⚠️🚀 CVE-2025-24813 — Apache Tomcat RCE Exploitation Suite

⚡ Version: 1.0 🛡️ CVE ID: CVE-2025-24813 (Apache Tomcat RCE) 🧬 Payloads: ysoserial / Java 🌐 Mode: Interactive + Stealth 🔬 Usage: Ethical, Investigative, Educational

🌌 Overview

This tool has been designed as a futuristic exploitation suite focused on:

🔍 Assessing Apache Tomcat against CVE-2025-24813
🛠️ Automating the proof of concept (PoC) process
🧠 Executing custom payloads with advanced evasion
🧬 Adapting to modern defenses (WAFs, detection, simulated traffic)

🧪 Designed for cybersecurity professionals, researchers, pentesters, and red teams.

🧠 What does this script do?

🛸 Main Features

✅ Interactive and intuitive interface

✅ Dynamic payloads (ysoserial or compiled Java)

✅ Chameleon anti-WAF headers

✅ Automatic evasion + payload fragmentation

✅ Backend execution fingerprinting

✅ Detailed per-target logging

✅ Dynamic cyberpunk style banner (🔮 glitch animation)

✅ Live console feedback (with Rich & Colorama)

⚙️ Requirements

Install the necessary requirements with:

pip install -r requirements.txt

Dependencies:

requests
colorama
rich
validators

And make sure you have:

☕ Java and javac in your PATH
📦 ysoserial.jar if you use the ysoserial payload type

🧪 Usage

Run the script:

python3 POC-Exploit_CVE_2025_24813.py

And fill in the configuration:

🧬 Select payload type 💣 Specify the command 🌐 Enter the target URL 🔧 Adjust evasion and SSL settings

🎯 Visual Example:

🔗 [?] Enter target URL: https://victim.org
💣 [?] Command to execute: whoami
🧬 [?] Payload type: ysoserial
📂 [?] Path to ysoserial.jar: ysoserial.jar
🔧 [?] Gadget: CommonsCollections6
🔐 [?] Verify SSL? (yes/no): no

🚀 Executing...
🧬 WAF detected... changing strategy
⚙️ Uploading payload...
💥 Remote execution confirmation
✅ Result: 'apache'

🌈 Script Visual Architecture

┌──────────────────────────────┐
│  Interactive Mode            │
├──────────────────────────────┤
│  URL Validation              │
│  Session Detection           │
│  WAF Detection               │
│  Payload Generation          │
│  Evasive Upload via PUT      │
│  Execution Verification      │
└──────────────────────────────┘
        ↘ LOGS PER TARGET

🧬 Payload Types

ysoserial: Based on the well-known tool ysoserial, it serializes vulnerable gadgets to execute commands.
Java Custom: Compiles a custom .java file that executes the remote command from the server.

Common Gadgets:

CommonsCollections6
Spring1
Jdk7u21

📁 Project Structure

POC-Exploit_CVE_2025_24813.py   # Main script
ysoserial.jar               # Required if using 'ysoserial'
logs/                       # Folder for per-target individual logs
payload.ser                 # Temporarily generated payload
Exploit.java / .class       # Temporary Java files

👨‍⚖️ Responsible and Ethical Use

This tool was created for strictly legal and educational purposes.

✅ Allowed:

Authorized security audits
Personal labs and testing environments
Academic research

🚫 Prohibited:

Use on third-party systems without consent
Illegal or unauthorized activities
Distribution with malicious intent

⚖️ Disclaimer

Neither the author nor the contributors are responsible for misuse. You are responsible for your own conduct.

🧠 Credits

👤 Author: [ByMakaveli]
🔬 Research: Based on modern Java evasion and exploitation techniques
🧰 Tools used: ysoserial, Java, Rich, Colorama, requests

🛰️ Referenced CVE

📄 CVE-2025-24813: Apache Tomcat Remote Code Execution 🔗 See details at CVE MITRE

📜 License

MIT License

Copyright (c) 2025

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files...

See the LICENSE file for more information.

💎 Visual Inspiration

This README and script are designed for an immersive, visual, and elegant experience, in tune with a new era of futuristic cybersecurity with purpose.

✨ Not just exploits... it's a technical symphony of evasion and digital control.

🔧 Required Dependencies

1. Python

Recommended version: Python 3.8+
Python libraries you must install:
```
pip install requests colorama
```

2. Java

The script uses two forms of payloads:

Ysoserial → external Java tool that generates deserialization payloads.
Custom Java compilation → when you select the "java" option instead of "ysoserial".

Therefore you need:

Java JDK (not just JRE, because code is compiled). Verify with:
```
java -version
javac -version
```
If both commands work, you're ready.

3. Ysoserial

Download the .jar from here 👉 https://github.com/frohoff/ysoserial
Save it in the same directory as the script or provide the full path when prompted. Example:
```
java -jar ysoserial.jar CommonsCollections6 "calc.exe" > test.ser
```

4. Operating System

On Windows, the default payload (calc.exe) will open the calculator.
On Linux/Mac you can change the command to e.g. gnome-calculator or xcalc.

⚙️ Installation Summary

Install Python 3.8+
Install libraries:
```
pip install requests colorama etc
```
Install Java JDK 8+
```
java -version
javac -version
```
Download ysoserial.jar to the script folder.

👉 With all that you can run the script in safe lab mode (only in controlled environments, for testing).

🛡️ README — Safe Step-by-Step Tutorial

Version: 1.0 Purpose: This guide explains how to prepare a fully safe environment to test the script you have, without affecting real systems. It includes a test server (mock), safe mode (DRY_RUN / SAFE_TEST), and clear steps to run the tool in a lab.

⚠️ Legal and Ethical Notice (READ BEFORE STARTING)

Only run in environments under your control: local virtual machines, containers, or isolated networks.
Do not run this against third-party systems without explicit written authorization.
This guide does not provide steps to exploit real servers. It is intended for defensive and educational testing.

🔍 What This Tutorial Contains

Setting up the Python environment in isolation.
Creating a test server (mock) that simulates the responses of the target service.
Preparing a dummy payload (harmless) for testing.
Adding a safe mode (SAFE_TEST) to the script so it does not execute external tools or perform dangerous actions.
Step-by-step execution and verification of results (logs).
Automated tests and best practices.

🧾 Requirements

Python 3.8+ installed.
pip available.
Recommended: virtualenv or venv.

Install dependencies:

python3 -m venv .venv
source .venv/bin/activate   # Linux / macOS
.\.venv\Scripts\activate  # Windows (PowerShell/Command Prompt)

POC-CVE-2025-24813-Apache-Tomcat-Remote-Code-Execution

Most Popular