Sploitus

Exploit for Code Injection in Geoserver

CVE-2024-36401

githubexploit · 2024-11-22

Exploit Code

README56 lines
## https://sploitus.com/exploit?id=5780E413-C736-5C44-B9F2-378B8CB8773E
# CVE-2024-36401-WoodpeckerPlugin

## Introduction
> CVE-2024-36401: Batch detection and exploitation, supports custom memory Trojan injection.
1. Supports batch detection.
2. The URL backend has been filtered (just generate URLs as needed).
3. Custom memory Trojans can be generated for injection. The default memory Trojan injection includes an injector class named “java.lang.test” – intended to bypass defineAnonymousClass under JDK11.

![img.png](assets/img1.png)

## Installation
Download the source code and execute it:
```bash
   mvn package
```
Place the jar file from the target directory into the plugin folder under [woodpecker-framework](https://github.com/woodpecker-framework/). If you don’t want to compile it yourself, you can download CVE-2024-36401-WoodpeckerPlugin-x.x-SNAPSHOT-all.jar from the attachment and place it in the plugin folder of woodpecker-framework.

## POC Detection
![img.png](assets/img2.png)

## Exploitation
After completing the POC detection, send it to Exploit with the right-click menu.

![img.png](assets/img3.png)

The command will be executed if `ismemshelldopen` is set to `false`; otherwise, it will not execute the command.

![img_3.png](assets/img6.png)

## Memory Trojan Injection
1. The default memory Trojan used is the “Listener” memory Trojan.
2. Custom memory Trojan injection is also supported.

To use a custom memory Trojan, use [java-memshell-generator](https://github.com/pen4uin/java-memshell-generator) to generate a memory Trojan. Note that Jetty is selected as the middleware.

![img_2.png](assets/img5.png)

Or use the `JMG Shell Helper` plugin.

![img_5.png](assets/img8.png)

Then, simply replace the `memshelldata=xx` parameter with the desired value.

![img_4.png](assets/img7.png)

## Disclaimer
> This project is for learning and research purposes only. The author assumes no responsibility for any consequences arising from using this project.

## References
https://yzddmr6.com/posts/geoserver-memoryshell/
https://blog.csdn.net/qq_45305211/article/details/139717906
https://github.com/kN6jq/WoodpeckerPluginManager

## License
+ MIT