A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
During an internal assessment last year, I found a Tomcat 9.0.17 instance on a Windows server. Port 8009 was open. The enableCmdLineArguments setting was active. Two CVEs in one host. The sysadmin had no idea the AJP connector was even enabled.
/etc/passwd—but WEB-INF/web.xml and potentially configuration files containing database credentials.This one affects Windows systems with enableCmdLineArguments enabled. Versions 9.0.0.M1 through 9.0.17, 8.5.0 through 8.5.39, and 7.0.0 through 7.0.93. The CGI Servlet passes query string arguments directly to the script without sanitization. The & character acts as a command separator.
The PATH variable is unset, so whoami won't work directly. You need full paths. And Tomcat's character filter blocks backslashes—but URL encoding bypasses it.
c%3A%5C decodes to c:\. The regex filter checks the raw URL for backslashes, but the decoded value passes through to cmd.exe. NT AUTHORITY\SYSTEM. Game over.Two CVEs on one host. Ghostcat reads your config files. CGI injection gives you SYSTEM. Both require port 8009 or the CGI servlet to be exposed—things that shouldn't be internet-facing but frequently are internally. Check both on every Tomcat instance you find.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.