TOMCAT

Apache Tomcat CVE Assessment & Exploitation Framework

TOMCAT is a testing tool for identifying and exploiting directory traversal vulnerabilities in Apache Tomcat servers. This framework combines detection for both recent and historical CVEs with practical exploitation capabilities, taking you from initial reconnaissance to full system compromise.

Supported Vulnerabilities

CVE-2020-17530
- Affected Versions: Tomcat 7.0.0 to 7.0.108, 8.5.0 to 8.5.60, 9.0.0 to 9.0.40
- Impact: Directory traversal via rewrite misconfiguration
- Vector: Double URL encoding attacks

CVE-2025-55752

Affected Versions:
- Tomcat 10.1.0-M1 to 10.1.29
- Tomcat 11.0.0-M1 to 11.0.0-M18
- Tomcat 9.0.0-M1 to 9.0.97 (under specific configurations)

Vulnerability Description:
Path traversal vulnerability in Apache Tomcat's URL processing that fails to properly normalize certain encoded path sequences, allowing attackers to read arbitrary files outside the web root directory.

Exploitation Vectors:
- ....// sequences that bypass normalization checks
- Semicolon separators (..;/..;/) for alternative path traversal
- Unicode encoding variations (%c0%af) for evasion
- Double URL encoding payloads

Impact:
- Arbitrary file read (passwd, shadow, web.xml, configuration files)
- Potential credential and source code exposure
- Information disclosure leading to further compromise

How TOMCAT Exploits It:
- Multi-payload testing with various encoding techniques
- Live file content validation to confirm successful traversal
- Version-aware payload prioritization
- Integration with RCE chain when PUT method available

Detection Methodology:
The scanner tests multiple traversal patterns against known file paths, analyzing HTTP responses for successful file content indicators while correlating with Tomcat version data to minimize false positives.

Real-World Validation:
Confirmed working against Tomcat 10.0.0+ instances in production environment.

---

TOMCAT Features

• Dual CVE detection with intelligent payload selection
• Tomcat version fingerprinting and vulnerability correlation
• Multiple operational modes (stealth, assessment, full exploitation)
• Automated file exfiltration of sensitive system and configuration files
• RCE assessment via PUT method testing
• JSP webshell deployment and multi-platform reverse shells
• Comprehensive reporting with actionable next steps

Installation

git clone https://github.com/ekomsSavior/TOMCAT
cd TOMCAT

pip3 install requests urllib3

Usage

python3 tomcat.py

Platform Support

This tool works across all major platforms:
- Linux (Kali, Ubuntu, etc.) - Primary development platform
- Windows - Requires Python 3.6+ and same dependencies
- macOS - Native support with homebrew Python

Windows users may need to install Python from python.org and use Command Prompt or PowerShell.

Usage Guide

When you launch the scanner, you'll be guided through an interactive menu:

1. Target Configuration
2. Enter the full Tomcat server URL (http/https, IP or domain)

3. The tool verifies connectivity and Tomcat indicators

4. Operational Mode Selection

5. Vulnerability Assessment: Safe scanning only, no exploitation
6. Assessment + RCE Check: Adds PUT method testing for potential code execution
7. Full Exploitation: Complete assessment with file exfiltration and shell deployment

8. Stealth Mode: Slower, less noisy scanning for monitored environments

9. Scan Execution
   The tool automatically:

10. Fingerprints Tomcat version and correlates with known affected versions
11. Tests multiple traversal payloads for both CVEs
12. Provides real-time feedback on each test
13. Confirms vulnerabilities with file content validation

1. Exploitation Phase (if selected)
2. Automatically attempts to read sensitive files (/etc/passwd, web.xml, configuration files)
3. Tests PUT method availability for potential webshell upload
4. If PUT enabled, deploys command shells or reverse shells
5. Saves exfiltrated data to local files for analysis

Reverse Shell Capabilities

TOMCAT framework includes comprehensive RCE exploitation through multiple vectors:

PUT Method Exploitation
- Automated detection of enabled PUT methods
- JSP webshell deployment for command execution
- Multi-platform reverse shell generation
- Persistent backdoor installation

Reverse Shell Types Supported

Unix/Linux Targets
- Bash reverse shells with full TTY allocation
- Python-based shells for environments with limited binaries
- Netcat-based fallbacks when available

Windows Targets
- PowerShell reverse shells with AMSI bypass techniques
- Base64 encoded payloads for command line evasion
- Full interactive PowerShell sessions

Reverse Shell Deployment Process

When you select "Full Exploitation" mode:

1. PUT Method Assessment
2. Automatic OPTIONS request analysis
3. Direct PUT method testing with cleanup

4. Authentication requirement detection

5. Webshell Upload

6. Randomly named JSP files to avoid detection
7. Command execution validation

8. File permission verification

9. Reverse Shell Triggering

10. Listener configuration prompts
11. Payload generation based on target OS
12. Manual trigger control for operator timing

Example Reverse Shell Workflow

[+] Checking PUT method availability...
[+] PUT method enabled (direct test)

[+] Attempting webshell upload...
[+] Webshell uploaded: https://target:8080/cmd_28374.jsp

[+] Uploading reverse shell...
[+] Reverse shell uploaded: https://target:8080/rev_49261.jsp
[!] Start listener: nc -nvlp 4444
[!] Press Enter to trigger reverse shell...

[+] Reverse shell triggered! Check your listener.

Listener Setup Examples

# Netcat listener (Linux/Mac)
nc -nvlp 4444

# Powercat listener (Windows) 
powercat -l -p 4444

# Socat listener (Enhanced features)
socat file:`tty`,raw,echo=0 tcp-listen:4444

What's Happening Under the Hood

Reconnaissance Phase
- Basic connectivity checks and service validation
- Server header analysis and Tomcat fingerprinting
- Content-based version detection from error pages and management interfaces

Vulnerability Assessment
- Sequential payload testing with multiple encoding techniques
- Live analysis of HTTP responses for successful file read indicators
- Correlation between detected version and relevant CVE payloads

Exploitation Engine
- Intelligent file path construction for maximum traversal depth
- Adaptive payload selection based on initial scan results
- Multi-platform shellcode generation (Unix/Windows/Python)
- Safe file handling and evidence

This shows successful vulnerability confirmation with:
- Specific CVE identification
- Working payload used
- File content validation

Advanced RCE Features

Webshell Persistence
- Multiple webshell deployment locations
- Configuration file modification for persistence
- Service installation on compromised hosts

Evasion Techniques
- Random JSP filenames to avoid pattern detection
- Obfuscated command execution
- Traffic encryption capabilities

Post-Exploitation
- Automatic privilege escalation checks
- Network reconnaissance from compromised host
- Lateral movement assessment

Legal Disclaimer

TOMCAT is designed for authorized security testing only.
Users must ensure they have explicit permission to test target systems.
Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.
The developer assumes no liability for misuse of this tool.

---

Want me to format this as a Markdown file for your repository or adjust any technical details?

https://instagram.com/ekoms.is.my.savior

MIT License Copyright (c) 2026 ek0mssavi0r / Church of Malware Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. USE AT YOUR OWN RISK. NO WARRANTY PROVIDED.