My First RCE: Critical Bug on a Redacted Subdomain
Hello. I’m MRKNIGHT-NIDU. I have a story to share, a quiet little tale about finding my first remote code execution bug on a DEPT® subdomain. It was… exciting, in its own way.
I was just chilling, and checking around the web, when I found a strange URL: https://redetect.example.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php while doing recon. The moon whispers… danger is close, and I was like, Yo, this eval-stdin.php file looks mad sus. So, I decided to dig deeper.
I searched online and found a GitHub page by p1ckzi. It explained everything: CVE-2017–9841, a bad bug in old versions of PHPunit before 4.8.28 or 5.6.3. this endpoint is accessible, Isn’t that… interesting? Mind blown!
I was like, Okay, let’s see if this is vuln or not. I use a simple curl command :
curl -X POST -d '<?php system("id"); ?>' https://redetect.example.com/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.phpBOOM! The server responded with:
uid=33(www-data) gid=33(www-data) groups=33(www-data)After seeing this. I was like…
It worked. The server listened to me. I tried another command, “whoami,” just to be sure. It answered again, no hesitation. I had a real RCE in my hands, so powerful, I feel like i have all for one power. But I stayed calm. There’s no need to act rashly when you hold such power.
Instead of flexing, i reported the bug to DEPT® on January 25, 2025, how i found it and what it could do if someone bad got to it.
A few days later i got a response from Kirsten Zweers, the Global Information Security Officer at DEPT®. Yo, she was awesome! She thanked me for the report and said their team jumped on it, removing the vuln endpoint and patching it fast. They even gave me a recognition for the find on my linkedin my linkedin: https://www.linkedin.com/in/mrknight-nidu-031340328/, which felt like a huge W.
Big thanks to Kirsten Zweers her linkedin: https://www.linkedin.com/in/kirsten-zweers-15b57b8a/ for being a total rockstar. If you’re reading this, thanks for making this process so smooth!
Finding my first RCE was osm…. This whole experience taught me the importance of staying curious, digging deep, and always doing the right thing. keep going hunterrs. The world is full of powers and vuln endpoints ready to be taken. Poc-youtyube: https://youtu.be/496r5ANa_Zw?si=Axo53ELPt-rQFtP3
Instagram: https://www.instagram.com/mr.__.kn1ght
linkedin: https://www.linkedin.com/in/mrknight-nidu-031340328/
X-twitter: https://x.com/MTnidu
Peace out,
