Rapid7 Vulnerability & Exploit Database

Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation

Back to Search

Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation

Disclosed
10/10/2016
Created
03/14/2023

Description

This module exploits a vulnerability in RedHat based systems where improper file permissions are applied to /usr/lib/tmpfiles.d/tomcat.conf for Apache Tomcat versions before 7.0.54-8. This may also work against The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage temporary files including their creation. With this weak permission, we're able to inject commands into systemd-tmpfiles service to write a cron job to execute our payload. systemd-tmpfiles is executed by default on boot on RedHat-based systems through systemd-tmpfiles-setup.service. Depending on the system in use, the execution of systemd-tmpfiles could also be triggered by other services, cronjobs, startup scripts etc. This module was tested against Tomcat 7.0.54-3 on Fedora 21.

Author(s)

  • h00die
  • Dawid Golunski <dawid@legalhackers.com>

Platform

Linux

Architectures

x86, x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/local/tomcat_rhel_based_temp_priv_esc
msf exploit(tomcat_rhel_based_temp_priv_esc) > show targets
    ...targets...
msf exploit(tomcat_rhel_based_temp_priv_esc) > set TARGET < target-id >
msf exploit(tomcat_rhel_based_temp_priv_esc) > show options
    ...show and set options...
msf exploit(tomcat_rhel_based_temp_priv_esc) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;