Tabby — Credentials¶
| User | Password / Hash | Type | Source | Access Granted | Tested |
|---|---|---|---|---|---|
| tomcat | $3cureP4s5w0rd123! |
cleartext | LFI → /usr/share/tomcat9/etc/tomcat-users.xml |
Tomcat manager-script + admin-gui → WAR deploy RCE (tomcat user) |
✓ |
| ash | admin@it |
cleartext | zip2john crack of 16162020_backup.zip → reused |
su ash → user.txt |
✓ |
Notes¶
- Found via LFI path traversal on
news.php?file=. - Tomcat default config path differs from upstream: Debian/Ubuntu
tomcat9keepstomcat-users.xmlunder/usr/share/tomcat9/etc/and/etc/tomcat9/, NOT under$CATALINA_HOME/conf/. - Roles:
manager-script(text/API deploy via/manager/text/...) andadmin-gui. - Important:
manager-scriptdoes NOT grantmanager-gui(the browser HTML interface). To deploy a WAR, use the/manager/text/deployAPI with curl, not the web GUI. - Password reuse: the zip password
admin@it(cracked from ash's backup) is reused as ash's Linux password — classic crack-then-reuse pivot.