Did n't find tomcat credentials

[ranjithprethan]

Hi,

I grabbed the prebuilt changeme from docker hub and ran it today. ./changeme.py -n "Apache Tomcat" XXXX. Though tomcat uses the default credentials, it didn't find the creds. I have also verified the same default creds hardcoded in creds folder (Yaml file)

Loaded 2 default creds profiles
Loaded 34 default creds

No default creds found .

I didnt pull redis and used redis at the background. Appreciate any help.

Thanks

[ztgrace]

Hi @ranjithprethan,

Thanks for the report. Could you please provide the following output so I can attempt to reproduce?

• Could you please post the debug output of ./changeme.py -n "Apache Tomcat" -d XXXX?
• What's the URL you're manually verifying?
• What port is the Tomcat service on?
• What default Tomcat default credentials are you manually verifying?

Thanks,
Zach

[ranjithprethan]

Hi Zach,

Thanks for your response.

I run kali on my windows using oracle virtual box and I run docker on my kali.
I run changeme on docker.
Kali is configured with bridged network and docker is not, however I can ping the remote IP from docker terminal.

url : http://localhost:8080
credentials : tomcat : tomcat

Thanks
Ranjith

[ztgrace]

Hi @ranjithprethan,

Thanks for the info. Could you please run the command with the debug -d flag and paste the output so I can see what it looks like?

Thanks,
Zach

[ranjithprethan]

Hi Zach, sure

Here is the screenshot.

Thanks
-Ranjith

[ztgrace]

Here's the two issues I see going on:

• changeme can't connect to the redis service, please follow the instructions here:
  https://github.com/ztgrace/changeme#run-changeme-in-docker Please configure as described and re-run your tests and let me know the results.
• Additionally Tomcat never gets fingerprinted. You should see a message like [21:08:41][http_fingerprint][ismatch] Apache Tomcat basic auth matched: Tomcat Manager Application when the service is properly fingerprinted. Please validate that the protocol (http vs https) and port are correct.

[ranjithprethan]

Hi Zach,

I have configured the redis service and I still get the connection error (Localhost:6379)

Do I also need to run this step below as part of this configuration? Is this intended to scan the redis server?

Run changeme with a --redishost of redis and --output file in our mounted volume: ./changeme.py --redishost redis --output /tmp/mnt/results.csv --protocols ssh --threads 20 -d 192.168.1.0/24

do I need to use my localhost IP address ( docker IP)? My docker runs on kali ( Virtual Box) and Kali runs on windows 7 machine.

this is the url for the tomcat manager
http://localhost:8080/manager/html

Thanks
Ranjith

[ranjithprethan]

I have also verified all my running containers on my docker. Redis runs on 6379 port. I am not sure why I still get the connection error

[AlessandroZ]

I have noticed that during the fingerprint process, if the body is not present on the yaml file, the fingerprint failed. The problem is that lots of yaml files does not have body (tomcat is one of them).
If "body" is not present, you have to check the status as well, it should solve the problem.

[ztgrace]

@AlessandroZ do you have an example HTTP request/response when this happens? I've not run into this and it seems to fingerprint all of the Tomcat instances I've seen.