Jerry
Super Easy Windows HTB Box recommended for beginners
Reconnaissance
As often, we start off by a port scan using Nmap
We see that only one port is opened on the target system: TCP 8080 (HTTP) And we also see it's running the Apache Tomcat CMS, visiting the webpage with our browsers we see the typical Tomcat dashboard
We check the "Manager App" section, where we login into the admin panel with the default credentials tomcat:s3cret
We can see we are able to uploada .WAR file so we proceed to generate a malicious Reverse Shell WAR File with msfvenom
Exploitation
We set up our listener, upload the file and access it and we successfully get a reverse shell on our system
We also see that both of the flags are accessible on the C:\Users\Administrator\Desktop directory as "2 for the price of 1.txt" so we just retrieve them!
Last updated