• Aucun résultat trouvé

AJPy: AJP python library

N/A
N/A
Protected

Academic year: 2022

Partager "AJPy: AJP python library"

Copied!
8
0
0

Texte intégral

(1)

Presented the 02/06/2016

For SSTIC 2016

AJPy: AJP python library

(or how to finally attack the port 8009 during

pentests?)

(2)

Wait whaaaaat?

Classic Java web application architecture

(3)

What is AJP?

packet-oriented

binary format (~ compressed HTTP)

TCP connections reuse

Current version: 1.3 (1998)

About 42K open ports (tcp/8009) on the Internet (2012)

Works with most of the Java application containers:

Apache Tomcat

JBoss/Wildfly Jetty

(4)

Security

Many restrictions can be done on Apache web server

IP source filtering

Mutual SSL authentication

fail2ban

etc.

Almost no restrictions on AJP Connectors

(5)

Hello, I speak AJP

Apache web server

1

2

Send HTTP request

Translates HTTP request to AJP request and

forward it

1 8009

Send AJP request

(6)

I don't really speak AJP

AJPy is a small python library that can craft and serialize AJP packets

Contains a tool for Tomcat

Get version (from error page)

Authentication bruteforce on admin panel

BUT mitigated by LockOutRealm (>Tomcat 6)

WAR upload (almost) → webshell over AJP

(7)

Show time

(8)

Conclusion

TODO

Fix the WAR deploy issue for Tomcat

Add JBoss/Wildfly support

Resource fuzzing

Improve and stabilize AJPy core library

See you @BeeRump for more

(CFP is still open, submit your papers @Baboon)

Références

Documents relatifs

GEMS aims at pushing forward the limits of automation in simulation process devel- opment, with a particular focus on : i) the automatic programming of MDO processes; ii)

In this section, we show how LiteX can be used as an entry to create a SoC for a Lattice ECP5 FPGA board with a fully open-source toolchain. Three main projects are

The main advantage of graph kernels is that they allow a large family of machine learning algorithms, called kernel methods, to be applied directly to graphs.. 2020 Giannis

Link aggregate algorithm and iterative scan algorithm; LFM: Local optimization funtion model; LPA: Label propagation algorithm; MCL: Markov cLustering; NDlib: Network diffusion

Our contribution to the described challenge in scientometrics is a Python library - ”Take it personally” (TIP) - that aims to facilitate a more author- related view on

Mais il existe une autre classe de facteurs qui, du moins in vitro, stimulent la croissance de cellules qui sont des précurseurs de lignées érythrocytaires, cellules

Sounds which often occur in correspondence relations in genetically related languages can be clustered into classes (types). It is assumed

scikit-image (Van der Walt et al., 2014) is a general-purpose image processing library for the Python language, and a component of the ecosystem of Python scientific modules