Jerry Write-up
Machine HTB Windows Easy
Jerry is an easy-difficulty Windows machine that showcases how to exploit Apache Tomcat, leading to an NT Authority\SYSTEM shell, thus fully compromising the target.
🔍 Task 1 — Which TCP port is open on the remote host?
By executing the following command sudo nmap -sS -p- 10.129.49.208 it was possible to identify that the port 8080 on the target machine was open.
The answer is 8080
🔍 Task 2 — Which web server is running on the remote host? Looking for two words.
After identifying the open HTTP port, the running web server was determined by accessing the service through a web browser.
The answer is Apache Tomcat
🔍 Task 3 — Which relative path on the webserver leads to the Web Application Manager?
On the web server’s home page, a button labeled “Manager App” was available. By clicking this button or alternatively by inspecting the HTML source code the relative path to the Web Application Manager was identified.
The answer is /manager/html
🔓 Task 4 — What is the valid username and password combination for authenticating into the Tomcat Web Application Manager? Give the answer in the format of username:password
Apache Tomcat is known to have several default credential combinations that are widely documented online.
Get AuraSec’s stories in your inbox
Join Medium for free to get updates from this writer.
A targeted brute-force attempt was performed using common Tomcat default credentials, which resulted in the successful identification of a valid username and password combination for accessing the Web Application Manager.
The answer is tomcat:s3cret
📁 Task 4 — Which file type can be uploaded and deployed on the server using the Tomcat Web Application Manager?
After successfully authenticating to the Tomcat Web Application Manager, the built-in file upload functionality was identified. The application only accepts files with the .war (Web Application Archive) extension for deployment.
A malicious WAR file was crafted using msfvenom, specifying the attacker’s LHOST and LPORT.
This file was then uploaded through the Tomcat interface and triggered by accessing its deployment path /shell.war. As a result, a reverse shell connection was successfully established to the attacking machine.
The answer is war
