Apache Tomcat 7.0.88 Exploit: A Step-by-Step Guide

In this article, we will explore the Apache Tomcat 7.0.88 exploit and demonstrate how to take advantage of it to gain access to a vulnerable lab presented by Hack the Box.

The Apache Tomcat 7.0.88 exploit is a remote code execution vulnerability that allows attackers to execute arbitrary commands on the server-side. This vulnerability was discovered in the CGI Servlet, which is responsible for executing command-line programs or scripts via web requests.

To begin with, we need to access the Tomcat webpage at the URL `http://10.10.10.95:8080/`. From here, we can try to find documentation on the administration portal in Tomcat.

Using Nmap, we scanned the IP address 10.10.10.95 and found that it is running Apache Tomcat/Coyote JSP engine 1.1. Our goal is to find the user.txt and root.txt files on the victim's machine.

To exploit this vulnerability, we need to follow these steps:

1. Disable CGI support: In the Tomcat configuration file `conf/web.xml`, set the `enableCmdLineArguments` parameter to `false`.

2. Enable command-line arguments: Set the `enableCmdLineArguments` parameter to `true` in the same file.

3. Create a batch file: Create a batch file named `cve-2019-0232.bat` with the following contents: `@echo off net user /add `

4. Upload the batch file: Upload the batch file to the Tomcat server using a tool like WinSCP.

5. Execute the batch file: Use the CGI Servlet to execute the batch file by sending a request to `http://10.10.10.95:8080/CGI-bin/cve-2019-0232.bat`.

6. Get the reverse shell: Once the batch file is executed, use Netcat to start a listener on your attacker machine and connect to it using the CGI Servlet.

Here's an example of how to do this:

* Start a Netcat listener on your attacker machine by running the command `nc -lvp 8080`.

* Send a request to `http://10.10.10.95:8080/CGI-bin/cve-2019-0232.bat?command=net%20user%20/add%20%20`.

By following these steps, you should be able to gain access to the user.txt and root.txt files on the victim's machine.

Important Notes:

* This exploit is only possible when running on Windows with `enableCmdLineArguments` enabled.

* The CGI option `enableCmdLineArguments` is disabled by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability).

* When running on Windows with `enableCmdLineArguments` enabled, the CGI Servlet in Apache Tomcat is vulnerable to RCE due to a bug in how the JRE passes command-line arguments to Windows.

In conclusion, the Apache Tomcat 7.0.88 exploit is a powerful tool that can be used to gain access to vulnerable labs and systems. However, it's essential to remember that this exploit is only possible under specific conditions and should not be used for malicious purposes.

Apache tomcat 7.0.88 exploit