https://justice-reaper.github.io/posts/Insecure-Deserialization-Lab-7/
Exploiting Ruby deserialization using a documented gadget chain - Justice-Reaper