🔐 Laravel RCE Exploitation Toolkit

This toolkit contains two Python scripts for identifying and exploiting Laravel applications with exposed .env files and vulnerable APP_KEYs.

---

🎬 Demo Video

🧾 Script 1: rce.py

📌 Purpose: Exploits Laravel RCE vulnerability by using a known APP_KEY to generate a malicious payload that leads to remote code execution. If successful, it writes a backdoor to the server and logs the URL.

🛠 How It Works:

• Reads a list of targets in the format: http://target.com|base64:APP_KEY
• Crafts a signed and encrypted payload using AES and HMAC
• Sends the payload via the XSRF-TOKEN cookie
• Writes a PHP backdoor to the web root
• Verifies if the backdoor is accessible

📥 Usage:

1. Prepare a file (e.g., targets.txt) with lines like: http://example.com|base64:your_app_key_here

2. Run the script: python rce.py

3. Enter the input filename when prompted

📁 Output: Successful backdoor URLs are saved in: ENV-TO-RCE/Result_YYYY-MM-DD_HH-MM-SS.txt

📦 Dependencies:

• requests
• urllib3
• colorama
• pystyle
• pycryptodome

Install with: pip install -r requirements.txt

---

🧾 Script 2: envtobase64.py

📌 Purpose: Scans a list of URLs for exposed Laravel .env files and extracts the APP_KEY. Useful for reconnaissance and preparing targets for rce.py.

🛠 How It Works:

• Reads a list of .env URLs
• Fetches each URL and checks for valid .env content
• Extracts the APP_KEY if present
• Saves results in the format: http://target.com|base64:APP_KEY

📥 Usage:

1. Prepare a file (e.g., env_urls.txt) with lines like: http://example.com/.env

2. Run the script: python envtobase64.py

3. Enter the input filename when prompted

📁 Output: Extracted APP_KEYs are saved in: ENV-TO-RCE/Result_YYYY-MM-DD_HH-MM-SS.txt

📦 Dependencies:

• requests
• urllib3
• colorama
• pystyle

Install with: pip install -r requirements.txt

---

⚠️ Legal Disclaimer: These tools are for authorized penetration testing and educational purposes only. Unauthorized use is illegal and unethical. Always obtain explicit permission before testing any system.

---

🧾 Requirements Summary (for both scripts)

Create a requirements.txt file with: requests urllib3 colorama pystyle pycryptodome

Then install: pip install -r requirements.txt

---

👨‍💻 Author: Bob Marley

Buy me a Coffe :

₿ BTC: 17sbbeTzDMP4aMELVbLW78Rcsj4CDRBiZh

©2025 Bob Marley