Exploiting Apache Tomcat

[@unixbsdshell]

Very good...! I like your video

[@Tekionemission]

the shell access is based on the defualt login?

[@MuffFlux]

what nmap command did you use at the start?

[@ZuhaibMohammed]

Thanks for uploading.

[@drmikeyg]

Where did you get the vulnerable Apache Tomcat machine? Great video thanks.

[@elevatecyber5031]

It was a HacktheBox machine if I remember correctly

[@InfiniteLogins]

Thanks for the video! Excited to see this one.

[@brucemoose926]

I was looking for help with CSRF_NONCE=some long string when I deploy a war file. Any ideas?

[@SuperTechrobin]

super cool video sir thanks sir

[@user-tg6vk4ig3i]

Really good. I hope you continue this series

[@InsaneRecords997]

Hey bro what to do if default credentials don't work?

[@elevatecyber5031]

It uses basic auth so you can brute force it.

[@AketzaCitoresFranco]

good video!

[@goodboy8833]

Wow this channel is like Goldmine

[@javiporras3396]

good one !

[@meheshpavan3193]

how to get root access?

[@elevatecyber5031]

It all depends what account is running the apache tomcat service when you exploit it. If it the root account, you'll get root, if it's www, you'll only have the access level of that account

[@meheshpavan3193]

@@elevatecyber5031 yeah I only got access as tomcat7 , for privilege escalation I tried the linux exploits but nothing worked. Anything you wanna suggest .

[@flapcat4681]

​@@meheshpavan3193there's too many variables to give any actionable advice on this. Try putting linpeas on the machine and running it, then read over the output and see what's on the box itself