⚠️🚀 CVE-2025-24813 — Apache Tomcat RCE Exploitation Suite

⚡ Version: 1.0 🛡️ CVE ID: CVE-2025-24813 (Apache Tomcat RCE) 🧬 Payloads: ysoserial / Java 🌐 Mode: Interactive + Stealth 🔬 Usage: Ethical, Investigative, Educational

🌌 Overview

This tool has been designed as a futuristic exploitation suite focused on:

• 🔍 Assessing Apache Tomcat against CVE-2025-24813
• 🛠️ Automating the proof of concept (PoC) process
• 🧠 Executing custom payloads with advanced evasion
• 🧬 Adapting to modern defenses (WAFs, detection, simulated traffic)

🧪 Designed for cybersecurity professionals, researchers, pentesters, and red teams.

🧠 What does this script do?

🛸 Main Features

✅ Interactive and intuitive interface

✅ Dynamic payloads (ysoserial or compiled Java)

✅ Chameleon anti-WAF headers

✅ Automatic evasion + payload fragmentation

✅ Backend execution fingerprinting

✅ Detailed per-target logging

✅ Dynamic cyberpunk style banner (🔮 glitch animation)

✅ Live console feedback (with Rich & Colorama)

⚙️ Requirements

Install the necessary requirements with:

pip install -r requirements.txt

Dependencies:

requests
colorama
rich
validators

And make sure you have:

• ☕ Java and javac in your PATH
• 📦 ysoserial.jar if you use the ysoserial payload type

🧪 Usage

Run the script:

python3 POC-Exploit_CVE_2025_24813.py

And fill in the configuration:

🧬 Select payload type 💣 Specify the command 🌐 Enter the target URL 🔧 Adjust evasion and SSL settings

🎯 Visual Example:

🔗 [?] Enter target URL: https://victim.org
💣 [?] Command to execute: whoami
🧬 [?] Payload type: ysoserial
📂 [?] Path to ysoserial.jar: ysoserial.jar
🔧 [?] Gadget: CommonsCollections6
🔐 [?] Verify SSL? (yes/no): no

🚀 Executing...
🧬 WAF detected... changing strategy
⚙️ Uploading payload...
💥 Remote execution confirmation
✅ Result: 'apache'

🌈 Script Visual Architecture

┌──────────────────────────────┐
│  Interactive Mode            │
├──────────────────────────────┤
│  URL Validation              │
│  Session Detection           │
│  WAF Detection               │
│  Payload Generation          │
│  Evasive Upload via PUT      │
│  Execution Verification      │
└──────────────────────────────┘
        ↘ LOGS PER TARGET

🧬 Payload Types

• ysoserial: Based on the well-known tool ysoserial, it serializes vulnerable gadgets to execute commands.
• Java Custom: Compiles a custom .java file that executes the remote command from the server.

Common Gadgets:

• CommonsCollections6
• Spring1
• Jdk7u21

📁 Project Structure

POC-Exploit_CVE_2025_24813.py   # Main script
ysoserial.jar               # Required if using 'ysoserial'
logs/                       # Folder for per-target individual logs
payload.ser                 # Temporarily generated payload
Exploit.java / .class       # Temporary Java files

👨‍⚖️ Responsible and Ethical Use

This tool was created for strictly legal and educational purposes.

✅ Allowed:

• Authorized security audits
• Personal labs and testing environments
• Academic research

🚫 Prohibited:

• Use on third-party systems without consent
• Illegal or unauthorized activities
• Distribution with malicious intent

⚖️ Disclaimer

Neither the author nor the contributors are responsible for misuse. You are responsible for your own conduct.

🧠 Credits

• 👤 Author: [ByMakaveli]
• 🔬 Research: Based on modern Java evasion and exploitation techniques
• 🧰 Tools used: ysoserial, Java, Rich, Colorama, requests

🛰️ Referenced CVE

📄 CVE-2025-24813: Apache Tomcat Remote Code Execution 🔗 See details at CVE MITRE

📜 License

MIT License

Copyright (c) 2025

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files...

See the LICENSE file for more information.

💎 Visual Inspiration

This README and script are designed for an immersive, visual, and elegant experience, in tune with a new era of futuristic cybersecurity with purpose.

