203 lines
10 KiB
Markdown
203 lines
10 KiB
Markdown
# 8009 - Pentesting Apache JServ Protocol (AJP)
|
||
|
||
<details>
|
||
|
||
<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch</strong></a> <strong>Wed - 18.30(UTC) 🎙️</strong> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|
||
|
||
<figure><img src="../.gitbook/assets/image (7).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**Follow HackenProof**](https://bit.ly/3xrrDrL) **to learn more about web3 bugs**
|
||
|
||
🐞 Read web3 bug tutorials
|
||
|
||
🔔 Get notified about new bug bounties
|
||
|
||
💬 Participate in community discussions
|
||
|
||
## Basic Information
|
||
|
||
From: [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
|
||
|
||
> AJP is a wire protocol. It an optimized version of the HTTP protocol to allow a standalone web server such as [Apache](http://httpd.apache.org/) to talk to Tomcat. Historically, Apache has been much faster than Tomcat at serving static content. The idea is to let Apache serve the static content when possible, but proxy the request to Tomcat for Tomcat related content.
|
||
|
||
Also interesting:
|
||
|
||
> The ajp13 protocol is packet-oriented. A binary format was presumably chosen over the more readable plain text for reasons of performance. The web server communicates with the servlet container over TCP connections. To cut down on the expensive process of socket creation, the web server will attempt to maintain persistent TCP connections to the servlet container, and to reuse a connection for multiple request/response cycles
|
||
|
||
**Default port:** 8009
|
||
|
||
```
|
||
PORT STATE SERVICE
|
||
8009/tcp open ajp13
|
||
```
|
||
|
||
## CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat)
|
||
|
||
If the AJP port is exposed, Tomcat might be susceptible to the Ghostcat vulnerability. Here is an [exploit](https://www.exploit-db.com/exploits/48143) that works with this issue.
|
||
|
||
Ghostcat is a LFI vulnerability, but somewhat restricted: only files from a certain path can be pulled. Still, this can include files like `WEB-INF/web.xml` which can leak important information like credentials for the Tomcat interface, depending on the server setup.
|
||
|
||
Patched versions at or above 9.0.31, 8.5.51, and 7.0.100 have fixed this issue.
|
||
|
||
## Enumeration
|
||
|
||
### Automatic
|
||
|
||
```bash
|
||
nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 <IP>
|
||
```
|
||
|
||
### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#ajp)
|
||
|
||
## AJP Proxy
|
||
|
||
### Apache AJP Proxy
|
||
|
||
It’s not often that you encounter port 8009 open and no other web port open. In which case it would be nice to use existing tools like metasploit to still pwn it right? As stated in one of the quotes you can (ab)use Apache to proxy the requests to Tomcat port 8009. In the references you will find a nice guide on how to do that (read it first), what follows is just an overview of the commands I used on my own machine. I omitted some of the original instruction since they didn’t seem to be necessary.
|
||
|
||
```bash
|
||
sudo apt-get install libapache2-mod-jk
|
||
sudo vim /etc/apache2/apache2.conf # append the following line to the config
|
||
Include ajp.conf
|
||
sudo vim /etc/apache2/ajp.conf # create the following file, change HOST to the target address
|
||
ProxyRequests Off
|
||
<Proxy *>
|
||
Order deny,allow
|
||
Deny from all
|
||
Allow from localhost
|
||
</Proxy>
|
||
ProxyPass / ajp://HOST:8009/
|
||
ProxyPassReverse / ajp://HOST:8009/
|
||
sudo a2enmod proxy_http
|
||
sudo a2enmod proxy_ajp
|
||
sudo systemctl restart apache2
|
||
```
|
||
|
||
A nice side effect of using this setup is that you might thwart IDS/IPS systems in place since the AJP protocol is somewhat binary, but I haven’t verified this. Now you can just point your regular metasploit tomcat exploit to 127.0.0.1:80 and take over that system. Here is the metasploit output also:
|
||
|
||
```bash
|
||
msf exploit(tomcat_mgr_deploy) > show options
|
||
|
||
Module options (exploit/multi/http/tomcat_mgr_deploy):
|
||
|
||
Name Current Setting Required Description
|
||
---- --------------- -------- -----------
|
||
PASSWORD tomcat no The password for the specified username
|
||
PATH /manager yes The URI path of the manager app (/deploy and /undeploy will be used)
|
||
Proxies no Use a proxy chain
|
||
RHOST localhost yes The target address
|
||
RPORT 80 yes The target port
|
||
USERNAME tomcat no The username to authenticate as
|
||
VHOST no HTTP server virtual host
|
||
```
|
||
|
||
### Nginx Reverse Proxy & AJP
|
||
|
||
When we come across an open AJP proxy port (8009 TCP), we can use Nginx with the `ajp_module` to access the "hidden" Tomcat Manager. This can be done by compiling the Nginx source code and adding the required module, as follows:
|
||
|
||
* Download the Nginx source code
|
||
* Download the required module
|
||
* Compile Nginx source code with the `ajp_module`.
