## https://sploitus.com/exploit?id=A0CC9855-3D63-5DD7-B1B0-9A0BF0B2C2F8
# CVE-2026-34486-Tribes
Apache Tomcat Tribes cluster communication protocol detection tool
This tool is used to understand the encapsulation process of the Tribes protocol. It sends detection packets to targets by constructing legitimate `XByteBuffer` frames (`FLT2002...TLF2003`). Based on the structure of response frames, it determines whether the target port is a node in the Apache Tomcat Tribes cluster.
## Vulnerability Background
**CVE-2026-34486** affects the communication module of the Apache Tomcat Tribes cluster. When `EncryptInterceptor` fails to decrypt data using AES, it captures exceptions and only logs them. Since `super.messageReceived(msg)` is located outside the `try-catch` block, unencrypted raw serialization bytes are still passed to subsequent processing chains, ultimately triggering deserialization via `ObjectInputStream`, resulting in a RCE vulnerability.
## Frame Structure
```
[ FLT2002 ][ payload_len(4B) ][ channel_data ][ TLF2003 ]
```
`channel_data` contains:
- `options` (4B)
- `timestamp` (8B)
- `uniqueId` (16B)
- Serialization data of `MemberImpl` (`TRIBES-B`โฆ`TRIBES-E`)
- Message body
---
## Usage
```bash
python3 Tribes.py -l targets.txt
python3 Tribes.py -l targets.txt -t 3 -o results.txt
python3 Tribes.py -l targets.txt -c 100 --no-adaptive
```
**Parameter Descriptions:**
| Parameter | Description | Default |
|-----------|-------------|---------|
| `-l` | List of targets, one IP or IP:Port per line | Required |
| `-t` | Timeout seconds | `5` |
| `-o` | Output file path | `tribes.txt` |
| `-c` | Concurrent tasks (automatically adjusted in adaptive mode) | `50` |
| `--no-adaptive` | Disables adaptive concurrency, uses fixed concurrent tasks | - |
---
## Output Format
```
[+] 192.168.1.1:4000 - 'FLT2002 xx xx xx ... TLF2003' # Tribes node
[-] 192.168.1.2:4000 - Not Tribes # Non-Tribes node
```
Results are automatically written to the output file, with support for resume from where you left off. ---
> โ ๏ธ This tool is intended only for security research and authorized testing purposes. It must not be used for any unauthorized network probing activities. Users who violate this rule will bear the consequences.