CVE 2017-12615 Apache Tomcat Windows RCE

⚠️Warning

This is a proof of concept environment and exploit for known CVEs, strictly for learning and educational purposes.

Do not use these scripts or techniques on systems you do not own or have explicit permission to test. Unauthorised access or exploitation of systems is illegal and unethical.

📃Description

This is a proof of concept environment and exploit for CVE 2017-12615.

The vulnerability arises in Tomcat with the following factors:

1. Servlet context was configured to have readonly=false
2. HTTP PUT requests are allowed

As such attackers may send and thus upload a JSP file via PUT a request. Apache Tomcat will then execute the code and render the response, rendering it vulnerable to remote code execution (RCE)

✏️Usage

Setting up the environment

1. Install and set up