POC详情： c92a09fdb3241cb590b0441f221c5f06eacfab58

来源
https://github.com/RevoltSecurities/CVE-2024-36401
关联漏洞
标题： GeoServer 安全漏洞 (CVE-2024-36401)
描述：GeoServer是一个用 Java 编写的开源软件服务器。允许用户共享和编辑地理空间数据。 GeoServer 存在安全漏洞，该漏洞源于不安全地将属性名称解析为 XPath 表达式，可能导致远程代码执行。
描述
Exploiter a Vulnerability detection and Exploitation tool for GeoServer Unauthenticated Remote Code Execution CVE-2024-36401.
介绍
# CVE-2024-36401: GeoServer Unauthenticated Remote Code Execution 

Exploiter a Vulnerability detection and Exploitation tool for GeoServer Unauthenticated Remote Code Execution CVE-2024-36401.

<h1 align="center">
  <img src="https://github.com/RevoltSecurities/CVE-2024-36401/assets/119435129/51cc68f7-b2fa-4d6c-9e5d-84fbbc5923cd" width="2000px">
</h1>
  <br>


### Installation

```bash
git clone https://github.com/RevoltSecurities/CVE-2024-36401.git
cd CVE-2024-34102
pip install -r requirements.txt
python3 exploiter.py --help
```
### Build Your Testing lab:
```bash
sudo docker-compose up -d # To start your vulnerable instance and locate to http://0.0.0.0:8080
sudo docker-compose down # To stop your vulnerable instance.
```

### Usage:

```yaml
python3 exploit.py -h                       


    ______     ____  __         _ ______         
   / ____/  __/ __ \/ /  ____  (_)_  __/__  _____
  / __/ | |/_/ /_/ / /  / __ \/ / / / / _ \/ ___/
 / /____>  </ ____/ /__/ /_/ / / / / /  __/ /    
/_____/_/|_/_/   /_____|____/_/ /_/  \___/_/     
  
                    @RevoltSecurities

[Description]: Vulnerability Detection and Exploitation tool for CVE-2024-36401

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     [INF]: Specify a URL or domain for vulnerability detection
  -l LIST, --list LIST  [INF]: Specify a list of URLs for vulnerability detection
  -t THREADS, --threads THREADS
                        [INF]: Number of threads for list of URLs
  -proxy PROXY, --proxy PROXY
                        [INF]: Proxy URL to send request via your proxy
  -v, --verbose         [INF]: Increases verbosity of output in console
  -o OUTPUT, --output OUTPUT
                        [INF]: Filename to save output of vulnerable target]


```
文件快照

 [4.0K]  /data/pocs/c92a09fdb3241cb590b0441f221c5f06eacfab58
├── [ 108]  docker-compose.yaml
├── [ 12K]  exploit.py
├── [1.7K]  README.md
└── [ 158]  requirements.txt

0 directories, 4 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。