For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made some changes to the java file of the web application such that it tries to create a new directory in home directory of the user.
I run this with version 6 and 7 of tomcat and it worked. It actually created the directory in home directory. But I came to know from an expert that this is kind of a normal behaviour of tomcat and this has nothing to do with exploiting the said vulnerability. This can be considered exploited only if the tomcat was run under security manager.
Hence I tried to do the same on tomcat 6.0.16 and tomcat 6.0.20 both. I tried to run tomcat under security manager but it did not create a directory in home directory. 1 ) Could someone pl tell why ?
2) as per org.apache website the versions affected by this vulnerability are 6.0.0-6.0.20. I could not get any of this version on apache website to download so I downloaded them from here. http://olex.openlogic.com/packages/tomcat/6.0.16#package_detail_tabs
3) Is there any way I can download tomcat version 6.0.0 to 6.0.20 from Apache tomcat official site ? just to make sure that I use the vulnerable version of tomcat. I searched but could not find.
Ultimately I want to succeed in exploiting this particular vulnerability. At the same time I want to make sure that the exploit which I do is really an exploit and not a normal behaviour of Apache tomcat.
Pl excuse me and correct me if I have failed to understand this particular vulnerability.