RCE in pyload-ng via js2py Sandbox Escape

Repository contains two distinct PoCs/scanners: 1) CVE-2024-8856 (WordPress WP Time Capsule) unauthenticated file upload leading to RCE: - PoC/src/scanner.py: a simple vulnerability scanner that POSTs a PHP file to /wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/index_REAL.php and flags vulnerable if HTTP 200 is returned. - PoC/src/scanner_real.py: a more operational RCE PoC. It generates PHP payloads that run system commands (ping/id/whoami/uname, read /etc/os-release, php -v) and writes a proof file under /tmp. After upload, it attempts to trigger execution by requesting guessed locations for the uploaded file (under wp-content/uploads, plugin tmp, and wp-time-capsule uploads). It records partial output as evidence and writes results to real_rce_result.json. - Stand/docker-compose.yml + Stand/init-plugin.sh: a local lab environment. docker-compose provisions WordPress (exposed on localhost:9999) and MariaDB; init-plugin.sh installs wp-time-capsule.1.22.21.zip, activates it via WP-CLI, and creates the vulnerable directory structure. 2) CVE-2024-39205 (js2py sandbox escape) educational demonstration: - PoC/src/scanner_real2.py: crafts a JavaScript payload that traverses Python object internals to locate subprocess.Popen and execute a single “safe” ping command to a user-supplied IP. It sends a raw HTTP POST to /flash/addcrypted2 with parameters package, crypted (base64 dummy), and jk (URL-encoded JS payload). Verification is done by running tcpdump locally to detect an ICMP echo from the target to the tester. Outputs/artifacts: - PoC/src/scan_result.json and PoC/src/real_rce_result.json are example result formats; PoC/result.txt shows a sample run against http://localhost:9999. Overall purpose: provide a vulnerable WordPress stand and scripts to (a) detect and (b) demonstrate/collect evidence of RCE via WP Time Capsule upload endpoint (CVE-2024-8856), plus a separate educational sandbox-escape demonstration script for CVE-2024-39205 targeting an HTTP /flash/addcrypted2 endpoint.

This repository contains a single file, 'reverse_shell.py', which is not a standard Python script but rather a hybrid of JavaScript-like and Python code. The script's main purpose is to obtain a reference to Python's 'subprocess.Popen' class through introspection and then execute a bash command that opens a reverse shell to the attacker's machine at 10.10.16.51:4321. The payload is a classic bash reverse shell, and the script is designed to work in an environment where such introspection is possible (e.g., a Python sandbox with JavaScript bindings or a vulnerable server-side JavaScript/Python interpreter). The exploit is operational, as it provides a working reverse shell payload, but it is not weaponized for broad use. The main attack vector is network-based, requiring the target to connect back to the attacker's IP and port. The endpoints involved are the attacker's IP address, TCP port, and the '/dev/tcp/...' pseudo-file used by bash to initiate the connection.

This repository contains a single Metasploit module targeting Pyload (<=0.5.0b3.dev85) with js2py (<=0.74), exploiting two vulnerabilities: CVE-2024-39205 (Pyload RCE) and CVE-2024-28397 (js2py sandbox escape). The exploit leverages a flaw in the /flash/addcrypted2 API endpoint, which is intended to be accessible only from localhost, but can be accessed remotely by manipulating the Host header. The module crafts a malicious JavaScript payload that escapes the js2py sandbox, allowing arbitrary command execution on the host. The exploit supports both direct command execution and staged payload delivery (dropper), and is weaponized for use within the Metasploit framework. The only file present is a Ruby module, structured according to Metasploit conventions, and includes all logic for vulnerability checking, payload generation, and exploitation. No external endpoints or IPs are hardcoded beyond the localhost reference for the Host header. The module is suitable for operational use against vulnerable Pyload installations.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-39205, targeting pyload-ng (<=0.5.0b3.dev85) running on Python 3.11 or below. The exploit leverages a sandbox escape vulnerability in js2py (CVE-2024-28397), which is used by the /flash/addcrypted2 API endpoint in pyload-ng. Although this endpoint is intended to be accessible only from localhost, the PoC demonstrates that this restriction can be bypassed using HTTP header manipulation, allowing remote attackers to send crafted POST requests. The payload is a JavaScript snippet that escapes the js2py sandbox and executes arbitrary shell commands on the server by traversing Python objects to invoke subprocess.Popen. The repository contains only a README.md with the exploit code and a .gitignore; there are no standalone code files. The exploit is a network-based remote code execution attack, and the main fingerprintable endpoint is the /flash/addcrypted2 API on the target server. The exploit is a PoC and requires the attacker to specify the target host and port.