Capability primitives + state-space search
心法: RCE不是一个"漏洞",是一组"能力"凑齐后的涌现。没单点大洞时,几个info级/低危照样拼出代码执行。
固有思维(要打破): "扫不到RCE/反序列化/上传→这站打不动了"。你的活不是"找RCE漏洞",是"凑齐执行所需的原语"。
把每个Fact抽象成能力原语(不记"发现X漏洞",记"现在拥有什么能力+限制"):
read(path) write(path) exec(cmd) ssrf(url) sqli redirect(url) eval_expr idor(id) cred(svc,priv) coerce_auth write_acl
RCE只需满足任意一条等式,拆成可获取的原语去凑:
A. 能写文件 + 文件被当代码执行 = RCE
B. 能控配置/env + 配置指向你的代码 = RCE
C. 能进管理面 + 面板自带执行功能 = RCE(不是漏洞,是功能!)
D. 有凭据 + 服务有合法执行入口 = RCE(滥用合法功能)
E. 能任意读 + 读到凭据 + 凭据可登录执行点 = RCE
F. 能控数据 + 数据流入危险sink(eval/模板/SQL) = RCE
Low-severity→primitive mapping (translating "chicken-rib vulns" into puzzle pieces): info leak (.git/backup/stack)→source code/path/keys→feed into B/E/F | LFI/arbitrary read→read config keys→E, or log poisoning→A SSRF (even GET only)→hit internal Redis/Consul/K8s/cloud metadata→C; cloud metadata gets temporary credentials→D weak/default/reused credentials→get into a backend with task/plugin/webhook/CI functionality→C | CORS/CSRF/XSS→use the admin's browser to invoke execution-type functionality→C controllable upload (even with extension restrictions)→combined with path traversal/parsing discrepancy/.htaccess→A | config write→modify template/log/connection string→B SQLi (even read-only)→read hashes/keys→E, or OUTFILE→A | controllable template→SSTI→F | prototype pollution→pollute downstream properties→F
State-space search (search it yourself when there's no ready-made chain): state = current capability set, action = use capabilities to unlock new capabilities, goal = Goal. Forward: for each capability ask "what can it unlock?"; for each pair of capabilities ask "what can they combine into?" (read+write=modify config; ssrf+internal redis=RCE; sqli+FILE=webshell; coerce_auth+relay=domain SYSTEM; idor+massassign=modify others' admin) Backward (mainly used when stuck): lock onto Goal=execute command→pick the equation closest to the current state as a template→set whichever primitive is missing as a sub-goal→ which low-severity/functionality/info leak on hand can assemble it?→if it can't be assembled, recursively break it down/switch equations → forward and backward meet in the middle = the complete chain emerges → verify segment by segment
Breakthrough points (don't look away when you see them): ·"Functionality is a primitive": the backend's scheduled tasks/plugins/template editing/SQL console/file manager/import-export/webhook —— legitimate functionality, but once you log in it's a ready-made execution/read-write primitive. In a pentester's eyes there is no distinction between "functionality/vulnerability", only "capability". ·Cross-protocol jumping: SSRF's gopher/dict/file turns "can only send HTTP" into "hit Redis/send SMTP/read files". ·Credential reuse is universal glue: any password/key obtained anywhere is by default reused across the whole network, spray it all. Lateral movement is often faster than vertical. ·Parsing discrepancies: upload validation/routing/reverse proxy all understand things inconsistently→there are bypasses in the gaps (double extension/encoding/Host confusion). ·Time dimension: TOCTOU/predictable tokens/cache poisoning, turning "occasionally" into "reliably", turning unexploitable into exploitable. ·Cross-domain cashing out: for every capability obtained ask "how much is it worth in another domain"——capability is universal currency. Web SSRF→get into cloud metadata and take over the account; hardcoded APK→connect directly to internal API bypassing frontend auth; supply chain→get CI keys and get into production. ·Creative mode (when known combinations are exhausted): re-examine capability boundaries (can only read /var/log? what about /proc/self/environ) | find sinks equivalent to RCE (writing crontab/.bashrc/CI config/LD_PRELOAD/authorized_keys/systemd unit all = RCE) | use information (errors/timing/response length) as a side channel | negate assumptions: list "what I thought was impossible" and ask each one "why is it impossible"
The derived chain is a hypothesis (can be tentatively recorded as note/chain); only after actual execution + evidence is it written as a confirmed Fact / record_vulnerability. The whole chain holds only if every step has been verified.