> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/tony-the-tiger.md).

# Tony The Tiger

![](/files/-MczJwhb8kLZq9U4tJJH)

## Support Material

![](/files/-MczKZV95onmcJ6DWWq7)

![](/files/-MczKnpolkk-9QHNM08r)

![](/files/-MczLJzkfa7lKlDsgn0-)

## Reconnaissance

Lets run nmap scans to find open ports and services

![](/files/-MczLmPw_WYnrObP-_vR)

![](/files/-MczLwb1Splz9rInw4kG)

![](/files/-MczM0WKbkubdXYSGLrL)

![](/files/-MczMdzMejPZzRp_1yiT)

## