From c791e7c132e7be161ad3d5d998953eeaf2f05a1d Mon Sep 17 00:00:00 2001
From: Raul <raul@doyensec.com>
Date: Wed, 4 Sep 2024 23:06:20 +0200
Subject: [PATCH 1/2] Add support to AJP weak credentials tester

---
 .../weak_credentials/conf/tomcat-users.xml    |  5 +++
 .../weak_credentials/docker-compose.yml       |  8 +++--
 apache/tomcat/weak_credentials/server.xml     | 31 +++++++++++++++++++
 3 files changed, 41 insertions(+), 3 deletions(-)
 create mode 100644 apache/tomcat/weak_credentials/conf/tomcat-users.xml
 create mode 100644 apache/tomcat/weak_credentials/server.xml

diff --git a/apache/tomcat/weak_credentials/conf/tomcat-users.xml b/apache/tomcat/weak_credentials/conf/tomcat-users.xml
new file mode 100644
index 00000000..314a0c40
--- /dev/null
+++ b/apache/tomcat/weak_credentials/conf/tomcat-users.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0"?>
+<tomcat-users>
+    <role rolename="manager-gui"/>
+    <user username="root" password="pass" roles="manager-gui"/>
+</tomcat-users>
diff --git a/apache/tomcat/weak_credentials/docker-compose.yml b/apache/tomcat/weak_credentials/docker-compose.yml
index 91503c1a..3ec75f8b 100644
--- a/apache/tomcat/weak_credentials/docker-compose.yml
+++ b/apache/tomcat/weak_credentials/docker-compose.yml
@@ -1,16 +1,18 @@
-version: '2'
-
 services:
   tomcat:
     image: docker.io/bitnami/tomcat:10.1
     ports:
       - '8080:8080'
+      - '8009:8009'
     volumes:
       - 'tomcat_data:/bitnami/tomcat'
+      - './server.xml:/opt/bitnami/tomcat/conf/server.xml'
+      - './conf/tomcat-users.xml:/opt/bitnami/tomcat/conf/tomcat-users.xml'
+
     environment:
       - TOMCAT_USERNAME=root
       - TOMCAT_PASSWORD=pass
 
 volumes:
   tomcat_data:
-    driver: local
\ No newline at end of file
+    driver: local
diff --git a/apache/tomcat/weak_credentials/server.xml b/apache/tomcat/weak_credentials/server.xml
new file mode 100644
index 00000000..bc0810e8
--- /dev/null
+++ b/apache/tomcat/weak_credentials/server.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Server port="8005" shutdown="SHUTDOWN">
+
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener"/>
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
+
+    <GlobalNamingResources>
+        <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" pathname="conf/tomcat-users.xml"/>
+    </GlobalNamingResources>
+
+
+  <Service name="Catalina">
+
+    <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443"/>
+    <Connector protocol="AJP/1.3" port="8009" address="0.0.0.0" redirectPort="8443" secretRequired="false"/>
+
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
+
+      <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">
+
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b"/>
+
+      </Host>
+    </Engine>
+  </Service>
+</Server>

From 4c3c29b06e3adae9bca567e0151f670e38428b79 Mon Sep 17 00:00:00 2001
From: Raul <raul@doyensec.com>
Date: Tue, 15 Oct 2024 16:15:57 +0200
Subject: [PATCH 2/2] Modified Readme name

---
 apache/tomcat/weak_credentials/{tomcat.md => README.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename apache/tomcat/weak_credentials/{tomcat.md => README.md} (100%)

diff --git a/apache/tomcat/weak_credentials/tomcat.md b/apache/tomcat/weak_credentials/README.md
similarity index 100%
rename from apache/tomcat/weak_credentials/tomcat.md
rename to apache/tomcat/weak_credentials/README.md