Deploy malicious Tomcat application

Deploy a Tomcat web application archive containing a web-shell endpoint to an authorized server. The procedure requires a remotely reachable Tomcat Manager text interface and an account with the manager-script role; the default Manager access is disabled until configured. If the deployed JSP endpoint implements operating-system command execution, requests to that endpoint can provide persistent remote command access within the Tomcat service account's permissions.