Questions tagged [code-execution]

The process of executing code, either maliciously or not, on a system or device. The term is often used when talking about code injection vulnerabilities.

Filter by
Sorted by
Tagged with
1
vote
1answer
51 views

How much protection does sandbox software provide against malicious .exe?

I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
0
votes
0answers
102 views

What is the risk of allowing user input in Python's 're' module

Some context I'm currently building an application which lets user's set up dynamic, queries they can execute later. A great addition to this seems like a regex module, in which users can filter ...
0
votes
0answers
53 views

Is php code with such features vulnerable to RCE?

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library. Here are the things I found I can make this library do for me: Include (include_once call) any ...
0
votes
2answers
103 views

Why Empire Launcher payload is not working in system() in PHP?

Technical details:- Created a parameter passing through system() i.e. cmd. Now I run Empire tool with http listener and launch powershell launcher. Got the huge bunch of base64 encode string. Now I ...
0
votes
1answer
53 views

PHP code execution attempts on an ASP website

I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
7
votes
1answer
210 views

Can I inject a shell command here in PHP?

During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec() $arg = $_GET['arg']; // sanitization, I suppose... if(...
1
vote
0answers
59 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
2answers
159 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
2
votes
1answer
104 views

How do services prevent malicious behavior when executing user provided code?

Some services such as Github allows the execution of user supplied code using docker containers via Github Actions. Another example of a service provider that executes user provided code are ...
2
votes
1answer
68 views

PHP Code execution in function parameters and logical operators [closed]

After wondering about this and trying to better understanding, I tried the folowing code: is_string(3 and sleep(30)); Why PHP will execute code inside a parameter function (sleep in is_string) ? ...
0
votes
1answer
134 views

How to fix WordPress CVE vulnerabilities or preventive measures?

I have a WordPress site r,unning on version 4.9.8. In the recent security audit done by the organization following issues were reported. 1) Wordpress: CVE-2017-1000600: Input Validation vulnerability ...
1
vote
2answers
115 views

How can memory problems lead to code execution exploits? [closed]

In reports on security exploits/vulnerabilities on desktop applications, I often read that memory problems lead to the execution of malicious code. For example, the description of Internet Explorer ...
1
vote
3answers
106 views

Binary to ASCII encoding for making files non executable

Isn't it a good idea to transfer eg an .wav file, which can carry malware inside (header, data etc.), to ASCII text file via hexdump? I would have achieved a non-executable format. It is still ...
3
votes
1answer
55 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
1
vote
0answers
32 views

Web application secrets protection following code execution

I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
2answers
773 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
2
votes
1answer
283 views

PHP command injection create_function eval

I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example. The code below should return the ...
1
vote
1answer
48 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
1
vote
1answer
115 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
0
votes
3answers
128 views

Executable files in email attachments on UNIX

.EXE files are a danger in email attachments, and are usually blocked by Windows email clients. How is this on UNIX/macOS, where executables don't have an extension? Based on the file data, how do ...
0
votes
1answer
62 views

Compiler Parameters to isolate a C++ program

Is there any set of compiler parameters that can be used to prevent a C++ program from having any access to most system functions, leaving it with access to read/write to stdin/stdout, but otherwise ...
3
votes
2answers
2k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
2
votes
2answers
73 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
3
votes
2answers
193 views

How to respond when network info sec check requires run of downloaded unknown .exe?

I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi. On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) ...
0
votes
1answer
84 views

Programmatically Quarantining files

Situation: Using Python to make a simple quarantine software for malware. What I know: I do understand (from this forum no less) that one of the ways is to put the file in a quarantine directory and ...
0
votes
1answer
198 views

Electron Framework vulnerability - Explaining remote code execution

Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now ...
11
votes
1answer
566 views

PHP eval code sandbox break

I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php function eval_syntax($code) { $braces = 0; $inString = 0; // We need to know if ...
-1
votes
1answer
99 views

How to find which program encrypted my files? [closed]

I've been infected by a ransomware and all files have extension .lin. how can i find the program that encrypted my files ?
-3
votes
1answer
520 views

How to execute PHP file after uploading it? [closed]

I have found an endpoint on a website that allow me to upload files. This endpoint didn't have any kind of protection against malicious file upload. So, I uploaded a PHP shell, but the problem is when ...
6
votes
2answers
3k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
3
votes
2answers
6k views

Adding network drive to trusted intranet sites security hole?

