hunt-rce – Security skill for AI agents

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Autonomous Testing Priority

Content-type is the #1 silent failure mode for command injection.

Traditional web forms use Content-Type: application/x-www-form-urlencoded. If you send a JSON body ({"host":"127.0.0.1;id"}) to a form endpoint, the server reads request.form['host'] and gets nothing — the app executes normally with no injection, potentially returning a plausible 200 response. You get a false negative with no indication anything went wrong.

Rule: Capture the legitimate request and preserve its actual encoding, method and CSRF/auth context. URL names and response JSON do not establish the accepted request content type.

Command injection operators to try (in order of prevalence):

value;id        ← Unix semicolon (most common)
value|id        ← pipe
value&&id       ← AND
value$(id)      ← subshell
value`id`       ← backtick

Candidate evidence: Unexpected OS command output (uid=N(username) gid=...) in the response body confirms code execution. The output may be HTML-wrapped — that still counts. If the response is otherwise normal (200, expected content) with the command output appended or embedded, use a unique non-sensitive marker and a control request to rule out reflection, static text or a scanner intermediary.

---

Candidate High-Impact Surfaces

Imported payout, report-count and historical case assertions are not verified guarantees. Assess actual permissions and prerequisites; banners, configuration strings, and frontend JS are leads, not server RCE proof. Browser JavaScript execution is a different boundary.

RCE vulnerabilities command the highest payouts in bug bounty programs because they grant attackers direct execution control over target infrastructure. The highest-value targets are:

Highest-paying asset types:

• Enterprise server products (GitHub Enterprise Server, self-hosted GitLab) — privilege escalation chains from low-privileged console roles to root SSH access consistently pay critical/high
• Supply chain / package registries — dependency confusion attacks against npm, PyPI, etc. hit critical severity across every major program
• Cloud-native infrastructure — exposed Kubernetes API servers, ingress controllers, and misconfiqured CI/CD pipelines
• Mobile app backends and OAuth flows — where server-side processing of attacker-controlled data meets execution contexts
• Admin/management consoles — template injection in configuration panels reaches root with a single payload

Why this class pays most:

• Blast radius is infrastructure-wide, not user-scoped
• Proof-of-concept is unambiguous — shell output is undeniable
• Fix requires architectural changes, not just a patch
• Programs cannot afford false negatives on RCE

---

Attack Surface Signals

URL Patterns

/management-console/*
/admin/settings/*
/api/v*/exec
/api/v*/run
/webhook/*
/_internal/*
/import?url=
/render?template=
/preview?format=

Response Headers / Tech Stack Signals

X-Powered-By: Express          # Node.js — npm dependency surface
X-Powered-By: Phusion Passenger
Server: nginx (ingress-nginx)  # Kubernetes ingress — path field injection
X-Runtime: Ruby                # Rails ActiveStorage, RDoc, REXML attack surface
Content-Type: application/yaml # YAML parsers (SnakeYAML, Psych) — deserialization
X-GitHub-Enterprise-Version    # GHAS — nomad template, collectd, syslog-ng injection

JavaScript / Frontend Signals

// Look for these patterns in JS bundles
fetch('/api/exec', {method:'POST', body: cmd})
eval(userInput) <!-- security-allowlist: documented payload technique reference, do not execute outside authorized scope -->
new Function(userInput)
document.write(unsafeData)
window.location = userControlled  // URL scheme bypass → JS execution

Tech Stack Signals

| Signal | RCE Vector |

|--------|-----------|

| nomad in config UI | Template injection → {{ ... }} |

| syslog-ng config editable | Config injection → program() destination |

| collectd config editable | Plugin exec injection |

| SnakeYAML in classpath | !!javax.script.ScriptEngineManager [...] |

| npm package.json internal scope | Dependency confusion |

| ingress-nginx annotations | Path field regex bypass |

---

Step-by-Step Hunting Methodology

1. Map the execution contexts first. Before testing payloads, identify everywhere user-controlled input touches an execution layer: template engines, shell commands, YAML parsers, file paths used in operations, package resolution, and configuration files.

2. Enumerate admin/management interfaces. Crawl for /management-console, /admin, /_internal, /setup, /config. These surfaces are lower-auth and higher-privilege — the GHES cluster produced 6 separate RCEs from one console role.

3. Check template injection in every config field. In any management UI that accepts free-form configuration (log destinations, notification formats, proxy settings), submit {{7*7}}, ${7*7}, <%= 7*7 %>. Look for 49 in responses, logs, or DNS callbacks.

4. Test YAML/XML/serialized input for code execution. Any endpoint accepting Content-Type: application/yaml or application/xml:

• SnakeYAML: submit !!javax.script.ScriptEngineManager gadget
• Ruby YAML: submit !ruby/object:Gem::Installer gadget
• REXML: do not use resource-exhaustion XML on live systems; use a bounded lab reproduction

5. Hunt dependency confusion. For every npm/pip/gem internal package name visible in JS bundles, error messages, or package.json in public repos — do not register target package names or publish install hooks without explicit supply-chain testing authorization. Prefer an isolated registry/build reproduction.

6. Check file path operations for traversal → execution. ActiveStorage, file upload handlers, symlink operations: use an agreed disposable canary path; do not write cron entries or persistence. Execution testing requires a separately authorized controlled plan.

7. Audit Kubernetes/cloud-native surfaces. Use only the explicitly scoped API server and assigned test identity. Public reachability does not authorize access. Check ingress annotations, especially nginx.ingress.kubernetes.io/configuration-snippet and spec.rules.http.paths.path for Lua/regex injection.

8. Test OAuth redirect URI and URL scheme handlers. Mobile apps processing javascript: or intent:// URIs via OAuth redirect may execute JavaScript. Try javascript:alert(document.cookie) and custom scheme URIs.

9. Verify with out-of-band callbacks. Use independent evidence when needed; an OOB callback alone can be SSRF rather than command execution. Use Burp Collaborator, interactsh, or canarytokens.org DNS tokens. Blind RCE is common in backend processors.

10. Chain privileges. A low-severity misconfiguration (editor role, CSRF, path traversal) combined with an RCE primitive equals critical. Do not pivot or escalate beyond authorized boundaries; stop after sufficient minimal proof.

---

Payload & Detection Patterns

Template Injection Probes

# Generic polyglot — works across Jinja2, Twig, Freemarker, Pebble, Velocity
{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}
{{'7'*7}}
{{config}}
{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}}

# Nomad template injection (Go text/template)
{{ env "NOMAD_SECRET_ID" }}
{{ with secret "secret/data/prod" }}{{ .Data.password }}{{ end }}
{{ runscript "id" }}

Apache HTTP Server alias path traversal (CVE-2021-41773 / CVE-2021-42013)

Path normalization bug in Apache 2.4.49 (and the 2.4.50 patch-bypass) lets an attacker escape DocumentRoot via dot-encoded segments through configured alias paths. Directory access controls and CGI configuration are additional prerequisites; banners alone cannot establish patch state. The same primitive yields different impact depending on the configured alias:

• Alias without Options +ExecCGI (e.g. /icons/) → arbitrary file read only
• Alias with Options +ExecCGI (e.g. /cgi-bin/) → arbitrary code execution

Version fingerprint:

… (full content is in the download package)