✨ Not just exploits... it's a technical symphony of evasion and digital control.

🔧 Required Dependencies

1. Python

• Recommended version: Python 3.8+

• Python libraries you must install:

  root@kitploit:~

  pip install requests colorama
  

2. Java

The script uses two forms of payloads:

1. Ysoserial → external Java tool that generates deserialization payloads.
2. Custom Java compilation → when you select the "java" option instead of "ysoserial".

Therefore you need:

• Java JDK (not just JRE, because code is compiled). Verify with:

  root@kitploit:~

  java -version
  javac -version
  

  If both commands work, you're ready.

3. Ysoserial

• Download the .jar from here 👉 https://github.com/frohoff/ysoserial

• Save it in the same directory as the script or provide the full path when prompted. Example:

  root@kitploit:~

  java -jar ysoserial.jar CommonsCollections6 "calc.exe" > test.ser
  

4. Operating System

• On Windows, the default payload (calc.exe) will open the calculator.
• On Linux/Mac you can change the command to e.g. gnome-calculator or xcalc.

⚙️ Installation Summary

1. Install Python 3.8+

2. Install libraries:

   root@kitploit:~

   pip install requests colorama etc
   

3. Install Java JDK 8+

   root@kitploit:~

   java -version
   javac -version
   

4. Download ysoserial.jar to the script folder.

👉 With all that you can run the script in safe lab mode (only in controlled environments, for testing).

🛡️ README — Safe Step-by-Step Tutorial

Version: 1.0 Purpose: This guide explains how to prepare a fully safe environment to test the script you have, without affecting real systems. It includes a test server (mock), safe mode (DRY_RUN / SAFE_TEST), and clear steps to run the tool in a lab.

⚠️ Legal and Ethical Notice (READ BEFORE STARTING)

• Only run in environments under your control: local virtual machines, containers, or isolated networks.
• Do not run this against third-party systems without explicit written authorization.
• This guide does not provide steps to exploit real servers. It is intended for defensive and educational testing.

🔍 What This Tutorial Contains

1. Setting up the Python environment in isolation.
2. Creating a test server (mock) that simulates the responses of the target service.
3. Preparing a dummy payload (harmless) for testing.
4. Adding a safe mode (SAFE_TEST) to the script so it does not execute external tools or perform dangerous actions.
5. Step-by-step execution and verification of results (logs).
6. Automated tests and best practices.

🧾 Requirements

• Python 3.8+ installed.
• pip available.
• Recommended: virtualenv or venv.

Install dependencies:

python3 -m venv .venv
source .venv/bin/activate   # Linux / macOS
.\.venv\Scripts\activate  # Windows (PowerShell/Command Prompt)

pip install -U pip
pip install requests colorama flask

Note: flask is only used for the local test server (mock).

🧪 1) Test Server (mock) — Safe Code

Create a file named mock_server.py with the following content. The server simulates the endpoints that the script expects and returns controlled states (200, 409, 500) so you can validate the script's logic without touching real servers.

# mock_server.py — safe test server
from flask import Flask, request, make_response, jsonify

app = Flask(__name__)
uploads = {}

@app.route('/index.jsp', methods=['GET'])
def index():
    # Simulates a page that may return a JSESSIONID cookie or text containing "Session ID"
    resp = make_response('Index page — Session ID: testsession')
    resp.set_cookie('JSESSIONID', 'testsession')
    return resp

@app.route('/check.txt', methods=['PUT'])
def check_put():
    # Simulates a writable resource
    return ('OK', 200)

@app.route('/uploads/../sessions/<session_id>.session', methods=['PUT'])
def upload_session(session_id):
    # Simulates that the upload was accepted but returns 409 (behavior the script expects)
    uploads[session_id] = True
    return ('Conflict - uploaded', 409)

@app.route('/', methods=['GET'])
def root():
    # If the cookie matches and the session was "uploaded", return 500 to simulate deserialization failure
    session = request.cookies.get('JSESSIONID')
    if session and uploads.get(session):
        return ('Internal Server Error', 500)
    return ('Hello from mock server', 200)

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=8000, debug=True)

How to run it:

python mock_server.py
# The mock will listen on http://127.0.0.1:8000

📁 2) Prepare a dummy Payload (Harmless)

For testing you don't need to generate real payloads. Create a simple file that the script can upload:

echo "DUMMY_PAYLOAD" > payload.ser

This file does not contain executable code: it only serves to validate the upload logic and check mock server responses.

