CVE-2025-XXXX: CloudPanel FastCGI PHP-FPM Privilege Escalation Exploit

📌 Description

This proof-of-concept (PoC) exploit targets a privilege escalation vulnerability in CloudPanel environments where the clp user has NOPASSWD sudo access, and FastCGI (PHP-FPM) is misconfigured or exposed locally.

By leveraging insecure FastCGI access and the ability to execute PHP scripts, this exploit executes arbitrary commands as root, either directly or by spawning a privileged root shell.

⚠️ This tool is intended strictly for educational and authorized penetration testing. Do not use it on systems you do not own or have explicit permission to test.

---

✨ Features

• 🔧 Run arbitrary system commands as root via PHP-FPM.
• 🐚 Spawn a pseudo-interactive root shell using a setuid copy of bash.
• 🔍 Automatically cleans up temporary files.
• ✅ Minimal dependencies (pure Python3).

---

📜 Technical Overview

The exploit works as follows:

1. A malicious PHP file is written to /tmp/.cmd.php containing:

   <?= `sudo sh -c "{cmd}"`; ?>

2. A FastCGI request is sent to a locally exposed PHP-FPM service on 127.0.0.1:{PORT}.

3. If the PHP-FPM process runs as a user with NOPASSWD sudo (e.g., clp), the command runs as root.

4. Optionally, the exploit can:

   • Copy /bin/bash to a temp location.
   • Set the setuid bit.
   • Spawn an interactive shell as UID 0.

---

⚙️ Usage

🔹 Run a command as root

python3 exploit.py --cmd 'id'

🔹 Spawn an interactive root shell

python3 exploit.py --interactive

Requires: Python3, /bin/bash, and a real TTY.

---

🧪 Examples

python3 exploit.py --cmd 'cat /etc/shadow'
python3 exploit.py --cmd 'whoami'
python3 exploit.py --interactive

Optional Arguments:

Flag	Description	Default
--host	Target host address	127.0.0.1
--port	Target FastCGI port	8787

---

📁 File Structure

File	Description
exploit.py	Main exploit script
/tmp/.cmd.php	Temporary malicious PHP file (auto-cleaned)
/tmp/.priv	Setuid copy of bash (if using --interactive)

---

🔒 Requirements

• Python 3.x
• Local access to a system where:
  • PHP-FPM is accessible on a local port.
  • The FPM process runs as a user with passwordless sudo access.
  • Writable /tmp directory.

---

👤 Author

• Jhuanes Septinus (@jnx23)
  Inspired by Muhammad Aizat (EagleTube)

---

📜 Disclaimer

This tool is provided for educational and research purposes only.
Do not use this on systems you do not own or have explicit permission to test.
The author is not responsible for any misuse or damage caused.

---

🪪 License

This project is licensed under the MIT License.