NukeViet 4.6.01 image-upload RCE PoC

Authorized lab PoC for the reported NukeViet image-upload chain:

1. verify_image() misses PHP short-open tags (<?).
2. Filename normalization preserves the inner .php extension.
3. The upload rewrite rule checks .php only at the URI end.
4. A server with PHP short tags enabled and an applicable Apache PHP handler may execute the uploaded polyglot.

This repository contains no credentials, tokens, cookies, or live-target configuration. Run only against an owned or explicitly authorized lab.

Requirements

• Python 3.10+
• requests
• NukeViet 4.6.01 lab instance with an authorized upload-capable account
• Lab PHP/Apache configuration matching the execution conditions above

Install dependency:

python3 -m pip install requests

Generate payload only

No network request:

python3 nukeviet_rce.py --payload-only --file shell.php.jpg

Run against an authorized lab

python3 nukeviet_rce.py \
  --authorized \
  --url http://127.0.0.1:8080 \
  --username LAB_USER \
  --password 'LAB_PASSWORD' \
  --command id

The script performs: login -> multipart upload -> uploaded-path extraction -> one command request. Use harmless proof commands such as id or whoami.

Evidence boundary

The PoC demonstrates impact only when the exact target configuration reaches PHP execution. A payload-generation pass or source-level match alone does not prove runtime RCE. Do not run it against third-party systems.