Remote Code Execution in pgAdmin 4 Query Tool and Cloud Deployment

This repository is primarily a collection of HackTheBox writeups, but it also contains real exploit automation in the `VariaType/` directory. The actionable exploit consists of one Bash orchestrator (`exploit_variatype.sh`) and four Python phase scripts. The exploit is not tied to a common framework like Metasploit; it is custom automation for a multi-stage Linux target compromise. Main exploit capabilities: (1) reconnaissance and extraction of credentials from an exposed `.git` repository on `portal.variatype.htb`; (2) login and LFI verification against `download.php`; (3) preparation of malicious font files and a crafted designspace document to exploit CVE-2025-66034 in fontTools varLib, causing arbitrary file write of a PHP webshell to `/var/www/portal.variatype.htb/public/files/shell.php`; (4) privilege escalation to user `steve` using a ZIP filename command injection payload associated with CVE-2024-25082, which appends an attacker SSH key into `/home/steve/.ssh/authorized_keys`; and (5) privilege escalation to root by abusing `sudo /usr/bin/python3 /opt/font-tools/install_validator.py` with a URL-encoded absolute path traversal to write the attacker’s public key into `/root/.ssh/authorized_keys`. Repository structure: most files are Markdown writeups for HTB machines/challenges. Only 5 files contain exploit code, all under `VariaType/`. `phase1_git_extract.py` handles exposed Git extraction and credential recovery. `phase2_rce_exploit.py` generates malicious font/designspace artifacts for the webshell stage, though upload is partly left manual in that script. `phase3_privesc_steve.py` generates an SSH key, builds an evil ZIP with a filename-based command injection payload, serves it over HTTP, and attempts to place it on the target for later processing. `phase4_privesc_root.py` serves a root public key and invokes the vulnerable validator script over SSH as steve to gain root SSH access. `exploit_variatype.sh` ties the phases together into a mostly automated end-to-end attack. Overall, this is a valid exploit repository with operational code, not just detection logic. The exploit targets a web-exposed Linux application stack and culminates in full root compromise with SSH persistence.

This repository is a small standalone Python proof-of-concept for CVE-2025-2945 affecting pgAdmin 4. It contains two files: a README describing the vulnerability, exploit flow, requirements, and usage; and a single executable script, poc.py, which implements the attack. The exploit is not part of a larger framework. The PoC performs a full authenticated exploitation chain over HTTP using requests.Session. It first retrieves a CSRF token from /login, supporting multiple extraction methods: known CSRF cookie names, a hidden HTML input field used by older versions, and a regex match for the csrfToken value embedded in the React-based login page for pgAdmin 9.x. It then authenticates to /authenticate/login, with a fallback POST to /login for older versions. After login, the script enumerates possible server IDs by calling /sqleditor/get_server_connection/<sgid>/<sid> until the JSON response indicates a valid registered server. It randomly chooses sgid, did, and trans_id values, then initializes a Query Tool session through /sqleditor/initialize/sqleditor/<trans_id>/<sgid>/<sid>/<did> using attacker-supplied database credentials. Finally, it sends a POST request to /sqleditor/query_tool/download/<trans_id> with JSON containing query_commited set to an arbitrary Python expression. The script treats an HTTP 500 response as confirmation that the payload executed, consistent with the vulnerable code path described in the README. Main exploit capability: authenticated remote code execution as the pgAdmin service account. The payload is fully user-controlled and can execute arbitrary Python expressions, including OS commands via __import__('os').system(...). The README includes examples for running id and for launching a bash reverse shell. Because the payload is directly supplied by the operator rather than generated by a framework, the exploit is best classified as OPERATIONAL rather than weaponized. Notable implementation details: the script defaults to plain HTTP on port 80, uses a browser-like User-Agent, relies on valid pgAdmin and database credentials, and requires the target to have a registered server accessible through the Query Tool. The repository’s purpose is clearly offensive validation of the pgAdmin Query Tool eval vulnerability, not detection or scanning only.

This repository provides a proof-of-concept exploit for CVE-2025-2945, a remote code execution vulnerability in pgAdmin4 versions 8.10 through 9.1. The exploit requires valid credentials for both pgAdmin4 and the underlying database. The main exploit script (poc.py) is written in Python and automates the process of authenticating to the target, retrieving CSRF tokens, identifying a valid server ID, initializing the SQL editor, and finally delivering a reverse shell payload via the Query Tool's download endpoint. The payload opens a reverse shell from the target server to an attacker-controlled host and port. The exploit targets several specific HTTP endpoints in the pgAdmin4 web interface, and is intended for use by authorized security professionals for research and testing. The repository consists of two files: a detailed README.md and the exploit script poc.py.

This repository provides a working exploit for CVE-2025-2945, a remote code execution vulnerability in pgAdmin4. The exploit targets two vulnerable endpoints in the pgAdmin backend, specifically '/sqleditor/query_tool/download' and '/cloud/deploy', where user-supplied parameters are unsafely passed to Python's eval() function, allowing arbitrary code execution. The main exploit logic is implemented in 'exploit/src/main.py', which automates authentication, session setup, and payload delivery to the vulnerable endpoint. The payload, configurable via 'exploit/resource/config.toml', is a Python one-liner that opens a reverse shell to the attacker's machine. The repository also includes a Docker-based test environment under the 'stand' directory, allowing users to deploy a vulnerable instance of pgAdmin and PostgreSQL for testing. The exploit requires valid credentials to pgAdmin and network access to the target. The code is operational and demonstrates a full attack chain from authentication to remote shell access.

This repository contains a standalone Python exploit (exp.py) for CVE-2025-2945, an authenticated remote code execution (RCE) vulnerability in pgAdmin4 versions 8.10 through 9.1. The exploit requires valid credentials for both a pgAdmin4 user and a database user. The script performs the following steps: (1) checks the pgAdmin4 version, (2) retrieves a CSRF token, (3) authenticates to the web interface, (4) locates a valid server ID, (5) initializes a SQL editor session, and (6) sends an attacker-supplied Python payload for execution via the query tool. The exploit interacts with several HTTP endpoints of the target pgAdmin4 instance. The repository includes a README with usage instructions and references, a LICENSE file, and the main exploit script. The exploit is a proof-of-concept and does not include a weaponized or customizable payload framework, but allows arbitrary Python code execution as provided by the user.

This repository provides a proof-of-concept Python exploit for CVE-2025-2945, a critical authenticated remote code execution vulnerability in pgAdmin 4 versions 8.10 through 9.1. The exploit is implemented in 'poc.py', which automates the process of authenticating to a target pgAdmin instance, initializing a SQL editor session, and sending a malicious payload via the 'query_commited' parameter to trigger arbitrary Python code execution on the server. The script requires valid credentials and database connection details. The README.md offers detailed usage instructions, vulnerability background, and references. The exploit targets HTTP endpoints exposed by pgAdmin and is network-based, requiring only web access and valid credentials. No hardcoded endpoints or IPs are present; all targets are user-supplied at runtime. The payload is customizable, allowing the attacker to execute any Python code on the vulnerable server. The repository is structured with a single exploit script, a README, and a license file.