Apache Tomcat – Account Scanner / ‘PUT’ Request Command Execution

• Exploit Database
• 113 阅读

• 作者： kingcope
  日期： 2012-03-19
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/18619/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

  ISOWAREZ RELEASE By KINGCOPE - YEAR 2012   -== Apache Tomcat Remote Exploit and Account Scanner ==-   the modified pnscan scanner utility scans a range of IPs to find open apache tomcat servers by trying the following login access combinations:   tomcat:tomcat password:password admin:admin admin:password admin:<nopassword> tomcat:<nopassword>   the included perl script can be used to unlock apache tomcat servers remotely by using the collected login combinations. it will retrieve either a root or SYSTEM reverse shell depending on the operating system or the equivalent of a reverse shell as the current user tomcat is running as. the exploit might contain metasploit logic (thanks to jduck).   Enjoy :>   /Kingcope   https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18619.zip (tomcat-remote.zip)