Tomcat Apache Information Dumps - Hack the Garbage

AKS aka 0kn0ck , CERA
Note : For Education Purposes Only !.

View:
.

The web is a platform for launching number of attacks in different environment. It is not so easy to directly trigger the pattern of insecurity and exploit the dynamic entities. The web itself holds tremendous information. This information should be managed and tackled in a right way. Again the administration is a big problem. Well it is. While pen testing Apache tomcat it is undertaken that the security is implemented in a worst way. Most of the time weak passwords and poorly generated modules and misconfigurations lead to control.

Note: 50 % of Apache Tomcat servers can be hacked in easy manner if security is slithered.

The randmization check on web produces understated dump of tomcat-users.xml file. It some time look strange and insecure to prove the fact that administration leads to insecurity. One other reason can be the administrator do not understand the actual parameter of security when particular security object is concerned. This time it is Apache Tomcat. Its always been a threat as username and password is present in the XML file. One more step is its present in clear text. We will look into two casesas related to this factor.

1. http://www.opensource.apache.com

2. http://www.opensource.adobe.com


So lets see:-

Check 1

tomcat-users
role rolename="Editeerder"/
role rolename="Consulterend Gebruiker"/
role rolename="Beheerder"/
role rolename="Goedkeurder"/
role rolename="tomcat"/
user username="gast" password="gast" roles="Consulterend Gebruiker"/
user username="editeerder" password="editeerder" roles="Consulterend Gebruiker,Editeerder"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="gegis" password="gegispass" roles="Consulterend Gebruiker,Editeerder,Goedkeurder,Beheerder"/
user username="guest" password="guest" roles="Consulterend Gebruiker"/
/tomcat-users

Check 2

?xml version='1.0' encoding='utf-8'?
tomcat-users
role rolename="demo.owner"/
role rolename="tomcat"/
role rolename="role1"/
role rolename="manager"/
role rolename="demo.user"/
role rolename="demo.alerts"/
role rolename="demo.contentadmin"/
role rolename="admin"/
role rolename="demo.admin"/
user username="caluser2" password="uwcal" roles="demo.user"/
user username="calcontent" password="uwcal" roles="demo.contentadmin"/
user username="caluser" password="uwcal" roles="demo.user"/
user username="caluser1" password="uwcal" roles="demo.user"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="caladmin" password="uwcal" roles="demo.admin"/
user username="calowner" password="uwcal" roles="demo.owner"/
user username="calowner2" password="uwcal" roles="demo.owner"/
user username="calowner3" password="uwcal" roles="demo.owner"/
user username="role1" password="tomcat" roles="role1"/
user username="both" password="tomcat" roles="tomcat,role1"/
user username="caluser3" password="uwcal" roles="demo.user"/
user username="manager" password="VuRyser2" roles="admin,manager"/
/tomcat-users

Check 3

1 ?xml version='1.0' encoding='utf-8'?
2 tomcat-users
3 role rolename="tomcat"/
4 role rolename="role1"/
5 user username="tomcat" password="tomcat" roles="tomcat"/
6 user username="role1" password="tomcat" roles="role1"/
7 user username="both" password="tomcat" roles="tomcat,role1"/
8 /tomcat-users

Check 4

tomcat-users
role rolename="tomcat"/
role rolename="role1"/
role rolename="manager"/
role rolename="admin"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="role1" password="tomcat" roles="role1"/
user username="both" password="tomcat" roles="tomcat,role1"/
user username="admin" password="admin" roles="admin,manager"/
/tomcat-users

Check 5

tomcat-users
role rolename="provider"/
role rolename="manager"/
role rolename="admin"/
user username="root" password="" fullName="sys admin" roles="admin,manager,provider"/
/tomcat-users

?xml version='1.0' encoding='utf-8'?
tomcat-users
role rolename="tomcat"/
role rolename="role1"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="role1" password="tomcat" roles="role1"/
user username="both" password="tomcat" roles="tomcat,role1"/
/tomcat-users

tomcat-users
user name="tomcat" password="tomcat" roles="tomcat,manager"/
user name="role1" password="tomcat" roles="role1"/
user name="both" password="tomcat" roles="tomcat,role1"/
/tomcat-users


This is actually the result of incessant dumps that are present on servers. But this really a good deal of fidning relative passwords as such. On next step this information is used for further attacks on the web server itself.

http://www.opensource.apache.com

tomcat-users
role rolename="tomcat"/
role rolename="role1"/
role rolename="admin"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="role1" password="tomcat" roles="role1"/
user username="both" password="tomcat" roles="tomcat,role1"/
user username="admin" password="apple" roles="admin"/
/tomcat-users

http://www.opensource.adobe.com

?xml version='1.0' encoding='utf-8'?
tomcat-users
!--
role rolename="tomcat"/
role rolename="role1"/
user username="tomcat" password="tomcat" roles="tomcat"/
user username="both" password="tomcat" roles="tomcat,role1"/
user username="role1" password="tomcat" roles="role1"/
--
/tomcat-users

So this is what we use to get from garbage dumps. So lets Hack through Web Garbage.