markdown docs

documentation/modules/auxiliary/admin/http/tomcat_administration.md

@@ -0,0 +1,47 @@
+## Vulnerable Application
+
+  The administrator application was removed as of Tomcat 6.  Tomcat 5.5.36 is available from [apache](https://archive.apache.org/dist/tomcat/tomcat-5/v5.5.36/).  This does not have the `admin` app bundled though, and can be downloaded [here](https://archive.apache.org/dist/tomcat/tomcat-5/v5.5.36/bin/apache-tomcat-5.5.36-admin.zip).
+  
+  To utilize the `admin` application, a user must have the permission `admin` applied to their account.  The following user line will handle all necessary permissions: `<user username="tomcat" password="tomcat" roles="admin">`.
+
+## Verification Steps
+
+  1. Install Tomcat 5.5 or older
+  2. Install the admin app
+  3. Start msfconsole
+  4. Do: ```use auxiliary/admin/http/tomcat_administration```
+  5. Do: ```set rhosts <ips>```
+  6. Do: ```set tomcat_user <username>```
+  7. Do: ```set tomcat_pass <username>```
+  8. Do: ```set rport <port>```
+  9. Do: ```run```
+  10. Find all the Tomcat admin portals
+
+## Options
+
+  **rport**
+
+  The default is set to `8180`, which is only default on FreeBSD.  All other operating systems, and the software itself, default to 8080.
+
+## Scenarios
+
+  Example run against Tomcat 5.5.36 with admin module installed against Windows XP
+
+  ```
+  msf > use auxiliary/admin/http/tomcat_administration 
+  msf auxiliary(tomcat_administration) > set rport 8085
+  rport => 8085
+  msf auxiliary(tomcat_administration) > set rhosts 192.168.2.108
+  rhosts => 192.168.2.108
+  msf auxiliary(tomcat_administration) > set verbose true
+  verbose => true
+  msf auxiliary(tomcat_administration) > set tomcat_pass tomcat
+  tomcat_pass => tomcat
+  msf auxiliary(tomcat_administration) > set tomcat_user tomcat
+  tomcat_user => tomcat
+  msf auxiliary(tomcat_administration) > run
+  
+  [*] http://192.168.2.108:8085/admin [Apache-Coyote/1.1] [Apache Tomcat/5.5.36] [Tomcat Server Administration] [tomcat/tomcat]
+  [*] Scanned 1 of 1 hosts (100% complete)
+  [*] Auxiliary module execution completed
+  ```