# MECCHA CHAMELEON can't hide from the RCE

Blueprint-exposed Finish Recording Output in MECCHA CHAMELEON maps writes arbitrary files via path traversal and null-byte truncation, yielding delayed RCE via Startup folder HTA.

- Payout: Research
- Severity: high
- Program: MECCHA CHAMELEON
- Write-up by: Aikido Security
- Disclosed: 2026-09-03
- Write-up quality: 9/10
- Original: https://www.aikido.dev/blog/meccha-chameleon-rce
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-meccha-chameleon-rce
- Tags: area:os domain:desktop impact:rce kind:research platform:threat-intel sev:high tech:windows technique:parser-differential technique:source-review vuln:file-upload vuln:path-traversal vuln:rce

**Target:** Unreal Engine 5.6.1 game map Blueprint / Finish Recording Output (StopRecordingOutput)
**Root cause:** StopRecordingOutput accepts an attacker-controlled filename/path, appends .wav, and passes it to lower-level Windows APIs that truncate at a null byte, allowing arbitrary path and extension writes.
**Steps:**
1. Open a Blueprint graph in a custom map and search exposed nodes for OS-touching functions (save/write/record/load).
2. Identify Finish Recording Output / StopRecordingOutput which writes a WAV to a supplied path.
3. On BeginPlay: StartRecordingOutput on a private submix, PlaySound2D with crafted uncompressed 16-bit PCM, then StopRecordingOutput.
4. Supply filename `../../../../Roaming/Microsoft/Windows/Start Menu/Programs/Startup/poc.exe\u0000IGNORED` to escape the default BouncedWavFiles dir and truncate the appended `.wav`.
5. Encode an HTA payload (`<hta:application/><script>new ActiveXObject("WScript.Shell").Run("calc.exe")</script>`) into PCM samples by pairing ASCII bytes little-endian (e.g. `<h` -> 0x683C).
6. Package map, upload to Steam Workshop, host lobby so victims auto-download and load it; on reboot mshta.exe executes the .hta in Startup.
**How found:** Noted lobby auto-download of community maps as attack surface; enumerated Blueprint-exposed engine functions by right-clicking graphs and filtering for save/write/record/load; Finish Recording Output stood out for writing files with attacker-controlled paths; then hunted a parser discrepancy between Unreal's string append and Windows path handling.
**Exploitation:** Attacker hosts a malicious Workshop map; lobby auto-prompts all players to download and load it. On load, Blueprint writes a WAV whose PCM data is an HTA payload into the victim's Startup folder with an .exe name (null-byte truncation strips .wav). On next reboot Windows runs the file via mshta.exe, executing attacker script with WScript.Shell.
**Escalation:** Chained path traversal + null-byte parser differential + PCM byte encoding to convert a file-write primitive into persistent delayed RCE across all lobby players.
**Insight:** When a sink appends a fixed extension, look for null-byte truncation in lower-level OS APIs to strip it; and when only the tail of a file is attacker-controlled, pick a format like HTA whose parser ignores leading bytes rather than requiring a PE header.