Hey Hunter's,
DarkShadow is here back again!

RCE in tcp connection (rocketMQ protocol)

You guys are always hunt vulnerabilities in HTTP/HTTPS connections right?

Try different:
1. Find your target in scope all ip address
2. Enumerate  all service
3. Grep all ip address which are using any tcp connection service's.
4. Note all ip, ports and service versions.
5. Start to read the service official documentation that how it's works.
6. Use tool ncat, socat or python noscript for sending request to testing.

Now come back to the POC:
1. Make a .bin file where save the payload.
2. Use ncat to send the request.
3. In burp collaborator the user-agent is curl means clear blind RCE.

Guy's make 300 reaction in this post then I'll made my next post that how you find bugs in tcp connection more deeply.

#bugbountytips #rce