Enumeration
Last updated
Last updated
Run a quick gobuster scan to see what other dirctories are available.
It looks like we have quite a few options here to explore. The most interesting to me are the /host-manager and /manager directories.
Nothing interesting in source code.
Nothing in source code either.
Lot's of good information here about the settings and set up of tomcat including default security settings.
Nothing in the source code.
This could be really good. This could be a means to uploading a reverse shell to the /examples directory and accessing it in here.
Nothing to note on any of these.
Looks like we get a login prompt. Let's see if we can find some default credentials for this since the rest of the web server isn't set up yet. We'll google to see if we come up with anything.
I can also look at brute forcing this login as it is doesn't stop me from multiple attempts.
I found quite a few answers on Google but the credentials admin:admin gave me some good information. I also found the following credentials that might work:
This is really good information and I'll check out the conf/tomcat-users.xml
Unfortunately, it looks like it doesn't exist.
I came back to this and tried the credentials tomcat:s3cret and was able to gain access to the page.
These credentials don't work for /host-manager
Let's explore the place to possible upload a WAR file:
Let's check out this page now.
It gives me the same sign-in page as /host-manager and the credentials admin:admin give me access. Unfortunately, this sends me to the same page as above, /manager/html.
Running a gobuster scan on this directory gave me a couple of areas to check out.
Only status can be accessed.
Now we have a lot of good information.
Tomcat Version --> Apache Tomcat/7.0.88
JVM Version --> 1.8.0_171-b11
JVM Vendor --> Oracle Corporation
OS Name --> Windows Server 2012 R2
OS Version --> 6.3
OS Architecture --> amd64
Hostname --> JERRY
It also shows a port of 8009. However, when I try visiting that page it hangs up and doesn't show anything. Could potentially be something listening on that end.
I found this possible exploit with hacktricks that I might be able to use.
