macOS Ruby Applications Injection

Overview

This skill covers exploiting the

RUBYOPT

environment variable to inject arbitrary code into Ruby applications on macOS systems. This is a privilege escalation technique that can be used during authorized security assessments.

Prerequisites

• Target system must be running Ruby
• You must have write access to a directory (e.g.,

  /tmp

  )
• You must be able to set environment variables for the Ruby process

Technique

The

RUBYOPT

environment variable allows you to add parameters to Ruby whenever it executes. While the

-e

flag cannot be used directly, you can use

-I

(to add a library path) and

-r

(to require/load a library) to inject code.

Step 1: Create the injection library

Create a Ruby file in a writable directory (e.g.,

/tmp

):

puts `whoami`

This library will execute when loaded. You can replace the

whoami

command with any command you want to execute.

Step 2: Create or identify a target Ruby script

You need a Ruby script to target. This could be:

• A script you control
• A system script that runs with elevated privileges
• Any Ruby application on the target system

puts 'Hello, World!'

Step 3: Execute with RUBYOPT injection

Set the

RUBYOPT

environment variable to load your injection library:

RUBYOPT="-I/tmp -rinject" ruby hello.rb

This will:

1. Add

   /tmp

   to the library search path (

   -I/tmp

   )
2. Load and execute

   inject.rb

   (

   -rinject

   )
3. Then run the target script

Important Note

This technique works even when the

--disable-rubyopt

flag is specified:

RUBYOPT="-I/tmp -rinject" ruby hello.rb --disable-rubyopt

Use Cases

• Privilege escalation: If a Ruby script runs with elevated privileges (e.g., via sudo), you can inject code to execute commands with those privileges
• Security assessments: Test Ruby application security during authorized penetration testing
• Vulnerability analysis: Understand how environment variable injection affects Ruby applications

Example Scenarios

Scenario 1: Sudo Ruby Script

If a user has sudo access to run a Ruby script:

# Check what Ruby scripts can be run with sudo
sudo -l | grep ruby

# If you find one, create your injection
sudo -u root RUBYOPT="-I/tmp -rinject" /path/to/ruby/script.rb

Scenario 2: Cron Job

If a Ruby script runs via cron with elevated privileges:

# Create your injection library
echo 'puts `whoami`' > /tmp/inject.rb

# Modify the cron environment or wrapper to include RUBYOPT

Detection and Mitigation

Detection

• Monitor for unexpected

  RUBYOPT

  environment variables
• Audit Ruby scripts that run with elevated privileges
• Check for suspicious files in

  /tmp

  or other writable directories

Mitigation

• Remove unnecessary sudo access to Ruby scripts
• Use

  sudo

  with

  --preserve-env

  carefully
• Implement proper input validation in Ruby applications
• Regular security audits of privileged scripts

Legal and Ethical Considerations

⚠️ IMPORTANT: This technique should only be used:

• On systems you own or have explicit written authorization to test
• During authorized security assessments
• For educational purposes in controlled environments

Unauthorized use of this technique may violate computer crime laws and could result in legal consequences.