Jerry Writeup
Jerry is quite possibly the easiest box I’ve done on HackTheBox. There’s a Tomcat install with a default password for the Web Application Manager. I used that to upload a malicious war file ...
Vulnerability Exploited: Broken Authentication
System Vulnerable: 10.10.10.95
Vulnerability Explanation: On this server, there was an exposed port that was running Apache Tomcat. The administrator had used default credentials for the manager interface. This allows the attacker to access the interface and deploy a war file that gave us access to the server. Since default credentials are publicly available and can be easily obtained.
Vulnerability Fix: The administrator should have instead used a sufficiently long password that is difficult to crack.
Privilege Escalation Vulnerability: Least Privilege Violation
Vulnerability Fix: Tomcat doesn’t need SYSTEM privileges to function properly. Instead, it should have been run under a tomcat user account that has limited privileges. This way, even if we did get access to the box, we would have needed to find a way to escalate privileges, instead of immediately getting SYSTEM access without having to work for it. The administrator should have conformed to the principle of least privilege.
Severity: Critical
An initial Nmap scan revealed the Apache Tomcat Service on the 8080 port.
The initial page of Apache Tomcat/7.0.88
Visiting the Manager App, using the default credentials: tomcat:s3cret
Create a reverse shell payload using msfvenom and save it on shell.war
Upload the shell.war on the web application
Launch a nc listener on the local machine and visit the /shell file on the web application:
Receiving a reverse shell as NT AUTHORITY\SSYTEM
user.txt & root.txt
The proof of user and root are stored on the same file called “2 for the price of 1.txt”
Lessons Learned
Always change the default credentials of any installed application on your server.
Never give any service permission more than what it needs to be working well.
Last updated