dreadnaught- Machine
- Jerry
- OS
- Windows
- Difficulty
- Easy
- Steps
- 2
- Added
- 30 Jun 2018
Apache Tomcat Manager still has its default tomcat:s3cret login; a deployed WAR shell runs as SYSTEM.
How it went
- 0nmap
nmap shows only Apache Tomcat 7.0.88 on 8080.
- 1Tomcat manager
The Tomcat Manager accepts the stock tomcat:s3cret credentials.
- 2WAR shell
A JSP WAR deployed through the manager returns a shell as SYSTEM; both flags sit in one file.