I ran into an issue where
rm doesn't delete anything from the
webapps directory using Apache Tomcat 7, but
rm does work in any other directory.
The Tomcat service is down. Any ideas?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Your tomcat instance has been attached. Check if tomcat manager is exposed and is NOT secured. Secure it immediately. Change the passwords in conf/tomcat-users.xml
You are unable to delete the malicious war 8888.war from the webapps because this war has run commands that changes the attributes of the webapps directory - made it write protected.
To check and revert you need to use (from https://askubuntu.com/questions/770639/how-can-i-delete-a-write-only-protected-folder)
Use lsattr command to verify that file/folder is not write protected using extended i attribute - output should be:
----i-------- /my/locked/directory To remove the i attribute you can run:
sudo chattr -i /my/locked/directory then check again with lsattr. The i should have been removed.
If removed run the sudo rm -r instructions above.
To read about what malicious work this attack could do refer to https://news.ycombinator.com/item?id=8226942 and stay protected.