Jerry – No Metasploit

Yeah… that’s definitely not the Jerry I remember from Tom and Jerry. Anyway, let’s get started with our usual portscan:

Okay. Let’s look at some other enumeration scans, namely gobuster on port 8080 and nikto:

Hmm. Ok interesting… So we can use PUT and place a malicious file on the server…? But let’s see if there’s another way to get into this box:

Ooh Apache Tomcat! Pretty familiar with this. Using default creds: tomcat and s3cret, we get in.

Scrolling down, we see we can upload a .war file.

Too easy. We can generate a war file with msfvenom to get a reverse shell:

Clicking the link navigates us to our war file which triggers the reverse shell

NT AUTHORITY\SYSTEM shell! A bit anti-climactic but oh well. Getting the flags, we see that this was the intended way because we have “2 for the price of 1.txt” for the flags: