mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-18 15:08:29 +00:00
253 lines
12 KiB
Markdown
253 lines
12 KiB
Markdown
# 8009 - Kupima Usalama wa Itifaki ya Apache JServ (AJP)
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikionekana kwenye HackTricks** au **kupakua HackTricks kwa muundo wa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|
|
|
|
<figure><img src="../../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Jiunge na [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) ili kuwasiliana na wadukuzi wenye uzoefu na wawindaji wa tuzo za kugundua kasoro!
|
|
|
|
**Machapisho Kuhusu Kudukua**\
|
|
Shiriki na yaliyomo yanayochunguza msisimko na changamoto za kudukua
|
|
|
|
**Habari za Kudukua za Wakati Halisi**\
|
|
Endelea kuwa na habari za ulimwengu wa kudukua kwa kasi kupitia habari na ufahamu wa wakati halisi
|
|
|
|
**Matangazo ya Hivi Karibuni**\
|
|
Baki na habari kuhusu tuzo mpya za kugundua kasoro zinazozinduliwa na sasisho muhimu za jukwaa
|
|
|
|
**Jiunge nasi kwenye** [**Discord**](https://discord.com/invite/N3FrSbmwdy) na anza kushirikiana na wadukuzi bora leo!
|
|
|
|
## Taarifa Msingi
|
|
|
|
Kutoka: [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
|
|
|
|
> AJP ni itifaki ya waya. Ni toleo lililoboreshwa la itifaki ya HTTP kuruhusu seva ya wavuti ya kujitegemea kama [Apache](http://httpd.apache.org/) kuwasiliana na Tomcat. Kihistoria, Apache imekuwa haraka zaidi kuliko Tomcat katika kuhudumia yaliyomo ya tuli. Wazo ni kuruhusu Apache kuhudumia yaliyomo ya tuli iwezekanavyo, lakini kupeleka ombi kwa Tomcat kwa yaliyomo yanayohusiana na Tomcat.
|
|
|
|
Pia ni ya kuvutia:
|
|
|
|
> Itifaki ya ajp13 ni ya pakiti. Muundo wa binary ulichaguliwa dhidi ya maandishi wazi yanayoweza kusomwa kwa sababu za utendaji. Seva ya wavuti inawasiliana na chombo cha servlet kupitia uhusiano wa TCP. Ili kupunguza mchakato ghali wa kuunda soketi, seva ya wavuti itajaribu kudumisha uhusiano wa TCP endelevu kwa chombo cha servlet, na kutumia tena uhusiano kwa mizunguko ya ombi/jibu mingi
|
|
|
|
**Bandari ya chaguo-msingi:** 8009
|
|
```
|
|
PORT STATE SERVICE
|
|
8009/tcp open ajp13
|
|
```
|
|
## CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat)
|
|
|
|
Ikiwa bandari ya AJP imefunuliwa, Tomcat inaweza kuwa na hatari ya kushambuliwa na Ghostcat. Hapa kuna [exploit](https://www.exploit-db.com/exploits/48143) ambayo inafanya kazi na shida hii.
|
|
|
|
Ghostcat ni udhaifu wa LFI, lakini una vikwazo fulani: faili tu kutoka njia fulani zinaweza kuvutwa. Walakini, hii inaweza kujumuisha faili kama `WEB-INF/web.xml` ambayo inaweza kuvuja habari muhimu kama vibali vya kuingia kwenye kiolesura cha Tomcat, kulingana na usanidi wa seva.
|
|
|
|
Toleo lililopachikwa kwenye 9.0.31 au zaidi, 8.5.51, na 7.0.100 limefanya marekebisho ya shida hii.
|
|
|
|
## Uchunguzi
|
|
|
|
### Kiotomatiki
|
|
```bash
|
|
nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 <IP>
|
|
```
|
|
### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#ajp)
|
|
|
|
## AJP Proxy
|
|
|
|
### Nginx Reverse Proxy & AJP
|
|
|
|
[Angalia toleo la Dockerized](#Dockerized-version)
|
|
|
|
Tunapokutana na bandari ya wazi ya AJP proxy (8009 TCP), tunaweza kutumia Nginx na `ajp_module` kufikia "siri" ya Tomcat Manager. Hii inaweza kufanywa kwa kuchanganya kificho cha chanzo cha Nginx na kuongeza moduli inayohitajika, kama ifuatavyo:
|
|
|
|
* Pakua kificho cha chanzo cha Nginx
|
|
* Pakua moduli inayohitajika
|
|
* Changanya kificho cha chanzo cha Nginx na `ajp_module`.
