So I am currently working my way through a few books. One of which had me download the metasploitable2 vm. This machine has a tomcat server running on it which I successfully exploited using Metasploit. I used Metasploit to brute-force the login credentials and then I used a bug in the upload manager to send a bind to TCP payload. That all worked swimmingly. Now I want to figure out how to do it by hand.
I managed to brute force the login by hand but I am having issues getting even a basic payload scenario to work.
From my understanding the way this works is Tomcat will let you stick a malicious JSP inside of a WAR and upload it to their server to run. When it runs the JSP a shell can be achieved.
Ultimately what I want to do is programmatically inject a payload that I craft in python into the server and get a reverse shell all without using Metasploit at all. However, I need to work up to that so I figured I would just start with taking a generated Metasploit payload and uploading it into the server via the upload manager interface.
Steps taken to exploit the machine
- Brute forced the login
- Generated a reverse_tcp payload with the same info that made it work when deployed from Metasploit
- Logged into the tomcat manager service
- Browsed to my WAR payload and uploaded it
- Setup netcat to listen
- In the browser, navigate to my payload. http://internalip:8180/mypayload/
No luck. Nothing calls back to me. In fact when I navigate to the link it says 404 cant be found even though the application shows up in the application list.