Ruby 2.x Universal RCE Deserialization Gadget Chain

This exercise delves into the fascinating realm of Ruby deserialization based on Luke Jahnke's research. Traditionally, exploiting deserialization vulnerabilities in Ruby required relying on specific Rails libraries or discovering gadgets within the libraries in use. However, Luke Jahnke's innovative approach enables code execution without external dependencies, as long as data is controlled in a call to Marshal.load(...).

The exploitation process involves crafting a set of gadgets that ultimately invoke the Kernel.open method, allowing arbitrary command execution. By modifying a provided script, learners can generate the necessary gadget to execute their desired command, providing a practical and hands-on understanding of this vulnerability. This exercise serves as an invaluable testbed for honing skills before encountering such issues in real-world penetration tests.