Remote code execution in Apache Tomcat 7.0

kevindqc wrote: post #4

ryanlol wrote: post #3

It's 2017 and scanning /0 for PUT still reliably gets a bunch of shells...

Why does that return a shell?

Web shell via put, still quite common.

Just as common as dorking for common webshells with no or default passwords.

If you need a VPS fast googling for c99 is faster than spinning up something on AWS ;)

Re: Remote code execution in Apache Tomcat 7.0

#6

Post by bastijn » Thu, Sep 21, 2017, 9:17 PM UTC

> "National Vulnerability Database The NVD is currently offline for scheduled maintenance.

> Please check back again shortly. We apologize for the inconvenience.

> Please direct any questions to nvd@nist.gov. Thank you."

Perfect timing for hn Frontpage. Alt link: https://tomcat.apache.org/security-7.html

Re: Remote code execution in Apache Tomcat 7.0

#7

Post by nwrk » Thu, Sep 21, 2017, 9:39 PM UTC

CC: Equifax

Re: Remote code execution in Apache Tomcat 7.0

#8

Post by thephyber » Thu, Sep 21, 2017, 10:45 PM UTC

bastijn wrote: post #6

> "National Vulnerability Database The NVD is currently offline for scheduled maintenance. > Please check back again shortly. We apologize for the inconvenience. > Please direct any questions to nvd@nist.gov. Thank you." Perfect timing for hn Frontpage. Alt link: https://tomcat.apache.org/security-7.html

Interestingly, I think NVD.nist.gov just changed their HTML-generating template since this HN URL was posted.

Re: Remote code execution in Apache Tomcat 7.0

#9

Post by bluetwo » Thu, Sep 21, 2017, 10:51 PM UTC

mdewinter wrote: post #2

Windows only, maybe the title can be changed.

I stopped reading when I got to 'Windows' as well.

Re: Remote code execution in Apache Tomcat 7.0

#10

Post by exikyut » Thu, Sep 21, 2017, 11:38 PM UTC

dogma1138 wrote: post #5

kevindqc wrote: post #4

Earlier quoted context omitted.

Why does that return a shell?

Web shell via put, still quite common. Just as common as dorking for common webshells with no or default passwords. If you need a VPS fast googling for c99 is faster than spinning up something on AWS ;)

Would like to learn more about this.

Hmm... looks like this dropped from 20k to 700 while I wasn't looking, which I guess is a very good thing (these are DVRs!). But FWIW, for "JAWS/1.0 -2017 -2016" on shodan, then "/shell?whoami" returns "root". :)