Vulnerabilities
Apache
I will start by checking out the webserver from a browser.
http://[Target IP]:8080
Looks like I get the default web page for Apache Tomcat version 7.0.88.
Let's see if we can find any vulnerabilities for it.
Meterpreter
I'll start with looking through metasploit.
Exploit 28 looks like it could be something so I will check that one out.
Checking out the link for exploitDB gives us some info on the exploit.
It looks like the exploit "should" work.
Unfortunately, after inputting the options for the exploit and checking it, it comes back as not exploitable. Let's try some of the others.
After doing some further enumerating, I got some credentials that I can use with one of the metasploit exploits. tomcat:s3cret
Set the options to the correct parameters.
And now we have a reverse shell into the system.
We also have administrator priveleges.
Now we can just navigate over to the administrator's profile to find a single text file with both flags.
User Flag
Root Flag
Last updated