Tomcat — TryHackMe

Let’s start with using nmap scan to look for open ports and services on the target system. -sC is for running default scripts on open ports and -sV is to enumerate the version of services running on those open ports.

Let’s look for directories and files on the web server sunning on port the target system using gobuster.

After enumerating the server we found its running Apache Tomcat 9.0.30. Google the version we found the above version of Tomcat is vulnerable to Apache Gostcat Vulnerability. Let’s exploit the vulnerability using Metasploit Framework. Let’s set the RHOSTS to the target IP.

The file /WEB-INF/web.xml is readable and it gives us the password for the user Skyfuck.

Now let’s connect to the target system using SSH.

Let’s list the directory for files. W found tryhackme.asc and credential.pgp, these look interesting files.

Let’s download both of those files.

Let’s use gpg2john to get the crackable hash for john.

Found a password for credential.pgp

Found the password for Merlin user let’s connect to the target machine via SSH using Merlin’s credentials.

We found the user.txt on Merlin’s home directory.

Now time for privilege escalation. Let’s see which commands can be run as a root by the current user i.e., Merlin.

Interesting we can run /usr/bin/zip as root. Lets go to GTFOBins and see how to exploit zip command to get a root session. And we find the following commands for the same purpose.

Found the root flag.