Thompson — TryHackMe — WriteUp

Hello. I’m Rahmos. Here is my Thompson — TryHackMe — WriteUp. Check it out!

First, deploy the machine and nmap for opend ports.

nmap -A -T4 -p- -v <ip>

There’re 3 ports opened: 22(ssh), 8080(http) and 8009(ajp). Let’s access its website via port 8080.

It’s a default Apache website. I’ve checked the page source but nothing valuable. Now I’ll scan for hidden dirs using gobuster

gobuster dir -u http://<ip>:8080 -w /path-to-wordlist

There are 2 folders suspicious: /host-manager and /manager

First let’s access /manager

It will prompt for username and password. I haven’t known yet, so I click cancel. And surprisingly, it led me to a default credential:

Well let’s try again with tomcat:s3cret

Boom! I’m in. Also try this credential for /host-manager and still successful.

Now I’ll find a way to upload a reverse shell into the webserver and gain access. There are 2 ways to do this: gain a shell directly via metasploit, or use metasploit to generate a .war shell and access via browser.

*Why .war but not .php? Because:

I will use the 1st way.

Start metasploit:

msfdb init && msfconsole

Then search for tomcat exploit:

search tomcat

Now I found a module to use.

use 17

In order to exploit, you need to specify the username and password of tomcat, which is tomcat:s3cret, RHOSTS, which is the machine ip, and RPORT to 8080. And also, change LHOST to your VPN ip.

After everything is set, run