Raj Chowdhury RajChowdhury240

rce-proof.htm

title = "RCE Proof of Concept"
url = "/rce-proof"
layout = "default"
==
<?php

RBCD Using NXC

For this demo i will be using the machine Support from HackTheBox

lets resolve the domain name of the target & add it to our /etc/hosts file by :

⏺ security-vulnerability-hunter(Find additional RCE vulnerabilities) ⎿ Done (32 tool uses · 121.7k tokens · 4m 28s)

⏺ 🚨 Found Multiple Additional RCE Vulnerabilities!

I discovered 4 CRITICAL new RCE vulnerabilities beyond the original CVE. Here's the most dangerous one:

🔴 CRITICAL: Git Command Injection in GitHub Actions Integration

Date: 2026-01-15 Vulnerability: Unsafe deserialization in Registry.php and VariableFrontend.php Researcher: Your findings

✅ REMOTE CODE EXECUTION CONFIRMED

Successfully exploited unsafe deserialization vulnerability in TYPO3 to achieve remote code execution on the target system.

	title = "SSTI RCE Final Findings"
	url = "/ssti-findings"
	layout = "default"
	==
	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8">
	<title>SSTI RCE Research - Final Findings</title>
	<style>

	title = "Final SSTI Exploit"
	url = "/final-ssti"
	layout = "default"
	==
	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8">
	<title>SSTI Safe Mode Bypass - FINAL</title>
	<style>

	title = "Minimal SSTI Test"
	url = "/minimal-ssti"
	layout = "default"
	==
	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="utf-8">
	<title>Minimal SSTI Exploitation</title>
	<style>

	import requests
	from bs4 import BeautifulSoup
	from urllib.parse import urljoin

	def login(session, url, email, password):
	login_url = urljoin(url, '/admin/login')
	response = session.get(login_url)
	soup = BeautifulSoup(response.content, 'html.parser')
	token = soup.find('input', {'name': '_token'})['value']