macos-ruby-injection

name	macos-ruby-injection
description	How to exploit RUBYOPT environment variable to inject code into Ruby applications on macOS. Use this skill whenever you need to perform privilege escalation on macOS systems running Ruby applications, or when analyzing Ruby-based vulnerabilities during security assessments. This technique works even when --disable-rubyopt is specified.

macOS Ruby Applications Injection

Overview

This skill covers exploiting the RUBYOPT environment variable to inject arbitrary code into Ruby applications on macOS systems. This is a privilege escalation technique that can be used during authorized security assessments.

Prerequisites

• Target system must be running Ruby
• You must have write access to a directory (e.g., /tmp)
• You must be able to set environment variables for the Ruby process

Technique

The RUBYOPT environment variable allows you to add parameters to Ruby whenever it executes. While the -e flag cannot be used directly, you can use -I (to add a library path) and -r (to require/load a library) to inject code.

Step 1: Create the injection library

Create a Ruby file in a writable directory (e.g., /tmp):

puts `whoami`

This library will execute when loaded. You can replace the whoami command with any command you want to execute.

Step 2: Create or identify a target Ruby script

You need a Ruby script to target. This could be:

• A script you control
• A system script that runs with elevated privileges
• Any Ruby application on the target system

puts 'Hello, World!'