## https://sploitus.com/exploit?id=A9F55CF1-CFC2-58D8-AAE1-7CF33BB87D0C
# TomcatScanPro
**README**
**Version:** [English](README_EN.md)
If you find this project helpful, don’t forget to star the project! Your support is what keeps us improving and optimizing this project. 😊
## **Introduction**
This project is designed for detecting weak passwords in **Tomcat** services. In addition to supporting various exploitation methods for **CVE-2017-12615**, it also integrates the exploitation mechanism for **CNVD-2020-10487** (Tomcat AJP protocol local file inclusion vulnerability), enabling users to efficiently detect and exploit vulnerabilities to obtain sensitive server information. The tool also supports concurrent detection of multiple URLs and optimizes resource utilization through a dynamic thread pool mechanism, thereby improving detection efficiency.
## **Features**
### **1. CVE-2017-12615 Vulnerability Detection**
- The tool supports three exploitation methods:
- `PUT /1.jsp/`
- `PUT /1.jsp%20`
- `PUT /1.jsp::$DATA`
- After successful upload, the tool attempts to access and execute the uploaded JSP file to determine whether remote code execution is possible. The results of each method are recorded separately as success or failure.
### **2. CNVD-2020-10487 (AJP Protocol Local File Inclusion Vulnerability)**
- The tool uses the AJP protocol for local file inclusion attacks. By default, it reads the `WEB-INF/web.xml` file, but the file path and conditions can be adjusted flexibly through the configuration file. It supports customizing the keywords (e.g., “Welcome”) in the target file to determine whether the file reading is successful. After successful file inclusion, detailed records of the successful URLs and the paths of the read sensitive files are kept.
### **2. Weak Password Detection**
- Supports brute-force cracking of weak passwords using username and password combinations. If login is successful, the tool will automatically attempt to upload a WebShell file, providing remote management and code execution capabilities. Both successful login and WebShell upload results are recorded in the log file.
### **3. Deploying WAR Packages via Backend `getshell`**
- After successfully cracking weak passwords, the tool attempts to deploy `WAR` packages via Tomcat’s backend management, to gain remote code execution rights. The deployed `WAR` packages will automatically decompress on the server and generate JSP Shell files. Accessing these files allows gaining Shell privileges. Customizing the content of the Shell files is supported through the configuration file.
## **How to Use**
1. Prepare text files containing URLs, usernames, and passwords, named `urls.txt`, `user.txt`, and `passwd.txt`, respectively.
2. The `urls.txt` should be saved as follows: https://127.0.0.1/ or https://127.0.0.1/manager/html. The script will automatically determine the detection targets.
3. Configure the settings in the `config.yaml` file.
4. Run the script, and the successful exploitation information will be recorded in the `success.txt` file.
## **Environment Installation**
Install the required modules using the following commands:
```bash
pip install -r requirements.txt
```
## **Notes**
- Please comply with relevant laws and regulations when using this script. Do not perform unauthorized operations.
- This script is intended only for educational and testing purposes. Any consequences arising from improper use are not borne by this script.
[source-iocs-preserved url=https://127.0.0.1/manager/html]