Verification method: Start an HTTP server on the VPS to receive requests:

If a callback is successfully received, you will see output similar to:

2. Establish a reverse shell connection

Use the reverse mode to establish a reverse shell connection to the specified VPS and port:

Step 1: Set up a listener on the VPS:

Step 2: Run the exploit tool to initiate the reverse connection:

After execution, the tool will display output similar to:

At this point, if the exploit is successful, the nc listener on the VPS will receive the reverse shell session.

Tool Parameters

• cmd: Execute a single command mode
• reverse: Reverse shell mode
• <target>: Target server address and port, format ip:port
• <command>: Command to execute on the target server
• <vps_ip>: IP address of the VPS server
• <vps_port>: Port on the VPS to listen on

Vulnerability Principle

This vulnerability exploits a security flaw in the GeoServer WFS service by injecting Java code into the valueReference to execute system commands. The tool constructs XML payloads containing malicious code and sends them to the GeoServer WFS interface, thereby achieving remote command execution.

Notes

1. This tool is for security research and vulnerability verification only. Do not use it for unauthorized testing.
2. Any consequences resulting from the use of this tool are the sole responsibility of the user.
3. When using the reverse shell feature, ensure you have permission to access the target system and operate within the scope of relevant laws and regulations.
4. In a lab test environment, administrators may have modified default routes to increase difficulty, causing the provided exploit to fail. In such cases, you may need to adjust the field /geoserver/wfs to the appropriate content.

Remediation Suggestions

Update GeoServer to the officially released security version in a timely manner and configure the server following security best practices.