> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-insecure-desiralization-labs/lab-6.md).

# lab-6

## Exploiting Ruby Deserialization Using a Documented Gadget Chain

**Difficulty:** Practitioner

### Lab Description

This lab uses a serialization-based session mechanism and the Ruby on Rails framework. Documented exploits exist that enable remote code execution via a gadget chain in this framework.

**Objective:** Find a documented exploit, adapt it to create a malicious serialized object with an RCE payload, then pass it to the website to delete the `morale.txt` file from Carlos's home directory.

**Credentials:** `wiener:peter`

### Root Cause

The application stores the user's session as a Ruby Marshal-serialized object inside a client-controlled cookie. When processing requests, it deserializes this cookie using `Marshal.load` without ensuring the data is trustworthy.

Ruby's `Marshal` format is intended only for trusted data. During deserialization, Ruby reconstructs objects and may invoke methods on them as part of restoring their state. If an attacker can replace the serialized data with a crafted object graph built from available framework classes (a gadget chain), these method calls can be chained together to perform unintended actions.

Because the application accepts and deserializes attacker-controlled serialized data, it is vulnerable to unsafe deserialization — allowing arbitrary behaviour during object reconstruction.

### Exploitation

1. Authenticate as a normal user and observe that the session cookie contains a Base64-encoded Ruby Marshal object.
2. Identify that the application uses Ruby on Rails / RubyGems classes known to form a documented deserialization gadget chain (publicly documented in CVE disclosures and exploit write-ups).
3. Use the documented exploit script to craft a malicious serialized object embedding the target command:

   ```
   rm /home/carlos/morale.txt
   ```
4. Encode the payload and replace the session cookie with the malicious value.
5. Send the request. The application calls `Marshal.load` on the attacker-controlled cookie, the gadget chain executes automatically as Ruby reconstructs the objects, and the payload runs under the application's security context.
6. The `morale.txt` file is deleted, completing the lab.

### Lesson Learned

* Never deserialize untrusted data using `Marshal.load`.
* Avoid storing serialized Ruby objects directly in client-controlled cookies.
* Prefer safer serialization formats such as JSON for untrusted data.
* If complex objects must be stored, use cryptographic signing and integrity protection to ensure data cannot be modified by clients before deserialization.
* Keep Ruby, RubyGems, Rails, and third-party libraries up to date, as gadget chains often depend on specific library versions that have been patched in newer releases.
* Minimise unnecessary libraries in production to reduce the number of gadget classes available to attackers.
* Apply the principle of least privilege so that, even if deserialization is abused, the application's OS permissions limit the impact.
* Monitor for anomalous deserialization errors, unexpected object types, and suspicious activity involving serialized session cookies, as these may indicate exploitation attempts.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-insecure-desiralization-labs/lab-6.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.