|
1 |
| -The auxiliary/scanner/http/tomcat_mgr_login works for Tomcat versions that uses HTTP |
| 1 | +The `auxiliary/scanner/http/tomcat_mgr_login` works for Tomcat versions that uses HTTP |
2 | 2 | authentication.
|
3 | 3 |
|
4 | 4 | Please note that for Tomcat 7 or newer, the roles required to use the manager application were
|
5 |
| -changed from the single manager role to the following four roles: |
| 5 | +changed from the single `manager` role to the following four roles: |
6 | 6 |
|
7 | 7 | * manager-gui - Allows access to the HTML GUI and the status pages.
|
8 | 8 | * manager-script - Allows access to the text interface and the status pages.
|
@@ -39,3 +39,98 @@ To download the vulnerable application, you can find it here: https://tomcat.apa
|
39 | 39 | 2. Do: ```set RHOSTS [IP]```
|
40 | 40 | 3. Set TARGETURI if necessary.
|
41 | 41 | 4. Do: ```run```
|
| 42 | + |
| 43 | +## Scenarios |
| 44 | + |
| 45 | +All scenarios are run with the credentials tomcat/tomcat. |
| 46 | + |
| 47 | +### Tomcat 6 |
| 48 | + |
| 49 | +Tomcat 6.0.48 running on Ubuntu 14.04 |
| 50 | + |
| 51 | +``` |
| 52 | +msf > use auxiliary/scanner/http/tomcat_mgr_login |
| 53 | +msf auxiliary(tomcat_mgr_login) > set rport 8080 |
| 54 | +rport => 8080 |
| 55 | +msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.156 |
| 56 | +rhosts => 192.168.2.156 |
| 57 | +msf auxiliary(tomcat_mgr_login) > run |
| 58 | +
|
| 59 | +[!] No active DB -- Credential data will not be saved! |
| 60 | +[-] 192.168.2.156:8080 - LOGIN FAILED: admin:admin (Incorrect) |
| 61 | +``` |
| 62 | +...snip... |
| 63 | + |
| 64 | +``` |
| 65 | +[-] 192.168.2.156:8080 - LOGIN FAILED: tomcat:root (Incorrect) |
| 66 | +[+] 192.168.2.156:8080 - LOGIN SUCCESSFUL: tomcat:tomcat |
| 67 | +[-] 192.168.2.156:8080 - LOGIN FAILED: both:admin (Incorrect) |
| 68 | +``` |
| 69 | +...snip... |
| 70 | + |
| 71 | +``` |
| 72 | +[*] Scanned 1 of 1 hosts (100% complete) |
| 73 | +[*] Auxiliary module execution completed |
| 74 | +``` |
| 75 | + |
| 76 | +### Tomcat 7 |
| 77 | + |
| 78 | +Tomcat 7.0.68 running on Windows XP |
| 79 | + |
| 80 | +``` |
| 81 | +msf > use auxiliary/scanner/http/tomcat_mgr_login |
| 82 | +msf auxiliary(tomcat_mgr_login) > set rport 8087 |
| 83 | +rport => 8087 |
| 84 | +msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.108 |
| 85 | +rhosts => 192.168.2.108 |
| 86 | +msf auxiliary(tomcat_mgr_login) > run |
| 87 | +
|
| 88 | +[!] No active DB -- Credential data will not be saved! |
| 89 | +[-] 192.168.2.108:8087 - LOGIN FAILED: admin:admin (Incorrect) |
| 90 | +``` |
| 91 | + |
| 92 | +...snip... |
| 93 | + |
| 94 | +``` |
| 95 | +[-] 192.168.2.108:8087 - LOGIN FAILED: tomcat:root (Incorrect) |
| 96 | +[+] 192.168.2.108:8087 - LOGIN SUCCESSFUL: tomcat:tomcat |
| 97 | +[-] 192.168.2.108:8087 - LOGIN FAILED: both:admin (Incorrect) |
| 98 | +``` |
| 99 | + |
| 100 | +...snip... |
| 101 | + |
| 102 | +``` |
| 103 | +[*] Scanned 1 of 1 hosts (100% complete) |
| 104 | +[*] Auxiliary module execution completed |
| 105 | +``` |
| 106 | + |
| 107 | +### Tomcat 8 |
| 108 | + |
| 109 | +Tomcat 8.0.32 unning on Windows XP |
| 110 | + |
| 111 | +``` |
| 112 | +msf > use auxiliary/scanner/http/tomcat_mgr_login |
| 113 | +msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.108 |
| 114 | +rhosts => 192.168.2.108 |
| 115 | +msf auxiliary(tomcat_mgr_login) > set rport 8088 |
| 116 | +rport => 8088 |
| 117 | +msf auxiliary(tomcat_mgr_login) > run |
| 118 | +
|
| 119 | +[!] No active DB -- Credential data will not be saved! |
| 120 | +[-] 192.168.2.108:8088 - LOGIN FAILED: admin:admin (Incorrect) |
| 121 | +``` |
| 122 | + |
| 123 | +...snip... |
| 124 | + |
| 125 | +``` |
| 126 | +[-] 192.168.2.108:8088 - LOGIN FAILED: tomcat:root (Incorrect) |
| 127 | +[+] 192.168.2.108:8088 - LOGIN SUCCESSFUL: tomcat:tomcat |
| 128 | +[-] 192.168.2.108:8088 - LOGIN FAILED: both:admin (Incorrect) |
| 129 | +``` |
| 130 | + |
| 131 | +...snip... |
| 132 | + |
| 133 | +``` |
| 134 | +[*] Scanned 1 of 1 hosts (100% complete) |
| 135 | +[*] Auxiliary module execution completed |
| 136 | +``` |
0 commit comments