CVE-2025-49132 PoC — Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Description

Poc - CVE-2025-49132

Readme

# CVE-2025-49132 Standalone Vulnerability Scanner

## Non-Docker Implementation

This scanner operates directly on Python without Docker dependencies, suitable for environments where Docker is not available or preferred.

## Installation

```bash
pip install -r requirements-standalone.txt
```

Manual installation:
```bash
pip install requests urllib3
```

## Usage

### 1. Single Target Scanning

```bash
python standalone_scanner.py scan http://localhost/
```

### 2. Batch Scanning from File

Create `targets.txt`:
```
http://localhost/
http://localhost:8080
http://localhost:3000
```

Execute batch scan:
```bash
python standalone_scanner.py batch --file targets.txt
```

### 3. Output Persistence

```bash
python standalone_scanner.py batch --file targets.txt --output results.json
```

### 4. Interactive Mode

```bash
python standalone_scanner.py interactive
```

## Output Examples

### Vulnerable Target:
```
🔍 Scanning: http://localhost/
⏰ Time: 2025-01-27 15:30:45
------------------------------------------------------------
✅ VULNERABLE - Database credentials found!
📊 Database Info:
   Host: localhost
   Port: 3306
   Database: root
   Username: root
   Password: secret123
🔗 Connection String: root:secret123@localhost:3306/root

✅ VULNERABLE - App configuration found!
📊 App Config:
   App Key: base64:your_secret_key_here
   Cipher: AES-256-CBC
   Debug: false
   Environment: production
   App Name: Pterodactyl
   App URL: http://localhost
   Timezone: UTC
   Locale: en

🔔 SECURITY WARNING: APP_KEY exposed!
   This key is used for encryption/decryption
   Can be used to decrypt sensitive data
```

### Safe Target:
```
🔍 Scanning: http://localhost/
⏰ Time: 2025-01-27 15:30:45
------------------------------------------------------------
❌ NOT VULNERABLE (Status: 404)
```

## Technical Features

- ✅ **Docker-free Operation**: Direct Python execution
- ✅ **Cross-platform Compatibility**: Windows, Linux, macOS
- ✅ **Multiple Execution Modes**: Single target, batch processing, interactive
- ✅ **Structured Output**: JSON format for data persistence
- ✅ **Robust Error Handling**: Comprehensive exception management
- ✅ **Progress Monitoring**: Real-time scanning progress
- ✅ **Analytical Reports**: Statistical summary generation
- ✅ **Cryptographic Detection**: APP_KEY and cipher identification
- ✅ **Security Alerts**: Automated vulnerability notifications

## Comparative Analysis

| Feature | Standalone | Container |
|---------|------------|-----------|
| Setup Complexity | Minimal | Docker-dependent |
| Dependencies | Python packages | Docker + Python |
| Performance | Optimized | Comparable |
| Process Isolation | None | Full isolation |
| Deployment Portability | High | Medium |

## Technical Specifications

### Network Configuration
- **Timeout**: 10 seconds (configurable)
- **SSL Verification**: Disabled for compatibility
- **User-Agent**: Standard browser simulation
- **Request Method**: GET only (non-intrusive)

### Vulnerability Detection
- **Database Configuration Exposure**: MySQL/PostgreSQL credentials
- **Application Configuration**: Laravel/PHP settings
- **Cryptographic Keys**: APP_KEY identification
- **Environment Variables**: Production/development settings

## Troubleshooting

### Module Import Errors:
```bash
pip install requests
```

### SSL Certificate Issues:
SSL warnings are automatically suppressed. No additional configuration required.

### Connection Timeout:
Default timeout is 10 seconds. Modify `timeout` parameter in source code if needed.

## Security Considerations

### Scanner Behavior
- **Non-intrusive**: Only performs GET requests
- **Data Handling**: No sensitive data persistence
- **Detection Scope**: Configuration file exposure
- **Exploitation**: No active exploitation performed

### Risk Assessment
- **Database Credentials**: Direct database access potential
- **Application Keys**: Encryption/decryption capability exposure
- **Environment Variables**: Configuration disclosure
- **Attack Surface**: Increased vulnerability footprint

## Quick Start Guide

```bash
# Install dependencies
pip install requests urllib3

# Perform test scan
python standalone_scanner.py scan http://localhost/

# Execute batch analysis
python standalone_scanner.py batch --file targets.txt --output results.json
```

## Technical Architecture

### Core Components
1. **Scanner Engine**: HTTP request processing
2. **Parser Module**: Response analysis and extraction
3. **Vulnerability Detector**: Pattern matching and validation
4. **Output Formatter**: Structured data presentation
5. **Error Handler**: Exception management and recovery

### Data Flow
```
Target Input → HTTP Request → Response Analysis → Vulnerability Detection → Output Generation
```

## Performance Metrics

- **Scan Speed**: ~1-3 seconds per target
- **Memory Usage**: Minimal footprint
- **Network Overhead**: Single GET request per target
- **CPU Utilization**: Low computational requirements

## Compliance and Ethics

This tool is designed for:
- **Security Research**: Vulnerability assessment
- **Penetration Testing**: Authorized security testing
- **Educational Purposes**: Security awareness training
- **Compliance Auditing**: Security posture evaluation

**Note**: Always obtain proper authorization before scanning any target systems. 

File Snapshot

Remarks