Authentication Bypass in MailboxImportServlet vulnerability (reminder)
https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/

How to run z-push on zimbra jetty: Proof of Concept

Take your Zimbra with you!
Post Reply
speedy3k
Posts: 19
Joined: Sat Sep 13, 2014 12:41 am

How to run z-push on zimbra jetty: Proof of Concept

Postby speedy3k » Mon Sep 02, 2013 9:49 am

This is a proof of concept for getting z-push to run on the same server as zimbra without doing too much. It was late when I did this, so I may have missed a step or two. There probably is even a better way to do this! Also, this is only a proof of concept. Future updates will probably break it. As always, use at your own risk! :)
This was tested using z-push 2.0.8-1731, zimbrabackend 56.1, Zimbra 8.0.4 OSE on Centos6
install php-cgi php-process
:create folder

opt/z-push and copy z-push files to it

Configure z-push per install instructions. zimbra url for backend can be localhost or 127.0.0.1
:create link in opt/zimbra/jetty/webapps to /opt/z-push

ln -s /opt/zimbra/jetty/webapps/z-push /opt/z-push
:create shell file called php-cgi-fix.sh in /usr/bin

#/usr/bin/sh

export SCRIPT_FILENAME=$1

/usr/bin/php-cgi
:create a WEB-INF folder in /opt/z-push
:create web.xml file with the following info and place in /opt/z-push/WEB-INF





    
      xmlns=http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee"

      xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance"

      xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"

      version="2.4"

    >
     php
     

       PHP

       org.eclipse.jetty.servlets.CGI

       1
       

            commandPrefix

            /usr/bin/php-cgi-fix.sh

       
          

              Path

              /bin:/usr/bin:/usr/local/bin

          

        

     
     

       PHP

       *.php

     
     


    

      

    

  


        

            deny

            /backend/*

	    /include/*

            /lib/*

	    /WEB-INF/*

            /config.php

            /z-push-top.php

            /z-push-admin.php

            /INSTALL

            /LICENSE

        

	

       deny




:edit /opt/zimbra/jetty/etc/jetty.xml.in

Find



            /service/extension/zimbrasync



Change



             /z-push/index.php


Add

I added this below a similar entry for "zimlet"





	            

		

		    /z-push/*

		    /z-push

		    true



Add

Again, I added this near similar code for "zimlet"





      

      /webapps/z-push

      /z-push

      

      /etc/webdefault.xml

      /work/z-push

      true

      

        

          false

        

      

      

        org.eclipse.jetty.server.webapp.ContainerIncludeJarPattern

		.*/.*jsp-api-[^/]*.jar$|.*/.*jsp-[^/]*.jar$|.*/.*taglibs[^/]*.jar$


:Edit php.ini

edit etc/php.ini

magic_quotes_gpc off

register_globals off

magic_quotes_runtime off

short_open_tag on

cgi.force_redirect = 0

max_execution_time = 120

memory_limit = 128M
:restart jetty

su zimbra

zmmailboxdctl restart
That should do it.

I welcome any feedback/suggestions. Please let me know if you have any questions, and I'll do my best to answer them.


Top
davidsalgadolinux
Posts: 1
Joined: Sat Sep 13, 2014 3:21 am

How to run z-push on zimbra jetty: Proof of Concept

Postby davidsalgadolinux » Tue Oct 08, 2013 4:09 pm

Hi !

It works !

Just check the shell script
:create shell file called php-cgi-fix.sh in /usr/bin

#/usr/bin/sh

export SCRIPT_FILENAME=$1

/usr/bin/php-cgi
Would' t the first line be:
#!/bin/sh
??
Thanks your work allowed me to use Outlook 2013 like this:
How to connect Exchange ActiveSync (Z-Push or other EAS Server) with Outlook 2013 - iFix4You Repair and Services
Since we just had http on port :80
Bye !
Top
speedy3k
Posts: 19
Joined: Sat Sep 13, 2014 12:41 am

How to run z-push on zimbra jetty: Proof of Concept

Postby speedy3k » Fri Jan 31, 2014 11:20 am

update:

I'm now running this using fastcgi If anyone is interested, in trying this out..just do the following. (this is assuming you already have following the steps in my first post)

download jfastcgi

jFastCGI | Free software downloads at SourceForge.net
place jfastcgi.jar in /opt/z-push/WEB-INF/lib

rename your web.xml to web.xml.bak (or whatever)

create a new new web.xml using the following





    
      xmlns=http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee"

      xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance"

      xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee">http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"

      version="2.4"

    >
     php
        

        FastCGI

        net.jr.fastcgi.FastCGIServlet

        

          server-address

          127.0.0.1:6666

        

        5

    

