Now, when you're finished with an XPoint.
You can pick another one directly by using the U.S command like this.
Or you can use the back and then utilize the new one by the EU's command.
That's pretty much how I work.
Then show the exploit options.
Now, for this point, I will define a payload by setting the payload variable.
Set payload java.
Met Interpretor Reverse TCAP.
So I don't set the host variable, but in the previous video, I define it as a global variable named.
And also, there are some new variables under this payload section L. host and L Port because I chose
a reverse TCP connection.
Which means that after a successful exploitation, the target will connect back to me.
So our host in this context is the IP address of Carly and Al Port is the port that is ready to connect
to Carly.
Its default value is four four four four, and I don't want to change that.
I will only set the host to 10, not 10.
Not to not one one.
Then said HTP password to Tomcat, said HTP username to Tomcat.
Now, it isn't necessary, but I can set the target to zero.
Or I forgot the airport, so let's set the iReport to 80, 180.
OK, so let me check it one more time.
OK, yeah, everything looks good.
Now exploit.
So it doesn't take too much time and I have the interpreter session on Matus voidable to.
But this time, let's have a look at the user Tomcat 55.
It is not the route user.
So this means actually you don't have a high privileged shell.
So I'm going to send this session to the background by using the interpreter command.
So this is my session's list in the background.
OK, so I want to show you a couple more command.
Push em and pop em, push em will push the current module to stack.
Now I will push this XPoint to stack, then I can pick another one RMI registry XPoint.
And I'll run it and I get another session, so as you can see here, I am working with RMI Registry
exploit with the pop em, I'll pop the last module from the stack and it's the Tomcat manager exploit,
as you see here on your screen.
So I'll advise you to do this, because when you're doing some really quick exploitation, those last
two commands come in super handy.