Skip to main content

OffSec Proving Grounds PyLoader — pyLoad CVE-2023-0297

· 5 min read
Views …
James
James
AOV Security

In this Art of Vector walkthrough, we take OffSec Proving Grounds PyLoader from a blank terminal to root — starting with a quiet two-port scan, then chaining the exposed pyLoad web UI to CVE-2023-0297 for pre-auth remote code execution.

Lab only. All testing was performed in an authorized training environment. Never run these techniques against systems you do not own or do not have explicit written permission to assess.

Summary​

PyLoader is a short, high-signal box. A full TCP scan shows only SSH and an HTTP service on 9666. That service is not a generic web app — version and title fingerprints identify it as pyLoad behind CherryPy/Cheroot.

Once the product is named, public research lands immediately on Exploit-DB 51532: a pre-auth RCE against pyLoad 0.5.0 (CVE-2023-0297). In the lab, a reverse shell callback returns as root with no privilege-escalation stage required.

Enumeration​

Nmap​

Start with a full TCP scan plus version and default scripts:

nmap -sV -sC -p- 192.168.120.26 -v

The host is quiet. Almost everything is closed. Only two ports matter:

22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu
9666/tcp open  http    CherryPy wsgiserver

The HTTP details are the real lead:

http-server-header: Cheroot/8.6.0
http-title: Login - pyLoad
http-robots.txt: 1 disallowed entry: /

That combination — non-standard port, CherryPy/Cheroot, and a pyLoad login page — is enough to stop broad web fuzzing and move straight into product-specific research.

Service analysis​

Port 22 is ordinary SSH. Without credentials, it is not the initial-access path.

Port 9666 is the attack surface. The title page redirects to /login, and the stack fingerprint points at pyLoad's web UI rather than a CMS or custom app. At this stage the question is simple: is there a public pre-auth issue for this product and version range?

Why pyLoad became the path​

This machine rewards naming the service correctly.

If you treat 9666 as "just another HTTP port," you can burn time on generic content discovery. If you take the Login - pyLoad title seriously, the research path collapses to a single CVE chain:

  • exposed pyLoad web UI
  • known pre-auth RCE in the vulnerable release window
  • attacker-controlled command execution without credentials

That is the entire foothold model.

Exploitation path​

Finding the public PoC​

Search Exploit-DB for pyLoad:

searchsploit -m 51532

That copies the public PoC locally:

Exploit: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Codes: CVE-2023-0297
Path: /usr/share/exploitdb/exploits/python/webapps/51532.py

The important part of the finding is not the script name. It is that the issue is pre-auth. No login, no password spray, and no secondary foothold are required before command execution.

Catching the shell​

Start a listener before firing the exploit. In this walkthrough we used Penelope:

penelope -p 5555

Then run the PoC against the pyLoad UI and deliver a reverse shell callback to the attacker host.

python3 51532.py -u http://192.168.120.26:9666/ -c "<reverse-shell-command>"

Expected operator feedback from the PoC:

[+] Check if target host is alive: http://192.168.120.26:9666/
[+] Host up, let's exploit!
[+] The exploit has be executeded in target machine.

On the listener side, Penelope reports a new session from the target and drops into an interactive shell.

Confirming impact​

Once the callback lands, verify identity:

id
uid=0(root) gid=0(root) groups=0(root)

In this lab path, initial access and root are the same step. There is no separate privilege-escalation chain after the reverse shell.

Root outcome​

What matters at the end is the exposure model: a download-manager web UI on a non-standard port, reachable without authentication hardening, and sitting on a vulnerable pyLoad release.

That is why PyLoader works as a teaching machine. The chain is short and clean:

  • recon finds only SSH and 9666
  • service analysis names the product as pyLoad
  • CVE research points to pre-auth RCE
  • exploitation returns root directly

Why this machine is a good lesson​

PyLoader is memorable because it punishes shallow assumptions and rewards precise fingerprinting.

If you ignore the title and server header, you treat it like a generic web box. If you recognize pyLoad early, the path is almost immediate. It is also a useful reminder that "download manager" and "media helper" services are still remote code execution surfaces when they bind to the network and fall behind on patches.

Defensive takeaways​

If you run pyLoad anywhere in your environment, the lessons are straightforward:

  1. Patch past the vulnerable pyLoad releases tied to CVE-2023-0297.
  2. Do not expose the web UI to untrusted networks without strong auth and network controls.
  3. Treat non-standard management ports the same way you treat port 80 or 443 — still attack surface.
  4. Assume pre-auth RCE in an admin-adjacent service is a full host compromise until proven otherwise.

References​

Unauthorized access is illegal. This write-up is for education and authorized lab work only.