* Sidenote: for some reason, the linux/x86/shell/reverse_tcp metasploit payload would work and create a session, but would then drop the session due to an EOFError that looks like this: If you are not familiar with msfpayload there are plenty of tutorials out there. It just so happens, that one of the filetypes that msfpayload supports is. Using msfpayload, we can create shellcode and then specify what type of file to send it to. War file, and then get the backdoor to execute? Would it be possible for us to somehow create a backdoor we could upload in the form of a. war are Web ARchive files that contain all the files needed for a Java based web application. If you have not explored the wordlist directory or any thing else inside metasploit, I would highly recommend you do so because there are many useful things you will find.Īfter doing some research, I found out that.

opt/framework/msf3/data/wordlists/tomcat_mgr_default_users.txt opt/framework/msf3/data/wordlists/tomcat_mgr_default_userpass.txt Normally when brute forcing something, you need to provide a file or list of usernames and passwords, but since metasploit is one bad mo fo, it provides a user and password file custom made for this auxiliary module located at We also want to change the STOP_ON_SUCCESS value to true so that when we are successful, metasploit will stop brute forcing. First we will need to change the port to 8180. Metasploit, by default, has some options configured that we will need to change. Use auxiliary/scanner/http/tomcat_mgr_login Lets try to brute force the login credentials of the manager application for tomcat.

For more info on what Apache Tomcat is, go here. In a previous post we did a port scan and saw that on port 8180 Apache Tomcat was running. In this post we are going to target another attack vector of the metasploitable OS.

Download PortScan & Stuff 1.93