‫Now, when you're finished with an XPoint.
‫You can pick another one directly by using the U.S command like this.
‫Or you can use the back and then utilize the new one by the EU's command.
‫That's pretty much how I work.
‫Then show the exploit options.
‫Now, for this point, I will define a payload by setting the payload variable.
‫Set payload java.
‫Met Interpretor Reverse TCAP.
‫So I don't set the host variable, but in the previous video, I define it as a global variable named.
‫And also, there are some new variables under this payload section L. host and L Port because I chose
‫a reverse TCP connection.
‫Which means that after a successful exploitation, the target will connect back to me.
‫So our host in this context is the IP address of Carly and Al Port is the port that is ready to connect
‫to Carly.
‫Its default value is four four four four, and I don't want to change that.
‫I will only set the host to 10, not 10.
‫Not to not one one.
‫Then said HTP password to Tomcat, said HTP username to Tomcat.
‫Now, it isn't necessary, but I can set the target to zero.
‫Or I forgot the airport, so let's set the iReport to 80, 180.
‫OK, so let me check it one more time.
‫OK, yeah, everything looks good.
‫Now exploit.
‫So it doesn't take too much time and I have the interpreter session on Matus voidable to.
‫But this time, let's have a look at the user Tomcat 55.
‫It is not the route user.
‫So this means actually you don't have a high privileged shell.
‫So I'm going to send this session to the background by using the interpreter command.
‫So this is my session's list in the background.
‫OK, so I want to show you a couple more command.
‫Push em and pop em, push em will push the current module to stack.
‫Now I will push this XPoint to stack, then I can pick another one RMI registry XPoint.
‫And I'll run it and I get another session, so as you can see here, I am working with RMI Registry
‫exploit with the pop em, I'll pop the last module from the stack and it's the Tomcat manager exploit,
‫as you see here on your screen.
‫So I'll advise you to do this, because when you're doing some really quick exploitation, those last
‫two commands come in super handy.