Apache Tomcat JSP Upload Remote Code Execution

This repository is a small standalone exploit project for CVE-2017-12615, containing one documentation file (README.md) and one Python exploit script (exploit.py). The README explains the Apache Tomcat arbitrary JSP upload issue affecting Tomcat 7.0.0 through 7.0.79 on Windows when PUT is enabled and DefaultServlet is writable. The Python script is the operational component: it disables TLS warnings, uses requests for HTTP interaction, rich for console output, threading for concurrency and listener handling, and argparse for CLI control. The exploit has two main capabilities. First, it can scan one or more targets for vulnerability by attempting HTTP PUT uploads of temporary JSP files using several path variants, including plain .jsp, trailing slash, %20 suffix, and ::$DATA suffix. It then performs HTTP GET to confirm the uploaded file is retrievable and issues DELETE for cleanup. Second, it can exploit a vulnerable target by generating a JSP reverse shell payload, uploading it to the Tomcat web root, and triggering execution so the target connects back to an attacker-controlled listener. The embedded JSP payload is more than a simple command runner: it creates a socket to the supplied LHOST/LPORT, spawns cmd.exe on Windows or /bin/bash otherwise, and relays stdin/stdout/stderr between the shell process and the socket using Java stream-handling threads. That makes the repository an operational exploit rather than a mere proof of concept. The code appears intended for direct command-line use, with exploit.py as the entry point. The visible code and README are consistent with the claimed vulnerability and do not indicate the repository is fake.

This repository contains a single-file JSP webshell (1.jsp) and a README.md with usage instructions. The webshell allows remote command execution by passing a 'cmd' parameter via HTTP GET requests. The README demonstrates how to upload the webshell to a target server using curl and provides a sample endpoint (http://34.124.205.159:8080/1.jsp). The exploit is operational and can be used against any web server capable of executing JSP files where arbitrary file upload is possible. The main attack vector is network-based, targeting web servers that process JSP files. No specific CVE is referenced, and the exploit is generic in nature.

This repository provides a proof-of-concept (PoC) exploit and a vulnerable environment for CVE-2017-12615, a remote code execution vulnerability in Apache Tomcat. The main exploit is implemented in 'CVE-2017-12615.py', a Python script that uploads a JSP file to a target Tomcat server using an HTTP PUT request. The exploit leverages a misconfiguration (readonly=false) in the Tomcat DefaultServlet, as set in the provided 'web.xml', to allow arbitrary file upload and execution. The repository includes a Dockerfile and docker-compose.yml to set up a vulnerable Tomcat 7.0.79 instance for testing. The README.md provides detailed setup and usage instructions. The exploit's main capability is to achieve remote code execution by uploading and executing a JSP webshell on the target server. Key fingerprintable endpoints include the upload URL (http://[TARGETIP]/[jsp_name]/) and the resulting webshell (http://[TARGETIP]/test.jsp).

This repository contains a Python proof-of-concept exploit for CVE-2017-12615 and CVE-2017-12617, targeting Apache Tomcat servers (primarily on Windows) with the HTTP PUT method enabled. The main file, 'tomcate-cve-put.py', attempts to upload a JSP webshell to the target server by sending a PUT request. If successful, the attacker can access the uploaded JSP file via HTTP and execute arbitrary system commands through a web interface. The exploit requires the attacker to specify the target host and the desired JSP filename. The repository is structured simply, with a README, a .gitignore, and the exploit script. The exploit is operational, as it provides a working payload (JSP webshell) and automates the attack process.

This repository is a graphical JavaFX tool for exploiting CVE-2017-12615, a vulnerability in Apache Tomcat 7.0.0-7.0.79 on Windows that allows arbitrary file upload via the HTTP PUT method. The tool provides a GUI for: - Detecting if a target Tomcat server is vulnerable by checking for PUT support and attempting to upload a test JSP shell. - Uploading a default or custom JSP webshell (default is Godzilla webshell, password: xiaokp) to the server. - Executing arbitrary system commands on the target via the uploaded shell (with password 'xiaokp.456.789'). The main logic is in 'src/cn/xiaokp/Tomcat_PUT_EXP/Controller.java', which handles vulnerability detection, command execution, and webshell upload. The tool uses the 'HttpRequest' Java library for HTTP requests. The endpoints '/exec.jsp' and '/shell.jsp' are used for shell access and command execution. The repository includes Java source, FXML UI definitions, and supporting library code, with the entry point at 'Main.java'. This is an operational exploit with a working payload and a user-friendly interface, suitable for penetration testing of Tomcat servers vulnerable to CVE-2017-12615.

