB Object

• Constructs an uninitialized `` object with attacker-controlled code.

4️⃣ Wrap in DeprecatedInstanceVariableProxy

• Hides the malicious object within an innocuous-looking wrapper.

5️⃣ Sign and Generate an Exploit Token

• Uses ActiveSupport::MessageVerifier to sign the payload, making it appear legitimate.

6️⃣ Achieve Remote Code Execution (RCE)

• When deserialized, Rails executes the attacker's payload, allowing arbitrary command execution.

🚀 Usage

The script will generate a signed exploit token, which can be used against a vulnerable Rails application.

🛡️ Mitigations

• **Rotate and secure **`` to prevent attackers from generating signed payloads.
• Upgrade Rails to the latest version (Rails 7+ has stricter serialization mechanisms).
• Use JSON serialization instead of Marshal serialization to avoid arbitrary object loading.
• Audit application deserialization to ensure untrusted user input is not being deserialized.

📜 Legal Disclaimer

This project is intended for educational purposes only. The author is not responsible for any misuse or damages caused by this code.

📚 References

• Rails Security Guide
• CWE-502: Deserialization of Untrusted Data

⚠️ Use at your own risk!