I ran into an issue where rm doesn't delete anything from the webapps directory using Apache Tomcat 7, but rm does work in any other directory.

The Tomcat service is down. Any ideas?

  • What happens when you try but fail? Permission errors? Who owns the folder and what user are you running rm as? – Kusalananda Sep 18 '17 at 14:14
  • Yeah I get permission error rm: cannot remove ‘8888.war’: Permission denied. Folder belongs to root and I'm running rm as root too. – Zawada Sep 18 '17 at 14:15

Your tomcat instance has been attached. Check if tomcat manager is exposed and is NOT secured. Secure it immediately. Change the passwords in conf/tomcat-users.xml

You are unable to delete the malicious war 8888.war from the webapps because this war has run commands that changes the attributes of the webapps directory - made it write protected.

To check and revert you need to use (from https://askubuntu.com/questions/770639/how-can-i-delete-a-write-only-protected-folder)

Use lsattr command to verify that file/folder is not write protected using extended i attribute - output should be:

----i-------- /my/locked/directory To remove the i attribute you can run:

sudo chattr -i /my/locked/directory then check again with lsattr. The i should have been removed.

If removed run the sudo rm -r instructions above.

To read about what malicious work this attack could do refer to https://news.ycombinator.com/item?id=8226942 and stay protected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.