Original Script Reference

For more details on the original exploit script, refer to the gist link CVE-2013-0156

CVE-2013-0156 Exploit Script

This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploit. You can access the challenge here: PentesterLab - CVE-2013-0156 Challenge.

This Python script is designed to exploit the CVE-2013-0156 vulnerability, a critical remote code execution (RCE) issue in Ruby on Rails applications caused by insecure deserialization of YAML objects. The vulnerability allows an attacker to inject arbitrary code through a crafted YAML payload, leading to code execution on the target server.

Features

• Payload Injection: The script sends a crafted XML payload to the target URL, exploiting the deserialization vulnerability in vulnerable Rails applications (Rails 2.x and 3.x).
• Customizable Target Version: Supports specifying whether the target is Rails 2.x or 3.x, allowing more control over payload format.
• Formatted Output: The script presents a well-structured and visually appealing output with color-coded request and response details, making it easy to track the exploit's status and response.
• Success Notification: Upon successful exploitation, the script notifies the user that the exploit has been executed successfully.

Usage