关联漏洞
标题：
Apache Tomcat 安全漏洞
(CVE-2017-12617)
描述：Apache Tomcat是美国阿帕奇（Apache）软件基金会下属的Jakarta项目的一款轻量级Web应用服务器，它主要用于开发和调试JSP程序，适用于中小型系统。 Apache Tomcat中存在安全漏洞。攻击者可通过发送特制的请求利用该漏洞向服务器上传JSP文件，并执行文件中包含的代码。以下版本受到影响：Apache Tomcat 9.0.0.M1版本至9.0.0版本，8.5.0版本至8.5.22版本，8.0.0.RC1版本至8.0.46版本，7.0.0版本至7.0.81版本。
描述
Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018
介绍
# Getting started
The purpose of this Proof Of Concept is to demonstrate how it is possible to use the CVE-2017-12617
in order to have a remote control on an Apache Tomcat server.
## Instructions
1. Please execute this command to run the server.
`make server_up`
2. Execute this command to run the attack and upload a web shell on the server (need cURL).
`make attack`
> If this command don't open your navigator, you could go to :
`http://localhost:8080/web_shell.jsp?cmd=pwd`
You will now have access to a web shell on the server, directly in your browser.
## Questions
If you have any problems to run this Proof of Concept, please create an issue at : https://github.com/ygouzerh/CVE-2017-12617/issues , we will do our best to answer you as quickly as possible.
文件快照
[4.0K] /data/pocs/81fc47574261d24537f1b1f39dc98c9af99c935e
├── [ 83] attack.sh
├── [ 242] Makefile
├── [595K] rapport.pdf
├── [ 775] README.md
├── [4.0K] victim
│ ├── [ 61] Dockerfile
│ └── [165K] web.xml
└── [ 636] web_shell.jsp
1 directory, 7 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。