This repository is a Python-based exploitation toolkit targeting Apache Tomcat servers. The main script, TomcatScanPro.py, automates detection and exploitation of several vulnerabilities and misconfigurations: 1. CVE-2017-12615: Exploits the HTTP PUT method to upload a JSP webshell using three different path tricks. After upload, it attempts to access and execute the shell to verify remote code execution. 2. CNVD-2020-10487: Exploits the AJP protocol to perform local file inclusion (LFI), by default reading WEB-INF/web.xml, with the ability to customize the file path and success keyword. 3. Weak Password Brute-Force: Attempts to brute-force Tomcat Manager credentials using provided username and password lists. Upon successful login, it uploads a WAR package containing a Godzilla JSP webshell for persistent remote code execution. The tool supports concurrent scanning of multiple targets, configurable via a YAML file. All successful exploitation attempts are logged to success.txt. The payloads are customizable, and the default shell is a Godzilla JSP shell supporting AES-encrypted payloads. The repository includes sample data files for URLs, usernames, and passwords, as well as configuration and requirements files. The tool is operational and can be used for both vulnerability assessment and exploitation of Tomcat servers.

This repository contains a single Python script, 'tomcat-cve-2017-12615.py', which exploits CVE-2017-12615, a vulnerability in Apache Tomcat (versions 7.0.0 to 7.0.81 on Windows) that allows arbitrary file upload via the HTTP PUT method. The script first checks if the PUT method is allowed by sending an OPTIONS request to a test endpoint. If allowed, it uploads a JSP webshell to a randomly named file on the server. The uploaded webshell allows remote command execution by sending HTTP requests with specific parameters. The script is operational and provides a working exploit with a hardcoded JSP payload. The main attack vector is network-based, targeting Tomcat servers accessible over HTTP. The script is self-contained, requires the target URL as an argument, and demonstrates the exploit's effectiveness by reporting the webshell's location if successful.

This repository contains a Python exploit script (CVE-2017-12615.py) targeting Apache Tomcat 7.0.0 to 7.0.79 servers with the HTTP PUT method enabled. The exploit works by uploading a malicious JSP file (webshell) to the server using a PUT request. The webshell allows remote command execution via the 'cmd' HTTP parameter. The script verifies successful upload by issuing a test command ('whoami') and then provides an interactive shell for the attacker to execute further commands. The README provides basic usage instructions and highlights the requirement for the PUT method to be enabled. The main fingerprintable endpoint is the '/1337.jsp/' path, which is used for both uploading and interacting with the webshell. The exploit is operational and provides a working remote command execution capability if the target is vulnerable.

This repository is a Tomcat vulnerability exploitation toolkit with a Java GUI (JavaFX) and supporting Python script for AJP exploitation. It targets multiple vulnerabilities in Apache Tomcat: 1. **CVE-2017-12615 (PUT file upload)**: The tool attempts to upload a file (potentially a webshell) to the target Tomcat server using the HTTP PUT method. It then verifies if the upload was successful by attempting to access the uploaded file. 2. **Weak password brute-force**: The tool brute-forces Tomcat Manager or similar endpoints using configurable username and password lists (provided in `username.txt` and `password.txt`). 3. **CVE-2020-1938 (AJP file read/include)**: The toolkit includes a Python script (`ajpVul.py`) that exploits the AJP protocol to read arbitrary files or attempt remote code execution via file inclusion. The Java GUI calls this script as a subprocess. The main entry point is `main.java`, which launches a JavaFX GUI. The GUI allows users to configure proxies, set brute-force dictionaries, and launch the various exploits. The code is modular, with separate controllers for each exploit type and for proxy/dictionary configuration. The toolkit supports both HTTP and SOCKS proxies for network requests. **Notable endpoints and files:** - `/manager/html`: Target for brute-force attacks. - `/1092wxa.txt`: Test file for PUT upload. - `WEB-INF/web.xml`: Default file for AJP file read. - `config/ajpVul.py`: Python script for AJP exploitation. - TCP port 8009: Default AJP port. **Purpose:** The repository is designed for security testing of Apache Tomcat servers, providing detection and exploitation capabilities for several well-known vulnerabilities. It is intended for use by security professionals for penetration testing and self-assessment of Tomcat deployments.