One Day SecOne Day Sec

Setting up GoAnywhere Managed File Transfer Vulnerability Debugging Environment

Onedaysec
3 min read
1 views
docx image 1770018736193 0 ace76b8282

0x00 Preface

---

This article documents the details of setting up a GoAnywhere Managed File Transfer vulnerability debugging environment from scratch.

0x01 Introduction

---

This article will cover the following topics:

  • GoAnywhere Managed File Transfer Installation
  • GoAnywhere Managed File Transfer Vulnerability Debugging Environment Configuration
  • Database Operations

0x02 GoAnywhere Managed File Transfer Installation

---

Reference: https://static.fortra.com/goanywhere/pdfs/guides/ga6_8_6_installation_guide.pdf

Download URL: https://www.goanywhere.com/products/goanywhere-free/download

Registration required to obtain a license

GoAnywhere Managed File Transfer can be installed separately on Windows and Linux operating systems

Default web path on Windows system: C:\Program Files\HelpSystems\GoAnywhere\tomcat\webapps\ROOT

Default web path on Linux system: /usr/local/HelpSystems/GoAnywhere/tomcat/webapps/ROOT

1. Enable remote debugging function

Achieved by enabling Tomcat debugging function. The method to enable Tomcat debugging is as follows:

  • Switch to the bin directory
  • Execute command: catalina jpda start

After Tomcat debugging function is enabled, it listens on local port 8000 by default

For GoAnywhere Managed File Transfer, the method to enable debugging function is as follows:

(1) Debugging on Windows

Modify file properties of C:\Program Files\HelpSystems\GoAnywhere\tomcat\bin\GoAnywhere.exe

Double-click file C:\Program Files\HelpSystems\GoAnywhere\tomcat\bin\GoAnywhere.exe, switch to Java tab, add in Java Options: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8090, as shown below

(1) Debugging on Windows — technical illustration 1

Restart GoAnywhere service

(2) Linux debugging

Modify file: /opt/HelpSystems/GoAnywhere/tomcat/bin/start_tomcat.sh, change exec "$PRGDIR"/"$EXECUTABLE" start "$@" to exec "$PRGDIR"/"$EXECUTABLE" jpda start "$@"

Modify file: /opt/HelpSystems/GoAnywhere/tomcat/bin/goanywhere_catalina.sh, change JPDA_ADDRESS="localhost:8000" to JPDA_ADDRESS="*:8090"

Note:

Tomcat's default debug port 8000 conflicts with GoAnywhere Managed File Transfer's web port, so here we choose to modify Tomcat's default debug port to 8090

Open firewall to allow external access to port 8090: iptables -I INPUT -p tcp --dport 8090 -j ACCEPT

Start GoAnywhere process: /opt/HelpSystems/GoAnywhere/goanywhere.sh start

0x03 Database Operations

---

GoAnywhere Managed File Transfer uses Apache Derby database

Default database storage location on Windows: C:\Program Files\HelpSystems\GoAnywhere\userdata\database\goanywhere

Default database storage location on Linux: /opt/HelpSystems/GoAnywhere/userdata/database/goanywhere/

Implementation details of database operations can be obtained from ga_classes.jar in the lib folder

From this we can get the implementation details of web user password encryption, corresponding location: C:\Program Files\HelpSystems\GoAnywhere\lib\ga_classes.jar!\com\linoma\ga\ui\admin\action\user\ChangeUserPasswordAction.class

Extracted Java implementation code is as follows:

import com.linoma.commons.crypto.PasswordHash;
import com.linoma.commons.crypto.PasswordHashFactory;
import com.linoma.dpa.util.SystemInfo;
public class Main {
public static void main(String[] args) throws Exception, Exception {
PasswordHash var2 = PasswordHashFactory.getPasswordHash(SystemInfo.getPasswordHashAlgorithm(), "");
String var3 = var2.hash("Password@123456");
System.out.println(var3);
}
}

1. Reading Derby Database

(1) Command Line Implementation

Using Apache Derby, download address: https://archive.apache.org/dist/db/derby/db-derby-10.14.2.0/db-derby-10.14.2.0-bin.zip

Run ij.bat in the bin directory

Connect to database: connect 'jdbc:derby:C:\Program Files\HelpSystems\GoAnywhere\userdata\database\goanywhere;';

