Kotarak
"Challenging" box from Hack The Box 10.10.10.55
Scanning and Enumeration
└─# nmap -sC -sV -p22,8009,8080 10.10.10.55
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-10 22:05 EDT
Nmap scan report for 10.10.10.55
Host is up (0.10s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 e2:d7:ca:0e:b7:cb:0a:51:f7:2e:75:ea:02:24:17:74 (RSA)
| 256 e8:f1:c0:d3:7d:9b:43:73:ad:37:3b:cb:e1:64:8e:e9 (ECDSA)
|_ 256 6d:e9:26:ad:86:02:2d:68:e1:eb:ad:66:a0:60:17:b8 (ED25519)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
| ajp-methods:
| Supported methods: GET HEAD POST PUT DELETE OPTIONS
| Potentially risky methods: PUT DELETE
|_ See https://nmap.org/nsedoc/scripts/ajp-methods.html
8080/tcp open http Apache Tomcat 8.5.5
|_http-favicon: Apache Tomcat
| http-methods:
|_ Potentially risky methods: PUT DELETE
|_http-title: Apache Tomcat/8.5.5 - Error report
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
PORT STATE SERVICE
22/tcp open ssh
8009/tcp open ajp13
8080/tcp open http-proxy
60000/tcp open unknown
PORT
STATE
SERVICE
VERSION
22
Open
SSH
OpenSSH 7.2p2
8009
Open
AJP13
Apache Jserv (Protocol v1.3)
8080
Open
HTTP
Apache Tomcat 8.5.5
Port 6000
Checking for useragent on proxy
There is none, there for we will use BurpSuite to find other information that could be of value to us.
When we set the path to file, we get a 'try harder error message' when we set the path to the page itself we get that page by itself. Knowing this, we can use wfuzz to find internal ports.
username: admin
password: 3@g01PdhB!
Access gained, now that we have access, lets see if we can upload a shellaroo up inside this badboi.
Using MSFVenom
Exploring Tomcat after initial access we were able to find a .dit file and a .bin file from previous pentest data.
This is useful because:
ntds are stored on windows active directory controllers. Its what contains windows domain innformation including users and passwords.
Running file on the found files we learn that:
the .bin file is a MS Windows registry file. We can assume this is a system hive file which contains the boot key that allows you to decrypt the .dit file. Lets transfer these files over to our KALI machine.
After you transfer the files, use impacket to to parse critical information that could be of use to us.
Usernames of interest:
Administrator
atanas
Looking through files we were able to find a app.log file
Looks like we have remote code exeuction for versions less than 1.18. Which is the cas here.
Last updated
Was this helpful?