CVE-2025-49132 - Pterodactyl Panel Configuration Information Scanner

This tool is used to scan Pterodactyl panel instances in an attempt to retrieve their database configuration information. By exploiting a specific path traversal vulnerability, sensitive configuration data of the panel can be obtained.

Project Overview

This project is a high-performance HTTP request tool specifically designed to detect and collect configuration information from Pterodactyl panel instances exposed to the public network. It sends specific requests to target servers, checks whether the response contains database configuration information, and saves the results in categorized directories.

Features

Main Features

• Multi-mode execution: Supports single-thread, multi-thread, and asynchronous execution modes
• Intelligent classification: Automatically categorizes results into "Correct" (contains target data) and "Incorrect" (does not contain target data or request failed) two categories
• Auto-save: Automatically saves to different directories based on result type
• Performance monitoring: Displays real-time execution progress and statistics
• Proxy support: Supports sending requests through a proxy
• Error retry: Automatically retries failed requests
• Result analysis: Automatically analyzes database configuration information from response data

Technical Characteristics

• Uses requests library for HTTP requests
• Uses aiohttp for asynchronous request support
• Uses ThreadPoolExecutor for multi-threaded processing
• Supports JSON data parsing and analysis
• Comprehensive error handling mechanism

Directory Structure

.
├── main.py              # Main program file
├── url.txt              # Target host list file
├── json/                # Output directory
│   ├── ✔️正确/           # Directory for results containing target data
│   └── ❌错误/           # Directory for incorrect or invalid results
└── README.md            # Project documentation

Install Dependencies

Before running the program, install the required Python libraries:

pip install requests aiohttp urllib3

Usage

Basic Usage

python main.py

By default, it reads the host list from the url.txt file and processes using multi-thread mode.

Command Line Arguments

python main.py [--file FILE] [--mode MODE] [--workers WORKERS]

Parameter description:

• -f, --file: Specify the host list file path (default: url.txt)
• -m, --mode: Execution mode, options: threading, async, single (default: threading)
• -w, --workers: Number of worker threads (default: 5)

Examples

# Use default settings
python main.py

# Specify a custom host file
python main.py --file hosts.txt

# Use asynchronous mode
python main.py --mode async

# Use single-thread mode
python main.py --mode single

# Set worker threads to 10
python main.py --workers 10

Configuration

In the Config class in the main.py file, you can modify the following settings:

• PROXY: Proxy server address (default: http://127.0.0.1:7899)
• TIMEOUT: Request timeout (default: 30 seconds)
• MAX_RETRIES: Maximum number of retries (default: 3)
• MAX_WORKERS: Maximum number of worker threads (default: 5)
• USER_AGENT: Request User-Agent (default: Mozilla/5.0 Windows AppleWebKit/537.36)

How It Works

1. The program reads the host list from the specified file
2. For each host, it sends an HTTP GET request to the /locales/locale.json path
3. Request parameters are set to:
   • locale: ../../../pterodactyl
   • namespace: config/database
4. Analyzes the response data to check if it contains database configuration information
5. Saves data to corresponding directories based on result type:
   • Contains target data: json/✔️正确/
   • Does not contain target data or request failed: json/❌错误/
6. Displays real-time execution progress and statistics

Output Format

Results are saved in JSON format, containing the following information:

• success: Whether the request was successful
• status_code: HTTP status code
• response_time: Response time
• url: Actual request URL
• headers: Response headers
• data: Response data
• size: Response size
• contains_target_data: Whether it contains target data
• database_info: Extracted database information

Notes

1. Please ensure compliance with relevant laws and regulations, and only use this tool in an authorized environment
2. Modify the proxy configuration to suit your network environment before use
3. A large number of requests may cause pressure on the target server; set the number of threads reasonably
4. Saved results may contain sensitive information; handle with care

Statistics

After execution, detailed statistics will be displayed:

• Total requests
• Successful requests
• Failed requests
• Number of targets found
• Success rate
• Target data discovery rate
• Total execution time
• Requests per second