ajp-ghostcat

What problem does it solve?

This Skill addresses vulnerabilities in Apache Tomcat's AJP connector, enabling attackers to read sensitive files, execute arbitrary code, and bypass access controls on exposed Tomcat instances.

Core Features & Use Cases

• Ghostcat File Read (CVE-2020-1938): Read sensitive files like web.xml or configuration files from web applications.
• Remote Code Execution: Achieve RCE by uploading a JSP payload and forcing its execution via AJP attribute injection, provided a file upload primitive exists.
• Tomcat Manager Bypass: Use AJP proxying to bypass IP restrictions and gain access to the Tomcat Manager interface for deploying applications or further exploitation.
• Use Case: A penetration tester discovers an exposed AJP port (8009) on a target's web server. They use this Skill to read the application.properties file, revealing database credentials, which are then used to pivot to the database.

Quick Start

Use the ajp-ghostcat skill to read the /WEB-INF/web.xml file from the target at 10.10.10.5 on port 8009.