Ruby Security Field Guide

YAML Level 3

Congratulations! You've made it to level 3 of the YAML deserialization exploitation exercises! This challenge continues to build off of the concepts from the first two. Again pull down the work shop files using the link below, run the installation steps, and see if you can modify the exploitation.rb script file to land remote code execution on the app.rb remote rails app.

Installation Steps

    $ gem install bundler
    $ bundle install
    $ ./app.rb &
    $ ./exploit.rb <command>

Level 3 Files