Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here

I am trying this with insecure web application of OWASP. I made some changes to the java file of the web application such that it tries to create a new directory in home directory of the user.

I run this with version 6 and 7 of tomcat and it worked. It actually created the directory in home directory. But I came to know from an expert that this is kind of a normal behaviour of tomcat and this has nothing to do with exploiting the said vulnerability. This can be considered exploited only if the tomcat was run under security manager.

Hence I tried to do the same on tomcat 6.0.16 and tomcat 6.0.20 both. I tried to run tomcat under security manager but it did not create a directory in home directory. 1 ) Could someone pl tell why ?

2) as per org.apache website the versions affected by this vulnerability are 6.0.0-6.0.20. I could not get any of this version on apache website to download so I downloaded them from here.

3) Is there any way I can download tomcat version 6.0.0 to 6.0.20 from Apache tomcat official site ? just to make sure that I use the vulnerable version of tomcat. I searched but could not find.

Ultimately I want to succeed in exploiting this particular vulnerability. At the same time I want to make sure that the exploit which I do is really an exploit and not a normal behaviour of Apache tomcat.

Pl excuse me and correct me if I have failed to understand this particular vulnerability.


share|improve this question

closed as not a real question by Polynomial, Lucas Kauffman, Gilles, rook, Jeff Ferland Sep 19 '12 at 16:55

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

We aren't here to do your research/homework are we now :)? – Lucas Kauffman Sep 19 '12 at 15:48
-1 there is public exploit code attached to the original bug report you didn't even try! – rook Sep 19 '12 at 16:13

If there are exploits, you can probably find them in Metasploit or on exploit-db. Just look at the source code of the Metasploit modules or scripts posted on those sites.

I'm willing to point you in the right direction, but that's all. You will have to explore the rest yourself if you want to actually learn something :)

share|improve this answer
Thanks Lucas..Metasploit souds really good...Actually I was expecting this kind of right direction only..But it seems that the asked question was improper for this..Anyways will take care next time for sure..Thanks for ur suggestion.. – Ragini Sep 20 '12 at 8:12
@Ragini if question was improved it will be great for beginners,refine your question and there may be possibility for reopening – BlueBerry - Vignesh4303 Sep 21 '12 at 11:26
@vignesh I have made the question more precise..Let's see if I get some responses :-) – Ragini Sep 21 '12 at 16:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.