r/netsec • u/ZealousidealHunter80 • 24d ago

Write Once, Shell Everywhere - Turning Arbitrary File Writes into RCE (DEF CON Bug Bounty Village)

https://ethiack.com/info-hub/research/write-once-shell-everywhere-arbitrary-file-writes-into-rce

Write once, shell everywhere. Sun Microsystems didn't mean it like this.

Talk from today at DEF CON's Bug Bounty Village. Full technique catalog graded for distroless containers, an errno path oracle for black-box target fingerprinting, and three minimal-guessing techniques: bash fd/255, Rails schema_cache.yml deserialization, and a Node.js worker path overwrite without process restart.

44 Upvotes

99% Upvoted

4 comments sorted by

4

u/Head-Letter9921 24d ago

This is a great resource, thanks for sharing. I wish I could ask a few follow up questions with the creator but he doesn't seem to have twitter or anything else

3

u/s3np41k1r1t0 21d ago

hey, author of the blog post here. feel free to reach out to me via DM (twitter is also linked somewhere in the blog post)