Apache Tomcat Init Script Symlink Privilege Escalation

This repository contains a single Metasploit module (Ruby file) that exploits a local privilege escalation vulnerability (CVE-2016-1240) in Apache Tomcat packages on Ubuntu and other Debian-based systems. The exploit targets a flaw in the Tomcat init script and log file handling, allowing an attacker with access as the 'tomcat' user to escalate privileges to root. The module checks for vulnerable Tomcat versions, uploads a payload and a shared object stub to a writable directory (typically /tmp), manipulates the catalina.out log file and /etc/ld.so.preload to hijack execution, and finally executes the payload as root. The exploit is operational and provides a root shell or Meterpreter session upon success. The main fingerprintable endpoints are the catalina.out log file, /etc/ld.so.preload, and the /tmp directory. The repository is structured as a standard Metasploit local exploit module.