1475210817/axis1.4-cve-2019-0227Apache Axis1.4 远程命令执行漏洞利用工具 - CVE-2019-0227，支持随机化服务名和Webshell文件名
Apache Axis1.4 contains a remote command execution vulnerability (CVE-2019-0227). When the enableRemoteAdmin property is set to true, an attacker can deploy a malicious service through the AdminService interface, thereby executing arbitrary system commands on the target server.
Affected version: Apache Axis ≤ 1.4
Trigger condition: enableRemoteAdmin set to true
| Method | Script | Principle | Writes File | Stealth |
|---|
| Method 1: JSP Webshell | jsp-webshell/axis_exp.py | Writes a JSP Webshell via LogHandler | ✅ Yes | Low |
| Method 2: Freemarker Direct Execution | freemarker-exec/axis_freemarker_exp.py | Directly calls the Freemarker Execute class to run commands | ❌ No | High |
cd jsp-webshell
python3 axis_exp.py -u http://target.com:8080/axis/ -c "whoami"
cd freemarker-exec
python3 axis_freemarker_exp.py -u http://target.com:8080/axis/ -c "whoami"
pip install requests urllib3
Axis1.4-CVE-2019-0227/
├── README.md
├── jsp-webshell/
│ ├── axis_exp.py
│ └── README.md
└── freemarker-exec/
├── axis_freemarker_exp.py
└── README.md
This tool is intended for security research and authorized testing only. Unauthorized use of this tool to attack target systems is illegal. Users assume all legal responsibility.
MIT License
# Axis1.4 CVE-2019-0227 Exploit Script - JSP Webshell Method
## Principle
Deploy a malicious service via Axis AdminService, use LogHandler to write a JSP Webshell, then execute commands via GET requests.
## Attack Flow
Deploy malicious service → LogHandler writes shell.jsp → GET request executes command
## Usage
```bash
# Execute a single command
python3 axis_exp.py -u http://localhost:8080/axis/ -c "whoami"
# Interactive Shell
python3 axis_exp.py -u http://localhost:8080/axis/ -i
# With authentication
python3 axis_exp.py -u http://localhost:8080/axis/ -U admin -P admin -i
| Parameter | Description |
|---|---|
-u, --url | Target Axis service URL |
-c, --command | Execute a single command |
-i, --interactive | Interactive Shell mode |
-U, --username | Basic authentication username |
-P, --password | Basic authentication password |
## 📝 Subdirectory README (freemarker-exec/README.md)
Deploy a service pointing to the freemarker.template.utility.Execute class via Axis AdminService, directly call its exec method to execute system commands, without writing any files.
Deploy Execute service → Directly call exec method → Command execution result returned via SOAP response
freemarker.jar in the WEB-INF/lib/ directory (Axis 1.4 ships it by default)# Execute a single command
python3 axis_freemarker_exp.py -u http://localhost:8080/axis/ -c "whoami"
# Interactive Shell
python3 axis_freemarker_exp.py -u http://localhost:8080/axis/ -i
# With authentication
python3 axis_freemarker_exp.py -u http://localhost:8080/axis/ -U admin -P admin -i
| Parameter | Description |
|---|---|
-u, --url | Target Axis service URL |
-c, --command | Execute a single command |
-i, --interactive | Interactive Shell mode |
-U, --username | Basic authentication username |
-P, --password | Basic authentication password |
freemarker.jar on the target