Query user configuration: SELECT * FROM DPA_USER;

(2) GUI Implementation

Use DBSchema, download link: https://dbschema.com/download.html

After launching DBSchema, select to connect to the Derby database, choose derbytools.jar org.apache.derby.jdbc.EmbeddedDriver as the JDBC Driver, and select C:\Program Files\HelpSystems\GoAnywhere\userdata\database\goanywhere as the Folder

Query the user data table, as shown in the figure below

(2) GUI Implementation — technical illustration 2

It can be seen that the default users are the following three:

  • Administrator, disabled
  • root, disabled
  • admin, default user

2. Modify the Database

GoAnywhere Managed File Transfer's Derby database uses embedded mode, which is not accessible by other applications, so there are two methods to modify the data:

(1) GoAnywhere Managed File Transfer is in a running state

Database modification can be achieved by writing a jsp file

(2) GoAnywhere Managed File Transfer is in a closed state

You can choose Apache Derby or DBSchema to open the database folder and directly modify it

Example commands for modifying the database:

Enable root user: UPDATE APP.DPA_USER SET ENABLED='1' WHERE USER_NAME='root';

Set root user password: UPDATE APP.DPA_USER SET USER_PASS='$5$mpoe6zI4B6+LHRMdbFKr8g==$RnAILbYe9KDauKE3wXTFVvlXQNZeM4Z2c7x1aEtME/U=' WHERE USER_NAME='root';

0x04 Summary

---

After setting up the GoAnywhere Managed File Transfer vulnerability debugging environment, we can proceed to study the vulnerability.

Related Questions & Answers

What are the default web paths and why is the Tomcat debug port changed to 8090?

The default web path is `C:\Program Files\HelpSystems\GoAnywhere\tomcat\webapps\ROOT` on Windows and `/usr/local/HelpSystems/GoAnywhere/tomcat/webapps/ROOT` on Linux. Tomcat's default JPDA debug port (8000) conflicts with GoAnywhere’s web port, so the article instructs changing it to `8090` in the `goanywhere_catalina.sh` script on Linux or via the `GoAnywhere.exe` Java Options on Windows. This port adjustment is a common step in vulnerability debugging setups, similar to those described in [F5 BIG-IP Vulnerability Debugging Environment Setup](/news/f5-big-ip-vulnerability-debugging-environment-setup).

How do I change an administrator password in the GoAnywhere MFT database?

To change a password, you need the hashed value. The article provides a Java code snippet that uses `PasswordHashFactory` to generate a hash (e.g., for `Password@123456`). Once you have the hash, run an SQL update on the database: `UPDATE APP.DPA_USER SET USER_PASS='<hash>' WHERE USER_NAME='root';`. This can be done via Derby command line or DBSchema when GoAnywhere is not running, or through a JSP file when the service is active. Refer to the [database operations](/news/setting-up-goanywhere-managed-file-transfer-vulnerability-debugging-environment#0x03-database-operations) portion for exact commands.

What methods can I use to read and modify the Apache Derby database used by GoAnywhere MFT?

You can read the Derby database using command-line tools like Apache Derby's `ij` script (connect with `connect 'jdbc:derby:<path>';`) or a GUI tool like DBSchema. To modify the database when GoAnywhere is stopped, use either method to run SQL statements—for example, enabling a disabled user with `UPDATE APP.DPA_USER SET ENABLED='1' WHERE USER_NAME='root';`. When the service is running, you can also write a JSP file to perform modifications. These techniques are covered in the [database operations section](/news/setting-up-goanywhere-managed-file-transfer-vulnerability-debugging-environment#0x03-database-operations) of the setup guide.

How do I enable remote debugging for GoAnywhere Managed File Transfer on a Windows system?

To enable remote debugging on Windows, modify the Java options in the `GoAnywhere.exe` file. Open the executable, switch to the Java tab, and add the following parameter: `-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8090`. This changes the default debug port from 8000 (which conflicts with the web port) to 8090. After adding the option, restart the GoAnywhere service as detailed in [Setting up GoAnywhere Managed File Transfer Vulnerability Debugging Environment](/news/setting-up-goanywhere-managed-file-transfer-vulnerability-debugging-environment).

Continue Reading