CVE-2016-2098

This Metasploit module exploits CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails ActionPack. It injects malicious ERB code into a JSON parameter, which is then evaluated on the server, leading to arbitrary code execution.

This repository contains a functional Go-based exploit for CVE-2016-2098, which targets a remote code execution vulnerability in Ruby on Rails' `render` method. The exploit constructs a malicious URL with an inline template injection payload to execute arbitrary shell commands on the target server.

The repository provides a technical explanation of CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails due to unsafe usage of the `render` method on user-supplied data. It includes details on exploitation via inline rendering and command injection, along with URL encoding examples.

This repository contains a functional Rails application demonstrating CVE-2016-2098, a vulnerability in Rails' render method that allows arbitrary file reads. The ExploitsController renders user-supplied input directly, enabling path traversal attacks.

This repository contains a functional Python script that exploits CVE-2016-2098, a command injection vulnerability in the 'inline' parameter of a web application. The script sends a crafted HTTP GET request with a malicious payload to execute arbitrary commands on the target system.

This repository contains a functional Python exploit for CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails. The exploit leverages the `render` function on user-supplied data to execute arbitrary commands via a crafted payload.

This repository contains a functional exploit script for CVE-2016-2098, which leverages Ruby on Rails' unrestricted use of the render method to execute arbitrary Ruby code. The script sends crafted HTTP requests to exploit the vulnerability and provides an interactive shell for command execution.

This repository contains a functional Proof of Concept (PoC) for CVE-2016-2098, demonstrating a remote code execution (RCE) vulnerability in Rails 4.2.5.1. The PoC includes a Rails application with a vulnerable endpoint that allows arbitrary code execution via crafted template parameters.

This repository contains a functional proof-of-concept for CVE-2016-2098, a remote code execution vulnerability in Rails 4.2.5.1. The exploit leverages unsafe template rendering via the `template[inline]` parameter to execute arbitrary commands.

The repository contains a functional Python-based exploit for CVE-2016-2098, which leverages an input validation error in Ruby on Rails' Action Pack to execute arbitrary Ruby code via the render method. The exploit constructs a malicious URL with an inline template injection payload and processes the response to extract output.

This repository contains a functional Python script that exploits CVE-2016-2098, an ERB template injection vulnerability, to achieve remote code execution (RCE). The script automates parameter detection, payload injection, and provides an interactive shell for command execution on the target system.

This repository contains a functional Python exploit for CVE-2016-2098, targeting Ruby on Rails ActionPack Inline ERB to achieve remote code execution. The exploit crafts a malicious JSON payload with base64-encoded Ruby code, which is then sent to a vulnerable endpoint.

This repository contains a functional exploit script for CVE-2016-2098, which allows remote code execution in Ruby on Rails applications by leveraging unrestricted use of the render method. The script sends a crafted HTTP request with an inline template to execute arbitrary commands on the target system.

This repository contains a functional Python-based exploit for CVE-2016-2098, which allows remote code execution in Ruby on Rails applications by leveraging unrestricted use of the render method. The exploit constructs a malicious URL with embedded Ruby code and processes the response to extract output.

This Metasploit module exploits a remote code execution vulnerability in Ruby on Rails ActionPack by injecting ERB code into a JSON parameter, which is then evaluated on the server. The payload is base64-encoded and executed via the `eval` function in the ERB template.