About me
Edit

Tomcat CGI Attacks

  • The enableCmdLineArguments setting for Apache Tomcat's CGI Servlet controls whether command line arguments are created from the query string

    • If set to true,

      • the CGI Servlet parses the query string and passes it to the CGI script as arguments.

  • The CGI script can use command line arguments to switch between these actions. For instance, the script can be called with the following URL:

http://example.com/cgi-bin/booksearch.cgi?action=title&query=the+great+gatsby

  • Here, the action parameter is set to title, indicating that the script should search by book title. The query parameter specifies the search term "the great gatsby."

  • If the user wants to search by author, they can use a similar URL:

http://example.com/cgi-bin/booksearch.cgi?action=author&query=fitzgerald

  • However, a problem arises when enableCmdLineArguments is enabled on Windows systems because the CGI Servlet fails to properly validate the input from the web browser before passing it to the CGI script.

    • This can lead to an operating system command injection attack, which allows an attacker to execute arbitrary commands on the target system by injecting them into another command.

    • For instance, an attacker can append dir to a valid command using & as a separator to execute dir on a Windows system

    • If the attacker controls the input to a CGI script that uses this command, they can inject their own commands after & to execute any command on the server.

    • An example of this is http://example.com/cgi-bin/hello.bat?&dir, which passes &dir as an argument to hello.bat and executes dir on the server.

      • As a result, an attacker can exploit the input validation error of the CGI Servlet to run any command on the server.

Enumeration

  • Scan the target using nmap, this will help to pinpoint active services currently operating on the system.

  • This process will provide valuable insights into the target, discovering what services, and potentially which specific versions are running, allowing for a better understanding of its infrastructure and potential vulnerabilities.

Finding a CGI script

  • One way to uncover web server content is by utilising the ffuf web enumeration tool along with the dirb common.txt wordlist.

  • Knowing that the default directory for CGI scripts is /cgi, either through prior knowledge or by researching the vulnerability, we can use the URL http://10.129.204.227:8080/cgi/FUZZ.cmd or http://10.129.204.227:8080/cgi/FUZZ.bat to perform fuzzing.

Fuzzing Extentions - .CMD

  • Fuzzing Extentions - .CMD

Fuzzing Extentions - .BAT

  • Fuzzing Extentions - .BAT

Exploitation

  • we can exploit CVE-2019-0232 by appending our own commands through the use of the batch command separator &.

  • We now have a valid CGI script path discovered during the enumeration at http://10.129.204.227:8080/cgi/welcome.bat

  • Navigating to the above URL returns the output for the dir batch command, however trying to run other common windows command line apps, such as whoami doesn't return an output.

  • Retrieve a list of environmental variables by calling the set command

  • From the list, we can see that the PATH variable has been unset, so we will need to hardcode paths in requests:

  • The attempt was unsuccessful, and Tomcat responded with an error message indicating that an invalid character had been encountered.

  • Apache Tomcat introduced a patch that utilises a regular expression to prevent the use of special characters.

  • However, the filter can be bypassed by URL-encoding the payload.

PreviousGitlab AttacksNextAttacking Thick Client Applications

Last updated