HTB Windows Easy: Jerry

Nmap scan

Initial Foothold

Web enumeration (port 8080)

The /manager directory is found whilst doing directory busting.

Visiting /manager results in a basic HTTP auth login prompt.

The default credentials work to login tomcat:s3cret, in Metasploit we can use these credentials for an authenticated upload code execution vulnerability.

Gain shell using metasploit

Select and configure exploit.

Run the exploit to gain a shell.

Get the flags.

You have PWNED!!!

Sources

• Tomcat credentials