✅Jerry (Easy)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Default Credential
System Vulnerable: 10.10.10.95
Vulnerability Explanation: The machine is misconfigured on set the default credential which could allow us to login and deploy reverse shell payload and gain access on the machine.
Privilege Escalation Vulnerability: N/A
Vulnerability Fix: Be aware of Default Credentials and Least privilege User.
Severity: Critical
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 8080 Apache-Coyote/1.1
by going through port 8080, we see a Tomcat webpage.
Let find hidden directory with gobuster.
On /manager, it requires username and password to login. By searching on google, we can see a list of credentials and we can try all of them.
We found a valid one is tomcat / s3cret.
Exploitation
On the application, we found we could upload file to deploy it which we could generate reverse shell and upload to the application.
Let start our netcat listener on port 4444 and execute the shell.
Last updated