mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
88 lines
3.4 KiB
Markdown
88 lines
3.4 KiB
Markdown
# 8009 - Pentesting Apache JServ Protocol (AJP)
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
## Basic Information
|
|
|
|
From [https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
|
|
|
|
> AJP ni itifaki ya waya. Ni toleo lililoboreshwa la itifaki ya HTTP ili kuruhusu seva ya wavuti huru kama [Apache](http://httpd.apache.org/) kuzungumza na Tomcat. Kihistoria, Apache imekuwa haraka zaidi kuliko Tomcat katika kuhudumia maudhui ya statiki. Wazo ni kumruhusu Apache kuhudumia maudhui ya statiki inapowezekana, lakini kupeleka ombi kwa Tomcat kwa maudhui yanayohusiana na Tomcat.
|
|
|
|
Pia ni ya kuvutia:
|
|
|
|
> Itifaki ya ajp13 inaelekezwa kwenye pakiti. Muundo wa binary ulionekana kuchaguliwa badala ya maandiko rahisi yanayosomwa kwa sababu za utendaji. Seva ya wavuti inawasiliana na kontena la servlet kupitia muunganisho wa TCP. Ili kupunguza mchakato ghali wa uundaji wa socket, seva ya wavuti itajaribu kudumisha muunganisho wa TCP wa kudumu kwa kontena la servlet, na kutumia muunganisho mmoja kwa mizunguko kadhaa ya ombi/jibu.
|
|
|
|
**Default port:** 8009
|
|
```
|
|
PORT STATE SERVICE
|
|
8009/tcp open ajp13
|
|
```
|
|
## CVE-2020-1938 ['Ghostcat'](https://www.chaitin.cn/en/ghostcat)
|
|
|
|
Hii ni LFI vuln ambayo inaruhusu kupata baadhi ya faili kama `WEB-INF/web.xml` ambayo ina taarifa za kuingia. Hii ni [exploit](https://www.exploit-db.com/exploits/48143) ya kutumia udhaifu huo na bandari za AJP zilizofichuliwa zinaweza kuwa hatarini.
|
|
|
|
Toleo zilizorekebishwa ziko kwenye au juu ya 9.0.31, 8.5.51, na 7.0.100.
|
|
|
|
## Enumeration
|
|
|
|
### Automatic
|
|
```bash
|
|
nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 <IP>
|
|
```
|
|
### [**Brute force**](../generic-hacking/brute-force.md#ajp)
|
|
|
|
## AJP Proxy
|
|
|
|
### Nginx Reverse Proxy + AJP
|
|
|
|
([Checkout the Dockerized version](8009-pentesting-apache-jserv-protocol-ajp.md#Dockerized-version))
|
|
|
|
Inawezekana kuwasiliana na bandari ya AJP proxy iliyo wazi (8009 TCP) kwa kutumia moduli ya Nginx `ajp_module` na kufikia Tomat Manager kutoka bandari hii ambayo inaweza hatimaye kusababisha RCE kwenye seva iliyo hatarini.
|
|
|
|
- Anza kupakua Nginx kutoka [https://nginx.org/en/download.html](https://nginx.org/en/download.html) na kisha uunde na moduli ya ajp:
|
|
```bash
|
|
# Compile Nginx with the ajp module
|
|
git clone https://github.com/dvershinin/nginx_ajp_module.git
|
|
cd nginx-version
|
|
sudo apt install libpcre3-dev
|
|
./configure --add-module=`pwd`/../nginx_ajp_module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules
|
|
make
|
|
sudo make install
|
|
nginx -V
|
|
```
|
|
- Kisha, toa maoni kuhusu `server` block na ongeza yafuatayo katika `http` block katika `/etc/nginx/conf/nginx.conf`.
|
|
```json
|
|
upstream tomcats {
|
|
server <TARGET_SERVER>:8009;
|
|
keepalive 10;
|
|
}
|
|
server {
|
|
listen 80;
|
|
location / {
|
|
ajp_keep_conn on;
|
|
ajp_pass tomcats;
|
|
}
|
|
}
|
|
```
|
|
- Hatimaye, anzisha nginx (`sudo nginx`) na hakikisha inafanya kazi kwa kufikia `http://127.0.0.1`
|
|
|
|
### Nginx Dockerized-version
|
|
```bash
|
|
git clone https://github.com/ScribblerCoder/nginx-ajp-docker
|
|
cd nginx-ajp-docker
|
|
```
|
|
Badilisha `TARGET-IP` katika `nginx.conf` na AJP IP kisha jenga na uendeshe.
|
|
```bash
|
|
docker build . -t nginx-ajp-proxy
|
|
docker run -it --rm -p 80:80 nginx-ajp-proxy
|
|
```
|
|
### Apache AJP Proxy
|
|
|
|
Pia inawezekana kutumia **Apache AJP proxy** kufikia bandari hiyo badala ya **Nginx**.
|
|
|
|
## References
|
|
|
|
- [https://github.com/yaoweibin/nginx_ajp_module](https://github.com/yaoweibin/nginx_ajp_module)
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|