|
|
* Unda faili ya usanidi inayoelekeza kwenye Bandari ya AJP
|
|
```bash
|
|
# Download Nginx code
|
|
wget https://nginx.org/download/nginx-1.21.3.tar.gz
|
|
tar -xzvf nginx-1.21.3.tar.gz
|
|
|
|
# Compile Nginx source code with the ajp module
|
|
git clone https://github.com/dvershinin/nginx_ajp_module.git
|
|
cd nginx-1.21.3
|
|
sudo apt install libpcre3-dev
|
|
./configure --add-module=`pwd`/../nginx_ajp_module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules
|
|
make
|
|
sudo make install
|
|
nginx -V
|
|
```
|
|
Changanisha kabisa kipande cha `server` na ongeza mistari ifuatayo ndani ya kipande cha `http` katika `/etc/nginx/conf/nginx.conf`.
|
|
```shell-session
|
|
upstream tomcats {
|
|
server <TARGET_SERVER>:8009;
|
|
keepalive 10;
|
|
}
|
|
server {
|
|
listen 80;
|
|
location / {
|
|
ajp_keep_conn on;
|
|
ajp_pass tomcats;
|
|
}
|
|
}
|
|
```
|
|
Anza Nginx na angalia kama kila kitu kinafanya kazi kwa usahihi kwa kutuma ombi la cURL kwa mwenyeji wako wa ndani.
|
|
```html
|
|
sudo nginx
|
|
curl http://127.0.0.1:80
|
|
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<title>Apache Tomcat/X.X.XX</title>
|
|
<link href="favicon.ico" rel="icon" type="image/x-icon" />
|
|
<link href="favicon.ico" rel="shortcut icon" type="image/x-icon" />
|
|
<link href="tomcat.css" rel="stylesheet" type="text/css" />
|
|
</headas
|
|
<body>
|
|
<div id="wrapper">
|
|
<div id="navigation" class="curved container">
|
|
<span id="nav-home"><a href="https://tomcat.apache.org/">Home</a></span>
|
|
<span id="nav-hosts"><a href="/docs/">Documentation</a></span>
|
|
<span id="nav-config"><a href="/docs/config/">Configuration</a></span>
|
|
<span id="nav-examples"><a href="/examples/">Examples</a></span>
|
|
<span id="nav-wiki"><a href="https://wiki.apache.org/tomcat/FrontPage">Wiki</a></span>
|
|
<span id="nav-lists"><a href="https://tomcat.apache.org/lists.html">Mailing Lists</a></span>
|
|
<span id="nav-help"><a href="https://tomcat.apache.org/findhelp.html">Find Help</a></span>
|
|
<br class="separator" />
|
|
</div>
|
|
<div id="asf-box">
|
|
<h1>Apache Tomcat/X.X.XX</h1>
|
|
</div>
|
|
<div id="upper" class="curved container">
|
|
<div id="congrats" class="curved container">
|
|
<h2>If you're seeing this, you've successfully installed Tomcat. Congratulations!</h2>
|
|
<SNIP>
|
|
```
|
|
### Nginx toleo la Dockerized
|
|
|
|
Nginx ni seva ya wavuti ya wazi na maarufu ambayo inaweza kutumika kama seva ya wavuti ya msingi au kama seva ya kupeleka maombi ya wavuti. Kwa kutumia Docker, unaweza kuzindua Nginx kwa urahisi na kwa njia inayoweza kubadilika.
|
|
|
|
Kuanza, hakikisha kuwa Docker imefungwa kwenye mfumo wako. Kisha, unaweza kufuata hatua hizi:
|
|
|
|
1. Unda faili ya Dockerfile na uandike maagizo ya kujenga picha ya Docker ya Nginx. Unaweza kuanza na msingi wa picha ya Nginx rasmi kutoka Docker Hub.
|
|
|
|
```dockerfile
|
|
FROM nginx:latest
|
|
```
|
|
|
|
2. Ongeza faili yako ya usanidi wa Nginx kwenye picha ya Docker. Unaweza kuunda faili ya usanidi na kuiita `nginx.conf`.
|
|
|
|
```dockerfile
|
|
COPY nginx.conf /etc/nginx/nginx.conf
|
|
```
|
|
|
|
3. Unda faili ya usanidi wa Nginx (`nginx.conf`) na uweke mipangilio yako ya seva ya wavuti. Hapa kuna mfano wa faili ya usanidi:
|
|
|
|
```nginx
|
|
worker_processes auto;
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
http {
|
|
server {
|
|
listen 80;
|
|
server_name example.com;
|
|
location / {
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
4. Jenga picha ya Docker kutumia amri ifuatayo:
|
|
|
|
```bash
|
|
docker build -t nginx-dockerized .
