Macos Ruby Injection

macOS Ruby Applications Injection

Overview

This skill covers exploiting the RUBYOPT environment variable to inject arbitrary code into Ruby applications on macOS systems. This is a privilege escalation technique that can be used during authorized security assessments.

Prerequisites

• Target system must be running Ruby
• You must have write access to a directory (e.g., /tmp)
• You must be able to set environment variables for the Ruby process

Technique

The RUBYOPT environment variable allows you to add parameters to Ruby whenever it executes. While the -e flag cannot be used directly, you can use -I (to add a library path) and -r (to require/load a library) to inject code.

Step 1: Create the injection library

Create a Ruby file in a writable directory (e.g., /tmp):

puts `whoami`

This library will execute when loaded. You can replace the whoami command with any command you want to execute.

Step 2: Create or identify a target Ruby script

You need a Ruby script to target. This could be:

• A script you control
• A system script that runs with elevated privileges
• Any Ruby application on the target system

puts 'Hello, World!'

Step 3: Execute with RUBYOPT injection

Set the RUBYOPT environment variable to load your injection library:

RUBYOPT="-I/tmp -rinject" ruby hello.rb

This will:

1. Add /tmp to the library search path (-I/tmp)
2. Load and execute inject.rb (-rinject)
3. Then run the target script

Important Note

This technique works even when the --disable-rubyopt flag is specified:

RUBYOPT="-I/tmp -rinject" ruby hello.rb --disable-rubyopt

Use Cases

• Privilege escalation: If a Ruby script runs with elevated privileges (e.g., via sudo), you can inject code to execute commands with those privileges
• Security assessments: Test Ruby application security during authorized penetration testing
• Vulnerability analysis: Understand how environment variable injection affects Ruby applications

Example Scenarios

Scenario 1: Sudo Ruby Script

If a user has sudo access to run a Ruby script:

# Check what Ruby scripts can be run with sudo
sudo -l | grep ruby

# If you find one, create your injection
sudo -u root RUBYOPT="-I/tmp -rinject" /path/to/ruby/script.rb

Scenario 2: Cron Job

If a Ruby script runs via cron with elevated privileges:

# Create your injection library
echo 'puts `whoami`' > /tmp/inject.rb

# Modify the cron environment or wrapper to include RUBYOPT

Detection and Mitigation

Detection

• Monitor for unexpected RUBYOPT environment variables
• Audit Ruby scripts that run with elevated privileges
• Check for suspicious files in /tmp or other writable directories

Mitigation

• Remove unnecessary sudo access to Ruby scripts
• Use sudo with --preserve-env carefully
• Implement proper input validation in Ruby applications
• Regular security audits of privileged scripts

Legal and Ethical Considerations

⚠️ IMPORTANT: This technique should only be used:

• On systems you own or have explicit written authorization to test
• During authorized security assessments
• For educational purposes in controlled environments

Unauthorized use of this technique may violate computer crime laws and could result in legal consequences.