# [hta3] Remote Code Execution on ████

Report Server export endpoint let attacker control rdExportFilename and rdReportName to write an ASPX webshell, achieving RCE on a DoD military server.

- Payout: hidden
- Severity: critical
- Program: U.S. Dept Of Defense
- Found by: cdl
- Disclosed: 2023-05-15
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1072832
- Library page: https://bugbountylibrary.com/r/h1%3A1072832
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:critical tech:dotnet technique:source-review vuln:file-upload vuln:rce

**Target:** ASP.NET Report Server (rdPage.aspx) export endpoint
**Root cause:** The export handler trusts user-supplied rdExportFilename for the output path/extension and rdReportName for file contents, writing attacker-controlled data to a web-accessible directory.
**Steps:**
1. Login to the report portal and run any report, landing on `?rdNoShowWait=True`.
2. Intercept the 'Export to Excel' POST to `/RServer/rdPage.aspx`.
3. Set `rdReportFormat=NativeExcel` and `rdExcelOutputFormat=NativeExcel`.
4. Set `rdExportFilename=shell.aspx`.
5. Set `rdReportName` to URL-encoded ASPX webshell that runs `Request.QueryString[...]` via `System.Diagnostics.Process`.
6. Forward request; response redirects to `/RServer/rdDownload/.../shell.aspx`.
7. Execute commands via `shell.aspx?<key>=whoami`.
**How found:** Researcher reviewed the target after a press release named the domain as in-scope, then tested the report export flow and noticed filename/format parameters were user-controlled.
**Exploitation:** Authenticated user exports a report with a crafted filename ending in .aspx and a malicious report body; server writes the file into a downloadable web path, then attacker requests the shell URL with a command in the query string to execute OS commands.
**Insight:** Report/export features that accept both a filename and a content/format parameter are prime webshell-write candidates: try changing the extension to a server-executable type and injecting content via the report-name/body field.