We have a shared network drive that is mapped, and when we open certain files we get a dialog like I found this site which explains that adding the network path to Local Intranet trusted sites for ...
1
vote
0answers
456 views

Bufferoverflow attack shell code address calculation

I've completed a bufferoverflow attack by injecting shellcode into buffer, and executing exploit by: ./binary $(python -c 'print overflow +shellcode + adressofshellcode') Above exploit is working ...
8
votes
4answers
4k views

Execute a PHP function that returns an array from an XSL file

There is a security challenge where you have to execute code on the server to retrieve a flag, and this code has to be executed using an XSL document. So I found a way to make the server interpret my ...
1
vote
1answer
288 views

SERVER-IIS multiple extension code execution attempt

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
0
votes
2answers
207 views

Is it safe to open virus infected EXE with Telerik JustDecompile?

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it ...
5
votes
2answers
4k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
7
votes
2answers
5k views

Can a CSV contain malicious code?

I am working with a system that allows users to upload CSV files, that are downloaded by other users. The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 ...
1
vote
0answers
58 views

What was the root cause for the recent (March 2017) Struts2 file upload vulnerability (S2-045)?

The recent Struts2 vulnerability allowed remote code execution by providing a bogus Content-Type header, as explained here: https://threatprotect.qualys.com/2017/03/08/apache-struts-jakarta-multipart-...
1
vote
1answer
542 views

Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters?

To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is: Motivation Assume your server was hacked, you open up your UTF-8 encoded ...
2
votes
2answers
498 views

Can a zipped malware execute?

I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute ...
4
votes
1answer
572 views

Special characters in filename leads to starting virus executable [duplicate]

So I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in ...
0
votes
1answer
86 views

Malicious Twilio XML response object [closed]

So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio....
1
vote
1answer
165 views

Large header/footer of shellcode bytes when going from x86 asm to exe?

I coded a simple bash shell in x86 and compiled it via nasm and ld into an exe. When I do this I can see the 31 bytes of instructions that I actually made but there are 100's of bytes before and after ...
2
votes
2answers
799 views

Understanding preg_replace Filtering & Exploitation

Here is the proof of concept of the code: <?php $input=$_GET['input']; print preg_replace('/[A-DH-M0-9._%+-]+@(.+)\.[A-Z]{2,4}/mADsex', 'strtoupper("\\1")', $input); ?> I don't quite ...
1
vote
2answers
898 views

Changing file extensions in PHP file upload to prevent code execution?

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
2
votes
2answers
211 views

With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server?

Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of ...
2
votes
3answers
912 views

Verify “blind” code execution works

Suppose the following situation: You're doing a black-box pentest. You found that the customer runs software X and X has a remote code execution vulnerability, but the nature of this code execution is ...
2
votes
1answer
393 views

Dynamic forking of a process in win32 vs modern antiviruses

Most tutorials about crypters assume that popular antiviruses don't scan programs executed directly from memory. However from what I've seen, some of them (e.g. Nod32) are able to scan RAM in search ...
4
votes
4answers
6k views

Removing execute permissions on `/tmp` or mounting it with `noexec` flag?

The CIS security benchmark recommends mounting /tmp and all other world writable directories on a separate partition so it could be mounted with the noexec flag. Since I already have my /tmp mounted ...
6
votes
1answer
717 views

How to restrict dlopen() from or to certain paths?

If I want to disable execution of programs on a filesystem, I can use the noexec mount option. However, this doesn’t works with dynamic libraries loaded throughdlopen(). So what is the way to do it ...