The video below demonstrates how an attacker using the CVE-2016-1240 vulnerability in Apache Tomcat packaging on Debian-based systems, could escalate their privileges to root user upon gaining access to the system as tomcat user.
In the presented scenario, the attacker gains the local access to tomcat shell by exploiting a pre-existing webapp vulnerability (File Upload) to upload a reverse shell and then proceeds to privilege escalation.
