Jerry
Windows box on HTB.
Enumeration:
Port Scanning:
Nmap:
We only have apache tomcat running on port 8080.
Open it with Firefox:
We can see the version is shown above, and it is old, so we can find a multiple of exploits.
Exploitaion:
Get a reverse shell:
I will click on manager app:
It will ask me for username and password:
We can try multiple combinations of default credentials, like admin:admin:
We will get access denied, but it will show default credentials tomcat:s3cret:
Lets test them:
We successfully managed to authenticate.
We can now upload a jsp file or war file and deploy, but first we should create the war file using msfvenom:
Scroll down a bit, we will find (select war file to upload):
I will press browse, and upload the shell.war that I created:
Click on deploy, and we will see it in the applications table:
Start our netcat listener:
And click on that shell in the applications table, or naviagte to IP:PORT/shell/:
We will see a blank page, but when we go back to our listener:
We can now get the flags:
Last updated