{"uuid": "c77d209c-440e-4e54-a50f-7897d2861856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-12617", "type": "seen", "source": "https://t.me/hacking_Attack/138511", "content": "Tomcat Manager without Default Creds\nhttps://www.reddit.com/r/Pentesting/comments/1dp8zxc/tomcat_manager_without_default_creds/\n\nI've been looking for a guide or how-to enumerate through the following scenario but haven't been able to find a resource that meets what I'm looking for. Tomcat 8.5 running on a Windows server, and my assumption is that I'm trying to get to the Manager App to upload the reverse shell as a WAR file. The issue that I'm running into is that the server isn't using any of the default/common tomcat credentials on the interface. This is where I'm getting stuck because every youtuber has either \"I already logged in\", \"use the metasploit module\" or \"google for default creds\" which I've done all of these and they do not work. I've been working at trying to find a foothold on this server for about a month. My server setup is - Windows Server 2019, ISO install, no updates. Apache Tomcat 8.5 management interfaces added at installation but no password was set. System is not vulnerable to CVE-2017-12617 or 2020-10487. Other than that there are several MSPRC ports open at 135 and some high ports, SMB, HTTPAPI on 5985, Tomcat on 8080 and no snmp. No alternate website being hosted as well, just what is looking like a vanilla Tomcat installation. I've hit that level of insanity where I keep running the same tools and exploits against it hoping it will work this time but I'm just not finding a foothold on the server. Any suggestions for a direction to look?    submitted by    /u/beerdini  (https://www.reddit.com/user/beerdini) \n [link] (https://www.reddit.com/r/Pentesting/comments/1dp8zxc/tomcat_manager_without_default_creds/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1dp8zxc/tomcat_manager_without_default_creds/)", "creation_timestamp": "2026-09-02T01:00:51.167606Z"}