92
votes
Accepted
Unusual mail headers show evidence of MTA attack. Have I been pwned?
This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit ...
- 208k
5
votes
Accepted
Does the log4j RCE vulnerability run even if the message is just a part of the logged string?
Will this code be affected by the exploit?
Yes.
From the LunaSec's announcement of the RCE, the line that triggers the exploit uses a parameter:[1]
// This line triggers the RCE by logging the ...
- 312
5
votes
(How) is it possible to let portable communication devices detonate via software?
Depending on exactly how the device was built and what functionality is available, it may be possible to cause it to overheat or fail in some other destructive way, especially with custom firmware. ...
- 16.6k
4
votes
Accepted
Are alphanumeric strings safe to pass to a bash script?
Tl,DR: Yes. But beware that you misunderstand what's going on and this may be a source of vulnerabilities.
An argument of a program can be an arbitrary byte string that doesn't contain a null byte. ...
4
votes
Accepted
Is this a remote code execution vulnerability?
Yes, I think it is vulnerable, or there's something wrong anyway. Here's why.
That guy (or girl) is suggesting that his machine has been compromised because of some RCE. We don't know if that's true, ...
- 15.9k
4
votes
Accepted
Why is the first step for an attacker to get Reverse Shell after getting RCE?
Remote code execution means you have successfully executed some specific code on the server. It does not mean you can execute anything else on the server, yet. The solution is to have the executed ...
- 67.3k
4
votes
Accepted
Log4shell - Should affected servers be "nuked from the orbit"?
... or is this overkill plus a huge waste of time
The fully depends on how well you know your own infrastructure, how good your monitoring is for attack detection and what proactive mitigations you ...
- 208k
4
votes
Accepted
Can one protect from the Log4j exp by sanitizing the parameters?
Client-side sanitization?
Sanitizing parameters is important, but the challenge associated with this particular vulnerability is that it can be exploited using parameters that are not typically ...
- 156
3
votes
Is there any way an attacker can access the server and modify the site (php) code?
Via uploading a file and executing it. Review uploads, php enabled functions and use 'noexec' (in UNIX/Linux) mount option on filesystem. If your app must execute local binaries, create a regular job ...
- 151
3
votes
Why is the first step for an attacker to get Reverse Shell after getting RCE?
In addition to @forest's answer, the initial remote code execution method is often blind, with no access to command output. Bootstrapping up into a remote shell means gaining access to command ...
- 73.3k
3
votes
Who is at risk from the PrintNightmare RCE?
All the news articles describing the RCE are implying that any internet-connected computer running Windows is at risk.
First, what you have stated here is not true.
The article that you yourself ...
- 5,256
3
votes
Exploitation tactics for heap over-reading?
There are two distinct questions here:
How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do?
How severe is the ...
3
votes
Accepted
Arbitrary command execution on remote devices
Short answer is no, long answer is depends.
Short answer: no, that's not how systems works. You need authorization to run commands on systems, and if you don't have authorization, you cannot run ...
- 55.5k
2
votes
Accepted
How to exploit RCE vulnerability for machine on local network
It could be that some of the outgoing traffic from the server is blocked. Upon gaining a RCE there are various techniques to check if you can get a connection back:
Try ping yourdomain.xx - Check if ...
- 1,022
2
votes
Accepted
Dangers of Electron's "shell.openExternal" on untrusted content
I think your confusion stems from your interpretation of the term "remote code execution" (RCE). This term is used to describe (perhaps colloquially) many different classes of critical software ...
- 13.2k
2
votes
Accepted
New York Times article about FBI secretly removing malware from U.S. corporate servers - would this indicate they have a government backdoor?
Would this indicate that the U.S. government has the ability to control the binaries installed on privately owned computers "at will", and that they thus have a backdoor to those computers?
...
- 208k
2
votes
Python Code Injection With int()
Is there a string that I could pass to the int() constructor that would somehow be converted into an anonymous class (i.e. is there any kind of special string notation to represent an anonymous class)?...
- 21
2
votes
Accepted
How can malicious user change file on server without it being logged in server logs and how to protect against it?
From what i know, it's generally only possible to modify a file on server using PUT or POST request, and only if server allows it.
If your server accepts incoming data in any form, and a security ...
- 17.6k
1
vote
Would a base64ed code work inside an images metadata?
That will likely not work. The question of "Why not?" shall be answered with another question: "Why would it?"
Computers do what we tell them to do. I highly doubt there is any ...
- 145
1
vote
Accepted
Uploading/writing server files via SSRF?
My question is, using the file:// scheme, can I modify files, or just read them?
A file: URI is just a way to specify a local path. Your question boils down to "using a file path, such as C:\...
- 52.1k
1
vote
How to completely restrict Steam in Linux to defend against remote zero day exploits?
How can I completely restrict Steam
Setup new computer that is dedicated to Steam and Gaming
Setup an isolated subnet for your Steam computer to reside
on. Most enterprise routers would be capable of ...
- 8,275
1
vote
How to completely restrict Steam in Linux to defend against remote zero day exploits?
You have NOT fully secured your [supposedly personal] box for a loooong list of reasons. Nor you should have, really - you have probably achieved a reasonable level of security there.
IF it is ...
- 143
1
vote
Attempting remote code execution, why does this php webshell code fail with single quotes?
Without seeing the code you're injecting into, it's hard to tell. It would be nice to see your entire payload too.
To be clear, the parameter name, cmd in this case, does not need to be enclosed in ...
- 173
1
vote
How does Local File Inclusion (LFI) work?
Let's suppose that the english.php is the default page.
The condition if (isset($_GET["key"]) && isset($_GET["email"]) && isset($_GET["language"]) &&...
- 612
1
vote
How does Local File Inclusion (LFI) work?
Most linux distros/web servers have safe file permissions on logs. You would need to be root to read the access log. Exploitation is a puzzle, but you can just superglue various behaviours together as ...
- 5,989
1
vote
Is there any way an attacker can access the server and modify the site (php) code?
Yes there is an option the attacker accessed the files and modified them. Check log files on the server which files were modified and how, compare them because probably he left an backdoor so he can ...
- 162
1
vote
Accepted
Rogue network printers as an attack vector in windows
Windows only automatically installs drivers that have been digitally signed. Unsigned drivers, drivers that have invalid signatures and drivers that have been signed by untrusted publishers are not ...
- 11.6k
1
vote
Accepted
Dealing with a large number of bad chars
It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature ...
1
vote
Deserialization Opportunity?
This looks more like a bug in the application which is ignored or handled by the server rather than something exploitable.
This code (in c#)
List<string> list = new List<string>();
list....
- 161
Only top scored, non community-wiki answers of a minimum length are eligible