Vulnerabilities
Last updated
Last updated
I will start by checking out the webserver from a browser.
Looks like I get the default web page for Apache Tomcat version 7.0.88.
Let's see if we can find any vulnerabilities for it.
I'll start with looking through metasploit.
Exploit 28 looks like it could be something so I will check that one out.
It looks like the exploit "should" work.
Unfortunately, after inputting the options for the exploit and checking it, it comes back as not exploitable. Let's try some of the others.
After doing some further enumerating, I got some credentials that I can use with one of the metasploit exploits. tomcat:s3cret
Set the options to the correct parameters.
And now we have a reverse shell into the system.
We also have administrator priveleges.
Now we can just navigate over to the administrator's profile to find a single text file with both flags.
Checking out the link for gives us some info on the exploit.