    

        FastCGI

        *.php

    

     



     


        

            deny

            /backend/*

	     /include/*

            /lib/*

	     /WEB-INF/*

            /config.php

            /z-push-top.php

            /z-push-admin.php

            /INSTALL

            /LICENSE

        

	

       deny




**note...I'm not sure if the security-constraint is needed or not, but I figured better safe than sorry.
Thats it. restart your services
Let me know if you have any questions and I'll do my best to help.
Top
svalavuo
Posts: 11
Joined: Sat Sep 13, 2014 12:35 am
Location: Rauma, Finland
ZCS/ZD Version: ZCS 8.8.9
Contact:
Contact svalavuo

How to run z-push on zimbra jetty: Proof of Concept

Postby svalavuo » Tue Mar 25, 2014 3:12 pm

Is it possible to get this working with ubuntu?

There is no php-process -package.

I got ActiveSync working with apache, but can't get it to work with jetty so I must access it through different hostname.

It would be great to use my zimbra host (and jetty) with my mobile too.

When I access my host with url Microsoft-Server-ActiveSync, it asks credentials and then it displays:

Problem accessing /z-push/index.php. Reason:

    Failed to exec CGI


With FastCGI I get following:



Caused by:
java.lang.RuntimeException: java.net.ConnectException: Connection refused

	at net.jr.fastcgi.impl.SingleConnectionFactory.getConnection(SingleConnectionFactory.java:55)

	at net.jr.fastcgi.impl.FastCGIHandler.service(FastCGIHandler.java:152)

	at net.jr.fastcgi.FastCGIServlet.service(FastCGIServlet.java:50)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820">HttpServlet.service(HttpServlet.java:820)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:654)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:445)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:556)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:227)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1044)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:372)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:189)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:978)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255)

	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:154)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:317)

	at org.eclipse.jetty.server.handler.DebugHandler.handle(DebugHandler.java:81)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.server.Server.handle(Server.java:369)

	at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:486)

	at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:933)

	at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:995)

	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

	at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

	at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

	at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:196)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)

	at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)

	at java.lang.Thread.run(Thread.java:744)

Caused by: java.net.ConnectException: Connection refused

	at java.net.PlainSocketImpl.socketConnect(Native Method)

	at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:339)

	at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:200)

	at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:182)

	at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

	at java.net.Socket.connect(Socket.java:579)

	at java.net.Socket.connect(Socket.java:528)

	at java.net.Socket.(Socket.java:425)

	at java.net.Socket.(Socket.java:241)

	at net.jr.fastcgi.impl.SingleConnectionFactory.getConnection(SingleConnectionFactory.java:53)

	... 32 more
Caused by:
java.net.ConnectException: Connection refused

	at java.net.PlainSocketImpl.socketConnect(Native Method)

	at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:339)

	at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:200)

	at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:182)

	at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

	at java.net.Socket.connect(Socket.java:579)

	at java.net.Socket.connect(Socket.java:528)

	at java.net.Socket.(Socket.java:425)

	at java.net.Socket.(Socket.java:241)

	at net.jr.fastcgi.impl.SingleConnectionFactory.getConnection(SingleConnectionFactory.java:53)

	at net.jr.fastcgi.impl.FastCGIHandler.service(FastCGIHandler.java:152)

	at net.jr.fastcgi.FastCGIServlet.service(FastCGIServlet.java:50)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820">HttpServlet.service(HttpServlet.java:820)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:654)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:445)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:556)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:227)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1044)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:372)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:189)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:978)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:255)

	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:154)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:317)

	at org.eclipse.jetty.server.handler.DebugHandler.handle(DebugHandler.java:81)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.server.Server.handle(Server.java:369)

	at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:486)

	at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:933)

	at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:995)

	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

	at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

	at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

	at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:196)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)

	at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)

	at java.lang.Thread.run(Thread.java:744)


So I guess fascgi.jar doesn't start with zimbra?
My system is Ubuntu 12.04.4 LTS

z-push is version SVN AS14 checkout
The reason I'm using older version of z-push is that with newer version I get all the folders to my mobiles, but none of the emails/content.


I got it working!

My error was, that php-cgi has its own php.ini in ubuntu. After I changed that, it started to work.
Top
pfcnetwork
Posts: 1
Joined: Thu Jun 25, 2015 1:10 pm

How to run z-push on zimbra jetty: Proof of Concept

Postby pfcnetwork » Thu Jun 25, 2015 1:11 pm

Hello,



Can be more clear, I am not able to work on my server.
Top
cjm51213
Posts: 44
Joined: Sat Sep 13, 2014 2:43 am

Re: How to run z-push on zimbra jetty: Proof of Concept

Postby cjm51213 » Thu Dec 29, 2022 6:59 pm

I'm a little late to the party, but this looked like a good idea, so I'm working on it.

