Skip to content

Commit 4c5e046

Browse files
committed
fixes deploy and upload
1 parent 3227131 commit 4c5e046

File tree

2 files changed

+431
-10
lines changed

2 files changed

+431
-10
lines changed

documentation/modules/exploit/multi/http/tomcat_mgr_deploy.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ This documentation is slightly different from the standard module documentation
33
This documentation is broken down by OS, Tomcat version, then privilege to show exploitation in each variation.
44

55
# Cleanup
6-
It should be stated outright that the exploit does NOT undeploy the shellcode from Tomcat. This can be done [manually](#manual-cleanup).
6+
It should be stated outright that the exploit MAY NOT undeploy the shellcode from Tomcat. This can be done [manually](#manual-cleanup).
77

88
# tomcat_mgr_upload
99
This module is VERY similar to `exploit/multi/http/tomcat_mgr_upload`, the main difference is this uses a `PUT` HTTP request, instead of going through a `POST` HTTP request through the GUI.
@@ -205,10 +205,10 @@ Of note, the user was given `manager-gui` permissions by default.
205205
206206
1. Edit `/etc/tomcat6/tomcat-users.xml` to add the following:
207207
208-
```
209-
<role rolename="manager"/>
210-
<user username="tomcat" password="tomcat" roles="manager"/>
211-
```
208+
```
209+
<role rolename="manager"/>
210+
<user username="tomcat" password="tomcat" roles="manager"/>
211+
```
212212
213213
2. Restart Tomcat: `sudo service tomcat6 restart`
214214
@@ -323,10 +323,10 @@ Of note, as of 7, the permission role 'manager' has been divided into several su
323323
324324
1. Edit `/etc/tomcat8/tomcat-users.xml` to add:
325325
326-
```
327-
<role rolename="manager-script"/>
328-
<user username="tomcat" password="tomcat" roles="manager-script"/>
329-
```
326+
```
327+
<role rolename="manager-script"/>
328+
<user username="tomcat" password="tomcat" roles="manager-script"/>
329+
```
330330
331331
2. Restart tomcat: `sudo service tomcat8 restart`
332332
1. To verify the permissions are all set correctly, browse to `http://192.168.2.118:8087/manager/text/deploy`, and you should see `FAIL - Invalid parameters supplied for command [/deploy]
@@ -375,4 +375,4 @@ Of note, as of 7, the permission role 'manager' has been divided into several su
375375
376376
## Manual Cleanup
377377
378-
Manual cleanup can be done by logging into the `/manager` website. From there, click `Undeploy` within the `Application` list to remove the malicious app from Tomcat.
378+
Manual cleanup can be done by logging into the `/manager` website. From there, click `Undeploy` within the `Application` list to remove the malicious app from Tomcat.

0 commit comments

Comments
 (0)