Sploitus

Exploit for CVE-2020-1938

githubexploit · 2026-09-04

Exploit Code

README27 lines
## https://sploitus.com/exploit?id=F45C169C-6234-591F-90F9-FB46F2216B06
# CVE-2020-1938 Tomcat File Read / File Include (Ghostcat) — python3

CVE-2020-1938 (CNVD-2020-10487) Tomcat AJP protocol file reading/file inclusion vulnerability exploitation POC, **transformed version for python3**. Original version (python2) by ydhcui: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

## Usage

```bash
python3 "path/to/Tomcat-root/directory/file inclusion(CVE-2020-1938)-python3.py" -p 8009 -f /test.txt 127.0.0.1
```

## Parameters

| Parameter | Description | Default |
|----------|--------------|--------|
| `target` | Target host/IP | Required |
| `-p, --port` | AJP port | 8009 |
| `-f, --file` | Path to the file to be read | `WEB-INF/web.xml` |

## Conversion Notes (python2 → python3)

- `import io`, `StringIO` → `io.BytesIO` (AJP data is binary byte stream)
- `.encode('base64')` → `base64.b64encode(...).decode('utf-8')`
- Serialization of `res` changed to `b""` byte concatenation
- Response body output `b"".join(...)` and then decoded to UTF-8

Details: http://www.svenbeast.com/post/fqSI9laE8/