Updated ruby gadget for marshal loading

[leonardo-doyensec]

Hello @p- , my name is Leonardo, I'm an Application Security Engineer @ Doyensec.
In the previous weeks I've doing some research around ruby deserialization, and I've noticed that the Marshal gadget was not working anymore on the latest ruby version. So I've adapted it.

Essentially the major change is that the kick-off gadget (Gem::Specification) is now calling safe_load making impossible to continue the exploit chain.
Since the rest of the exploit is untouched, I've been searching for a similar gadget that called to_s once deserialized. I've found it in Gem::Version.
The only problem with it is that it will throw an exception after the folder creation (which is the first stage of the exploit). Hence two separate loads are required.

Another problem arising is that the URI module is not present anymore in ruby as default. Hence, we need to import net/http. I think this is a fair assumption since with this exploit we will target mostly web applications (whether rails or sinatra) that will import this module.

Contacts:
Twitter
Doyensec

[p-]

Hey @leonardo-doyensec 👋

Sounds great!
I've added some minor nitpicks. (comment out calls of marshal.load)

Thanks!

[leonardo-doyensec]

Hello @p-, i've added the changes that you have requested