/CVE-2017-12617

Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018

Primary LanguageJava

Getting started

The purpose of this Proof Of Concept is to demonstrate how it is possible to use the CVE-2017-12617 in order to have a remote control on an Apache Tomcat server.

Instructions

  1. Please execute this command to run the server.

make server_up

  1. Execute this command to run the attack and upload a web shell on the server (need cURL).

make attack

If this command don't open your navigator, you could go to : http://localhost:8080/web_shell.jsp?cmd=pwd

You will now have access to a web shell on the server, directly in your browser.

Questions

If you have any problems to run this Proof of Concept, please create an issue at : https://github.com/ygouzerh/CVE-2017-12617/issues , we will do our best to answer you as quickly as possible.