|
||
* Create a configuration file pointing to the AJP Port
|
||
|
||
```bash
|
||
# Download Nginx code
|
||
wget https://nginx.org/download/nginx-1.21.3.tar.gz
|
||
tar -xzvf nginx-1.21.3.tar.gz
|
||
|
||
# Compile Nginx source code with the ajp module
|
||
git clone https://github.com/dvershinin/nginx_ajp_module.git
|
||
cd nginx-1.21.3
|
||
sudo apt install libpcre3-dev
|
||
./configure --add-module=`pwd`/../nginx_ajp_module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules
|
||
make
|
||
sudo make install
|
||
nginx -V
|
||
```
|
||
|
||
Comment out the entire `server` block and append the following lines inside the `http` block in `/etc/nginx/conf/nginx.conf`.
|
||
|
||
```shell-session
|
||
upstream tomcats {
|
||
server <TARGET_SERVER>:8009;
|
||
keepalive 10;
|
||
}
|
||
server {
|
||
listen 80;
|
||
location / {
|
||
ajp_keep_conn on;
|
||
ajp_pass tomcats;
|
||
}
|
||
}
|
||
```
|
||
|
||
Start Nginx and check if everything is working correctly by issuing a cURL request to your local host.
|
||
|
||
```html
|
||
sudo nginx
|
||
curl http://127.0.0.1:80
|
||
|
||
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8" />
|
||
<title>Apache Tomcat/X.X.XX</title>
|
||
<link href="favicon.ico" rel="icon" type="image/x-icon" />
|
||
<link href="favicon.ico" rel="shortcut icon" type="image/x-icon" />
|
||
<link href="tomcat.css" rel="stylesheet" type="text/css" />
|
||
</headas
|
||
<body>
|
||
<div id="wrapper">
|
||
<div id="navigation" class="curved container">
|
||
<span id="nav-home"><a href="https://tomcat.apache.org/">Home</a></span>
|
||
<span id="nav-hosts"><a href="/docs/">Documentation</a></span>
|
||
<span id="nav-config"><a href="/docs/config/">Configuration</a></span>
|
||
<span id="nav-examples"><a href="/examples/">Examples</a></span>
|
||
<span id="nav-wiki"><a href="https://wiki.apache.org/tomcat/FrontPage">Wiki</a></span>
|
||
<span id="nav-lists"><a href="https://tomcat.apache.org/lists.html">Mailing Lists</a></span>
|
||
<span id="nav-help"><a href="https://tomcat.apache.org/findhelp.html">Find Help</a></span>
|
||
<br class="separator" />
|
||
</div>
|
||
<div id="asf-box">
|
||
<h1>Apache Tomcat/X.X.XX</h1>
|
||
</div>
|
||
<div id="upper" class="curved container">
|
||
<div id="congrats" class="curved container">
|
||
<h2>If you're seeing this, you've successfully installed Tomcat. Congratulations!</h2>
|
||
<SNIP>
|
||
```
|
||
|
||
## References
|
||
|
||
* [https://academy.hackthebox.com/module/145/section/1295](https://academy.hackthebox.com/module/145/section/1295)
|
||
|
||
<figure><img src="../.gitbook/assets/image (7).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**Follow HackenProof**](https://bit.ly/3xrrDrL) **to learn more about web3 bugs**
|
||
|
||
🐞 Read web3 bug tutorials
|
||
|
||
🔔 Get notified about new bug bounties
|
||
|
||
💬 Participate in community discussions
|
||
|
||
<details>
|
||
|
||
<summary><strong>HackTricks in </strong><a href="https://twitter.com/carlospolopm"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch</strong></a> <strong>Wed - 18.30(UTC) 🎙️</strong> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||
|
||
</details>
|