Tomcat / AJP:
Exploitation
Guides on deploying malicious WAR files via Tomcat Manager
Tomcat Manager WAR Deployment
Deploy malicious WAR files via Tomcat Manager to gain remote code execution, exploiting weak credentials or misconfigurations in exposed management interfaces.
Tomcat AJP exploitation centers on the Ghostcat vulnerability (CVE-2020-1938), one of the most impactful Tomcat findings. Ghostcat allows an attacker to read any file within the web application directory through the AJP connector by manipulating javax.servlet.include.* request attributes. This means reading WEB-INF/web.xml, source code, configuration files, and database credentials without authentication.
When the target allows JSP file uploads (even to a non-executable location), Ghostcat escalates from file read to remote code execution by processing the uploaded file as a JSP through the AJP include mechanism. AJP request smuggling through mismatches between the proxy and Tomcat's parsing of AJP packets is another avenue on specific versions.
Tomcat Manager deployment abuse through AJP works when the Manager application is deployed and accessible via the AJP connector, even if the HTTP port restricts it. Default credentials (tomcat/tomcat, admin/admin) or brute-forced credentials let you deploy a malicious WAR file for a full shell. Tools like ajpShooter and pyfuscern automate the Ghostcat exploitation chain.