CVE-2017-12617 PoC — Apache Tomcat 安全漏洞

Description

Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018

介绍

# Getting started

The purpose of this Proof Of Concept is to demonstrate how it is possible to use the CVE-2017-12617
in order to have a remote control on an Apache Tomcat server.

## Instructions

1. Please execute this command to run the server.

`make server_up`

2. Execute this command to run the attack and upload a web shell on the server (need cURL).

`make attack`

> If this command don't open your navigator, you could go to :
`http://localhost:8080/web_shell.jsp?cmd=pwd`

You will now have access to a web shell on the server, directly in your browser.

## Questions

If you have any problems to run this Proof of Concept, please create an issue at : https://github.com/ygouzerh/CVE-2017-12617/issues , we will do our best to answer you as quickly as possible.

文件快照

备注