4 ms·
I have remote code execution working when YAML syck parser is being used. I've also got RCE working when psych is used (default in 1.9.x) using a similar trick
by benmmurphy 14y ago
I have remote code execution working when YAML syck parser is being used. I've also got RCE working when psych is used (default in 1.9.x) using a similar trick to syck.
- vinhboy 14y agoI know you're not supposed to share these things, but I found it really useful how last time there were public PoC we could use to test our patches. Any such thing this time around?
- benmmurphy 14y agopostmodern just posted he found it on twitter. so i would expect public PoCs/metasploit code to be released soon.
- postmodern_mod3 14y agoHere you go: https://gist.github.com/4660248 https://gist.github.com/4660248
- vinhboy 14y agothanks
- deleted 14y ago[deleted]