91

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit you encountered. You are safe if you are not using EXIM or run a fixed version. From the linked article (emphasis added): This vulnerability is exploitable ...


3

There are two distinct questions here: How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do? How severe is the vulnerability? In other words, if you can trigger it, what can you do with it? The answer to the first question is: very easy. VLC is a video player, and you can ...


3

The reason why CVSS scores are high, even though an issue is difficult to exploit, is because CVSS ignores the likelihood of some things. For example, if an exploit requires the user to open a media file, it gets the attribute "User interaction required". An exploit that would require the user to ignore an explicit warning also gets the attribute "User ...


3

Tl,DR: Yes. But beware that you misunderstand what's going on and this may be a source of vulnerabilities. An argument of a program can be an arbitrary byte string that doesn't contain a null byte. The limitation with null bytes comes from the operating system. Depending on your programming language and its standard library, a null byte may be rejected, or ...


2

Yes, it is safe form an error-free perspective. As long as they are not special characters they should not influence anything. Take a look at the special characters listed here. If you do not use any of them in your string there should be no problem whatsoever.


1

It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature solutions. The exploit payload generator in Metasploit includes an encoding step which takes care of this: you tell it what characters to avoid and it builds a decoder ...


1

I think your confusion stems from your interpretation of the term "remote code execution" (RCE). This term is used to describe (perhaps colloquially) many different classes of critical software vulnerabilities that allow an attacker to execute arbitrary code or commands on a vulnerable system. The particular vulnerability may be a result of a memory ...


1

This looks more like a bug in the application which is ignored or handled by the server rather than something exploitable. This code (in c#) List<string> list = new List<string>(); list.Add("Hello"); list.Add("World"); Console.WriteLine(list.ToString()); Outputs: System.Collections.Generic.List`1[System.String] So it would appear that while ...


1

This boils down to a basic networking problem: if the exploit requires you to connect to a listening network service on the target (e.g. exploiting BlueKeep requires you to connect to the RDP service running on the target), you need a way to connect to the target by IP address. You mention the target is behind a NAT, and that port forwarding is not ...


1

Based on comments, I am assuming this is a LAMP stack (and will have to make a few more assumptions as well). I'll nudge you and others who find themselves here in the right direction :D How do I open a shell/what does that mean? In general, a shell (as described here) is a way to send arbitrary commands to the operating system and obtain output (results of ...


1

"Open a shell" means that you upload code to the site that it will run, which will give you command access to the server. There are shells you can download from various sites to meet your needs (PHP, Java, etc.). You upload the shell using the same process you used for RFI. The shell runs as the same user as the web service, so it should give you access to /...


1

Buffer overflows don't just occur with text, so it may be possible to pass an 'image' that exploits something in the image processing. Bad code always exists though...using OWASP has a good example page, and we can construct a simple function which could overflow: int main(int argc, char **argv) { char items = imageprocessor(); // process image seen ...


1

It could be that some of the outgoing traffic from the server is blocked. Upon gaining a RCE there are various techniques to check if you can get a connection back: Try ping yourdomain.xx - Check if your domains DNS query is executed by the victim server, if it is, that means you can setup a shell through DNS. You can use a tool like https://github.com/...


1

Remote exploits are exploits that you can run on an external machine. Local exploits are exploits that you can run only with access to the machine (f.e. Privilege Escalations). A remote exploit may be on a host inside an intranet, accessible only by few people, but also inside the internet, accessible by everyone.


Only top voted, non community-wiki answers of a minimum length are eligible