So list the FTP services on medicolegal three again.
And this time you can work on the service that runs on Port 82 82.
Now it's due to be in HTP service, so I will try to reach it from my browser to display the application
that runs on this port.
And this is an Apache Tomcat help interface.
So at first, I think that the default Tomcat user name and password might probably work well here.
But unfortunately, it's not, so let's find another way.
There's always another way.
And we'll go back to the MSF council.
So, of course, you can always check the Nessa's result for Port 82, 82 s p 82, 82, and then two
to 10.
Now, have a look at that, there are some findings that you should analyze pretty carefully.
When you look into the vulnerability list, you see this line with a patchy access to detection.
So this finding is is relatively new.
So let's open up your browser and look for.
Access to exploit.
And click here to display the civic code about the Apache access to.
Right, so there are six codes here.
That, as you also can see the score, the last one is really high.
So let's look for this KVI echoed in Métis Point.
But you can always widen your search to search all.
So let's go back into the MSF council.
And search for TV code two zero one zero, dash zero two one nine, and there are two modules for this
code.
Now, if you are familiar with the MSF structure, you can immediately see the first one is a brute
force module to detect Ilagan, OK, and the second one is an exploit with such login information.
So let's have a look at the module information info and the exploit module name.
And if you look at the variable section, you will see a path variable.
So until now, you haven't verified if there is a vulnerability.
So to be sure that that's the exploit we want to use.
Let's go to that path from my browser to verify the path.
So why you go ahead and do this to open your browser now?
And go to the address, tenderfeet tend to then call in eight to eight to forego access to.
And sure enough.
So let's click on the administration link and, well, I think this is the administration page.
So let's go back to MSF consul.
And you can use this XPoint.
Show the options.
Set our host to ten point ten to ten.
That our airport to eight to eight to.
So available payloads for this module.
OK, set payload to.
Java interpreter reverse TCP.
Set elbows for this reverse connection to my colleagues i.p.
And I'll set airport to 82, 82.
So I'm pretty sure I said everything, but just to be sure, let's check one more time, show the options
again and everything looks good, so let's exploit.
And as you see the module log in with the default access user information and you know, it's a good
thing to get in the practice of is you can add this information to your dictionary file format.
Exploitable three.
So the session opened.
So let's get UID and this info.
And you've got another successful session on Métis Voidable three, good job.