Module: Msf::Exploit::Remote::HTTP::RailsActiveStorageVips

Includes:

ActiveStorage, FileReader, MessageVerifier, RailsSecrets, Request, Msf::Exploit::Remote::HttpClient

Defined in:

lib/msf/core/exploit/remote/http/rails_active_storage_vips.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/request.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/file_reader.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/png_decoder.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/rails_secrets.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/active_storage.rb,
lib/msf/core/exploit/remote/http/rails_active_storage_vips/message_verifier.rb

Overview

Helpers for the Rails Active Storage Vips file-read and signed-variation exploit chain.

Defined Under Namespace

Modules: ActiveStorage, FileReader, MessageVerifier, RailsSecrets, Request Classes: ConfigError, DataError, FlowError, PngDecoder, ReadBudgetError, TriggerError, UnreachableError

Constant Summary

REPRESENTATION_REDIRECT_LIMIT =

3

Constants included from Request

Request::MAX_UPLOAD_HEADERS, Request::MAX_UPLOAD_HEADER_BYTES, Request::MAX_UPLOAD_HEADER_VALUE_BYTES, Request::UNSAFE_UPLOAD_HEADERS

Constants included from RailsSecrets

RailsSecrets::CREDENTIAL_ENVIRONMENTS, RailsSecrets::ENVIRONMENT_PATHS, RailsSecrets::LOCAL_SECRET_PATHS, RailsSecrets::MAX_YAML_DEPTH

Constants included from MessageVerifier

MessageVerifier::KEY_GENERATOR_DIGESTS, MessageVerifier::VERIFIER_DIGESTS

Constants included from FileReader

FileReader::EXPLOIT_DATA_DIR, FileReader::EXTERNAL_OFFSET_MARKER, FileReader::EXTERNAL_PATH_PLACEHOLDER, FileReader::READ_LAYOUTS

Instance Attribute Summary

Attributes included from Msf::Exploit::Remote::HttpClient

#client, #cookie_jar

Method Summary

Methods included from ActiveStorage

#report_vuln, #service_details

Methods included from Msf::Exploit::Remote::HttpClient

#basic_auth, #cleanup, #configure_http_login_scanner, #connect, #connect_ws, #deregister_http_client_options, #disconnect, #download, #full_uri, #handler, #http_fingerprint, #initialize, #lookup_http_fingerprints, #normalize_uri, #path_from_uri, #peer, #proxies, #reconfig_redirect_opts!, #request_opts_from_url, #request_url, #rhost, #rport, #send_request_cgi, #send_request_cgi!, #send_request_raw, #service_details, #setup, #ssl, #ssl_version, #sslkeylogfile, #strip_tags, #target_uri, #validate_fingerprint, #vhost

Methods included from CertificateTrace

#certificate_csr_trace, #certificate_peer_cert_trace, #certificate_trace, #certificate_trace_enabled?, #initialize

Methods included from Kerberos::ServiceAuthenticator::Options

#kerberos_auth_options, #kerberos_clock_skew_seconds

Methods included from Kerberos::Ticket::Storage

#initialize, #kerberos_storage_options, #kerberos_ticket_storage, store_ccache

Methods included from Auxiliary::LoginScanner

#configure_login_scanner

Methods included from Auxiliary::Report

#active_db?, #create_cracked_credential, #create_credential, #create_credential_and_login, #create_credential_login, #db, #db_warning_given?, #get_client, #get_host, #inside_workspace_boundary?, #invalidate_login, #mytask, #myworkspace, #myworkspace_id, #report_auth_info, #report_client, #report_exploit, #report_host, #report_loot, #report_note, #report_service, #report_vuln, #report_web_form, #report_web_page, #report_web_site, #report_web_vuln, #store_cred, #store_local, #store_loot

Methods included from Metasploit::Framework::Require

optionally, optionally_active_record_railtie, optionally_include_metasploit_credential_creation, #optionally_include_metasploit_credential_creation, optionally_require_metasploit_db_gem_engines