⚙️ 3) Add a Safe Mode (SAFE_TEST) to the Original Script

To prevent the script from invoking external utilities (Java/ysoserial) or performing dangerous actions, add this block at the beginning of the main script (before any generation/subprocess call):

import os
SAFE_TEST = os.environ.get('SAFE_TEST', '0') == '1'

Then modify (or wrap) the generation/upload functions to behave safely when SAFE_TEST is True.

Example minimal change for generate_ysoserial_payload and generate_java_payload:

def generate_ysoserial_payload(command, ysoserial_path, gadget, payload_file, target_url):
    if SAFE_TEST:
        log_info("SAFE_TEST active — creating dummy payload (non-executable)", target_url)
        with open(payload_file, 'wb') as f:
            f.write(b"DUMMY_PAYLOAD")
        return payload_file
    # --- original behavior only if SAFE_TEST == False ---


def generate_java_payload(command, payload_file, target_url):
    if SAFE_TEST:
        log_info("SAFE_TEST active — creating dummy java payload (non-executable)", target_url)
        with open(payload_file, 'wb') as f:
            f.write(b"DUMMY_JAVA_PAYLOAD")
        return payload_file
    # --- original behavior only if SAFE_TEST == False ---

And in upload_and_verify_payload, if SAFE_TEST is True, use the normal flow (the mock will accept it) but do not execute commands outside the script.

How to activate SAFE_TEST:

• Linux/macOS:

  root@kitploit:~

  export SAFE_TEST=1
  

• Windows (PowerShell):

  root@kitploit:~

  $env:SAFE_TEST = "1"
  

▶️ 4) Step-by-Step Execution (Safe Mode)

1. Start your virtual environment and ensure dependencies are installed (see Requirements section).

2. Launch mock_server.py:

   root@kitploit:~

   python mock_server.py
   

3. Create the dummy payload if you are not using SAFE_TEST or if it does not create the payload for you:

   root@kitploit:~

   echo "DUMMY_PAYLOAD" > payload.ser
   

4. Activate safe mode in the terminal:

   root@kitploit:~

   export SAFE_TEST=1   # Linux/macOS
   # or in PowerShell: $env:SAFE_TEST = "1"
   

5. Run the main script:

   root@kitploit:~

   python3 your_script.py
   

6. Answer the prompts (you will use lab values):

   • Enter target URL: http://127.0.0.1:8000
   • Enter command to execute: leave default (it will not be executed in SAFE_TEST)
   • Payload type: ysoserial (the script, with SAFE_TEST=1, will create a dummy payload instead of invoking external tools)
   • Path to ysoserial.jar: (you can leave ysoserial.jar — it will not be used in safe mode)
   • Verify SSL? no (your mock uses HTTP)

🔎 5) What to Check in Tests

• That the check_writable_servlet function detects the successful PUT on the /check.txt endpoint.
• That when uploading payload.ser, the mock returns 409 and then the script makes a GET with the JSESSIONID cookie.
• That the mock returns 500 and the script interprets it as a logical verification success.
• That the logs contain all expected entries and that temporary files (if any) are cleaned up.

🧪 6) Unit Tests (Recommendation)

• Use pytest and requests-mock to simulate HTTP responses.

• Create tests for:

  • validate_url — valid/invalid inputs.
  • retry_request — simulate exceptions and retries.
  • detect_waf — simulate Server headers with and without signatures.
  • upload_and_verify_payload — use the mock server to validate the flow.

Simple example with requests-mock (skeleton):

# test_script.py
import requests
import requests_mock
from tu_script import validate_url, retry_request

def test_validate_url():
    assert validate_url('http://127.0.0.1:8000')
    assert not validate_url('notaurl')

def test_retry_request_success():
    # use requests_mock to simulate a GET and test retry_request
    pass

Author:ByMakavali

❌ What NOT to Do

• Do not run the script against unauthorized external targets.
• Do not share functional payloads or PoCs publicly without coordination and responsible disclosure.
• Do not distribute tools that can automate attacks without strict controls.