grav-exploit CVE-2022-2073

## https://sploitus.com/exploit?id=8142EEF8-7DE0-53E9-80F1-A343A33B4A99
# GravCMS 1.10.7 - Unauthenticated Remote Code Execution (RCE)

[![Security](https://img.shields.io/badge/Exploit-Critical-red.svg)](https://vulners.com/cve/CVE-2022-2073)
[![Python](https://img.shields.io/badge/Python-3.6%2B-blue.svg)](https://www.python.org/)
[![License](https://img.shields.io/badge/License-EDU-green.svg)](LICENSE)

> *"A child lost in the dark. A server waiting to fall. No words. No mercy. Just exploitation."* — Playdead Style

## 📋 Overview

This exploit targets **GravCMS 1.10.7** which contains an unauthenticated arbitrary YAML write vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the scheduler functionality, allowing attackers to inject malicious cron jobs without authentication.

### Vulnerability Details

| Field | Value |
|-------|-------|
| **CVE** | CVE-2022-2073 |
| **Affected Version** | GravCMS 1.10.7 and below |
| **Attack Vector** | HTTP POST to scheduler endpoint |
| **Authentication** | None required |
| **Impact** | Complete system compromise |
| **CVSS Score** | 9.8 (Critical) |

## 🎯 Features

- ✅ **Unuthenticated exploitation** - No login required
- 🔄 **Multiple shell types** - bash, nc, python, php
- 🎨 **Playdead-style interface** - Dark, minimalist aesthetic
- 📝 **Verbose mode** - Detailed debugging output
- 🔍 **Pre-exploit validation** - Checks if target is vulnerable
- ⚡ **Multiple payload templates** - Increases success rate
- 🛡️ **Silent mode** - OPSEC friendly option

## 📦 Installation

```bash
# Clone the repository
git clone https://github.com/yourusername/grav-exploit.git
cd grav-exploit

# Make the script executable
chmod +x grav_exploit.py

# Install dependencies (if any)
pip3 install requests