Tomcat service penetration and security

Tomcat is a classic open-source middleware. It is widely used in production and has multiple instances and multiple ports for tomcat clusters. However, we need to pay attention to the security issues. Today we will give a simple demonstration of a case.

 

The first choice is to lock the target host: 192.168.1.3. Generally, the default tomcat port is 8080.

The default user name and password in the tomcat-users.xml are tomcat, tomcat

Log on to the tomcat GUI Management page.

Compress a webshell in jsp format into a zip file, and then compress it in war format without affecting File Execution.

12	zip -j shell.jsp shell.zip mv shell.zip shell.war

Select "Brower" to specify the shell. war file to upload and Deploy. Note that Undeploy can delete the file physically.

After the Desploy operation is successful, you can see that a directory named shell is automatically generated, and the status is true, which is started automatically.

Open the corresponding webshell page and enter the executed system command in the box below the page. The system information is displayed at a glance.

Cause analysis, the tomcat-users.xml has the following configuration

  <role rolename= "manager-gui" /> <user username= "tomcat"  password= "tomcat"  roles= "manager-gui" />

Comment out the configuration and restart the tomcat service to avoid security risks.

Article: http://laoxu.blog. 51 cto.com/4120547/1243308