|
|
```
|
|
|
|
5. Mara baada ya kujenga picha, unaweza kuizindua kama kontena ya Docker kwa kutumia amri ifuatayo:
|
|
|
|
```bash
|
|
docker run -d -p 80:80 nginx-dockerized
|
|
```
|
|
|
|
Sasa, Nginx yako iliyodockerizwa inapaswa kuwa ikifanya kazi na inapatikana kwenye bandari 80 ya mfumo wako. Unaweza kufikia seva ya wavuti kwa kutembelea anwani ya IP ya mfumo wako au jina la kikoa lililowekwa katika faili ya usanidi (`nginx.conf`).
|
|
|
|
Kwa kufuata hatua hizi, unaweza kuzindua Nginx kwa urahisi na kwa njia inayoweza kubadilika kwa kutumia Docker. Hii inaruhusu kupeleka na kusimamia seva yako ya wavuti kwa urahisi zaidi.
|
|
```bash
|
|
git clone https://github.com/ScribblerCoder/nginx-ajp-docker
|
|
cd nginx-ajp-docker
|
|
```
|
|
Badilisha `TARGET-IP` katika `nginx.conf` na AJP IP kisha jenga na endesha
|
|
``` bash
|
|
docker build . -t nginx-ajp-proxy
|
|
docker run -it --rm -p 80:80 nginx-ajp-proxy
|
|
```
|
|
### Apache AJP Proxy
|
|
|
|
Kukutana na bandari wazi ya 8009 bila bandari nyingine za wavuti zinazopatikana ni nadra. Walakini, bado inawezekana kuitumia kwa kutumia **Metasploit**. Kwa kutumia **Apache** kama proksi, maombi yanaweza kuelekezwa kwa **Tomcat** kwenye bandari ya 8009.
|
|
```bash
|
|
sudo apt-get install libapache2-mod-jk
|
|
sudo vim /etc/apache2/apache2.conf # append the following line to the config
|
|
Include ajp.conf
|
|
sudo vim /etc/apache2/ajp.conf # create the following file, change HOST to the target address
|
|
ProxyRequests Off
|
|
<Proxy *>
|
|
Order deny,allow
|
|
Deny from all
|
|
Allow from localhost
|
|
</Proxy>
|
|
ProxyPass / ajp://HOST:8009/
|
|
ProxyPassReverse / ajp://HOST:8009/
|
|
sudo a2enmod proxy_http
|
|
sudo a2enmod proxy_ajp
|
|
sudo systemctl restart apache2
|
|
```
|
|
Hii mipangilio inatoa uwezekano wa kuepuka mifumo ya kugundua na kuzuia uingiliaji (IDS/IPS) kutokana na **asili ya binary ya itifaki ya AJP**, ingawa uwezo huu haujathibitishwa. Kwa kuelekeza shambulio la kawaida la Metasploit Tomcat kwa `127.0.0.1:80`, unaweza kuchukua udhibiti wa mfumo uliolengwa.
|
|
```bash
|
|
msf exploit(tomcat_mgr_deploy) > show options
|
|
```
|
|
## Marejeo
|
|
* [https://github.com/yaoweibin/nginx_ajp_module](https://github.com/yaoweibin/nginx_ajp_module)
|
|
* [https://academy.hackthebox.com/module/145/section/1295](https://academy.hackthebox.com/module/145/section/1295)
|
|
|
|
<figure><img src="../../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Jiunge na server ya [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) ili kuwasiliana na wadukuzi wenye uzoefu na wawindaji wa bug bounty!
|
|
|
|
**Machapisho ya Udukuzi**\
|
|
Shiriki na yaliyomo yanayochunguza msisimko na changamoto za udukuzi
|
|
|
|
**Habari za Udukuzi za Wakati Halisi**\
|
|
Endelea kuwa na habari za ulimwengu wa udukuzi kwa kasi kupitia habari na ufahamu wa wakati halisi
|
|
|
|
**Matangazo ya Hivi Karibuni**\
|
|
Baki na habari za hivi karibuni kuhusu bug bounties mpya zinazozinduliwa na sasisho muhimu za jukwaa
|
|
|
|
**Jiunge nasi kwenye** [**Discord**](https://discord.com/invite/N3FrSbmwdy) na anza kushirikiana na wadukuzi bora leo!
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ina tangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|