Usage

To use this exploit, you need the following:

• A Kali Linux machine or a similar penetration testing environment.
• Netcat installed for listening on the specified port.
• A vulnerable Adobe ColdFusion 8 server.

Command Syntax

Arguments

• -l <LHOST>: Local attacker IP (e.g., 10.10.16.5).
• -p <LPORT>: Local attacker port for the reverse shell (e.g., 9001).
• -r <RHOST>: Remote target IP (e.g., 10.10.10.11).
• -q <RPORT>: Remote target port where ColdFusion is running (e.g., 8500).

Example Usage

1. Start a listener on your attacker machine:

   root@kitploit:~

   nc -lnvp 9001
   

2. Run the exploit with the appropriate arguments.

3. Once executed, the payload will connect back to your listener.

How It Works

1. Generate Payload:

   • The script uses msfvenom to generate a malicious JSP payload.
   • The payload initiates a reverse shell to the specified LHOST and LPORT.

2. Upload Payload:

   • The payload is uploaded to the vulnerable ColdFusion server using a POST request.

3. Trigger Payload:

   • The uploaded payload is executed by sending a GET request to the file's URL.

4. Establish Reverse Shell:

   • A reverse shell is established, giving the attacker access to the target system.

Requirements

• msfvenom for payload generation.
• curl for file upload and triggering the payload.
• nc (Netcat) for listening to reverse shell connections.

Example Output

Disclaimer

This script is for educational purposes only. Use it on systems you own or have explicit permission to test. Unauthorized use of this exploit on systems you do not own is illegal and unethical.

Author

Developed by [0xDTC].