メニュー
Apache Tomcat CVE-2017-12615 PUT arbitrary file upload RCE via JSP webshell. Targets Tomcat instances with HTTP PUT enabled and write permissions on the webroot.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Fast HTTP probing and lightweight fingerprinting using ProjectDiscovery httpx. Use for web recon with redirect-awareness and JSON output.
V5 样板 Micro-Skill：Pydantic 入参、micro_executor SDK、落盘 parsed.json、stderr S-06、stdout Agent 摘要 JSON（嵌入 raw_stdout）。
Build a basic understanding of the current project by scanning source code and available docs. Use when user asks for /init, project onboarding, quick repo familiarization, or initial architecture context.
Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics.
Raw HTTP probing with curl. Use for custom method, headers and body requests in recon and validation.
Advanced web path scanner using multithreaded brute-force. Use for discovering hidden files, directories, and endpoints on web servers.
| name | exploit-tomcat |
| description | Apache Tomcat CVE-2017-12615 PUT arbitrary file upload RCE via JSP webshell. Targets Tomcat instances with HTTP PUT enabled and write permissions on the webroot. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","curl"],"env":[]},"primaryEnv":null}} |
Exploits Apache Tomcat's misconfigured HTTP PUT handler (CVE-2017-12615) to upload a JSP webshell and achieve remote code execution.
Apache Tomcat 7.0.0 - 7.0.81 with readonly init parameter set to false in DefaultServlet config (enabled by some deployment templates).
Provide target (Tomcat base URL). The skill uploads a JSP webshell via HTTP PUT and executes a command through it, returning output.
| Param | Type | Required | Description |
|---|---|---|---|
| target | string | yes | Base URL of the Tomcat instance |
| cmd | string | no | OS command to execute (default: id) |
| path | string | no | Upload path override (default: /upload.jsp/) |
| timeout | int | no | Timeout in seconds (default: 30) |
Affects Tomcat 7.x; check version with httpx/whatweb before use. The trailing slash trick (/upload.jsp/) bypasses the JSP execution filter during upload.
