Pterodactyl | CTF | 0xdreadnaught

Machine: Pterodactyl
OS: Linux
Difficulty: Medium
Steps: 3
Added: 7 Feb 2026

An unauth Pterodactyl Panel LFI (CVE-2025-49132) reaches RCE via pearcmd; a cracked DB hash gives SSH, and a PAM + udisks2 chain (CVE-2025-6018/6019) gives root.

How it went

0
nmap
nmap shows SSH and nginx; a panel. subdomain runs Pterodactyl Panel 1.11.10.
1
Panel LFI
An unauth LFI (CVE-2025-49132) leaks the Laravel DB config, then includes pearcmd.php to write a webshell, giving RCE as wwwrun.
2
crack hash
The panel database holds user bcrypt hashes; phileasfogg3's cracks from rockyou for SSH.
3
udisks2 LPE
A PAM env injection (CVE-2025-6018) grants allow_active, then a udisks2 SUID-mount race (CVE-2025-6019) runs a SUID bash as root.