This is what I think I've been instructed to do:
  • install
    • php-cgi
    • php-process
  • Edit /opt/zimbra/conf/php.ini
    • magic_quotes_gpc off
    • register_globals off
    • magic_quotes_runtime off
    • short_open_tag on
    • cgi.force_redirect = 0 Not yet. I don't fully understand the implications, so I will revisit this later. Comments warn that this is probably a bad idea.
    • memory_limit = 128M Not yet. I don't yet know the performance consequence of doing this.
  • Create shell file called php-cgi-fix.sh in /usr/bin. Copy the three lines below:

    Code: Select all

       #!/usr/bin/sh
       export SCRIPT_FILENAME=$1
       /usr/bin/php-cgi

  • Edit /opt/zimbra/jetty/etc/jetty.xml.in

    Code: Select all

    =================================================================================================================
    replaced:
       /service/extension/zimbrasync
    with
       /z-push/index.php

    add: (copy similar entry for "zimlets", then s/zimlet/z-push/)
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       <Call name="addRule">
           <Arg>
               <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
                   <Set name="pattern">/z-push/*</Set>
                   <Set name="replacement">/z-push</Set>
                   <Set name="terminating">true</Set>
               </New>
           </Arg>
       </Call>
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    NB: Change:
           <Set name="throwUnavailableOnStartupException">true</Set>
        To:
           <Set name="throwUnavailableOnStartupException">false</Set>

       <New id="z-push" class="org.eclipse.jetty.webapp.WebAppContext">
           <Arg><Ref id="Contexts"/></Arg>
           <Arg><SystemProperty name="jetty.base" default="."/>/webapps/z-push</Arg>
           <Arg>/z-push</Arg>
           <Set name="configurationClasses"><Ref id="plusConfig"/></Set>
           <Set name="defaultsDescriptor"><SystemProperty name="jetty.base" default="."/>/etc/webdefault.xml</Set>
           <Set name="tempDirectory"><SystemProperty name="jetty.base" default="."/>/work/z-push</Set>
           <Set name="compactPath">true</Set>
           <Set name="throwUnavailableOnStartupException">false</Set>
           <Set name="baseResource">
               <New class="org.eclipse.jetty.util.resource.ResourceCollection">
                   <Arg>
                       <Array type="String">
                           <Item><SystemProperty name="jetty.base" default="."/>/webapps/z-push</Item>
                           <Item>./../zimlets-deployed</Item>
                       </Array>
                   </Arg>
               </New>
           </Set>
           <Call name="setAttribute">
               <Arg>org.eclipse.jetty.server.webapp.ContainerIncludeJarPattern</Arg>
               <Arg>.*/.*jsp-api-[^/]*\.jar$|.*/.*jsp-[^/]*\.jar$|.*/.*taglibs[^/]*\.jar$</Arg>
           </Call>
       </New>
    =================================================================================================================

  • install and configure z-push in the expected location (/usr/share/z-push/)
    • mkdir /opt/z-push
    • chown zimbra:zimbra /opt/z-push
    • chmod 755 /opt/z-push
    • rsync -uva /usr/share/z-push opt/
  • Create link in opt/zimbra/jetty/webapps to /opt/z-push
    • cd /opt/zimbra/jetty/webapps
    • ln -s /opt/z-push .
  • mkdir /opt/z-push/WEB-INF
  • Create the following snippet of /opt/z-push/WEB-INF/web.xml from a copy of /opt/zimbra/jetty/webapps/zimlet/WEB-INF/web.xml

    Code: Select all

       <?xml version="1.0" encoding="UTF-8"?>
       <web-app xmlns="http://java.sun.com/xml/ns/j2ee"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
          version="2.4">

... and this is where I get lost.

Is there is anybody that can

  1. Confirm that I have not gone off the rails above
  2. Post a copy of the relevant web.xml file and help me complete the instructions.
Thanks for the help

Chris.
Top
User avatar
gabrieles
Outstanding Member
Outstanding Member
Posts: 204
Joined: Tue Feb 14, 2017 9:40 am

Re: How to run z-push on zimbra jetty: Proof of Concept

Postby gabrieles » Fri Dec 30, 2022 1:36 pm

So what part of putting a z-push load on a mailstore that has to run java/jetty/mysql/all the application server load too, is a good idea?
Maybe if you have 3 active users on that server.
Maybe in 2013 virtualization was not so common and putting everything on a single barebone could be an idea worth of a POC, but not in 2022.
Top
Post Reply

Return to “Mobility”

Who is online

Users browsing this forum: No registered users and 5 guests