-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Create a link to the issues.
- Loading branch information
Yohan Gouzerh
committed
Jan 14, 2019
1 parent
449fe3c
commit ac0e046
Showing
1 changed file
with
18 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,23 @@ | ||
# Getting started | ||
|
||
## launch tomcat server | ||
The purpose of this Proof Of Concept is to demonstrate how it is possible to use the CVE-2017-12617 | ||
in order to have a remote control on an Apache Tomcat server. | ||
|
||
## Instructions | ||
|
||
1. Please execute this command to run the server. | ||
|
||
`make server_up` | ||
|
||
## launch attack(need cURL) | ||
`make attack` | ||
2. Execute this command to run the attack and upload a web shell on the server (need cURL). | ||
|
||
`make attack` | ||
|
||
> If this command don't open your navigator, you could go to : | ||
`http://localhost:8080/web_shell.jsp?cmd=pwd` | ||
|
||
You will now have access to a web shell on the server, directly in your browser. | ||
|
||
## Questions | ||
|
||
If you have any problems to run this Proof of Concept, please create an issue at : https://github.com/ygouzerh/CVE-2017-12617/issue , we will do our best to answer you as quickly as possible. |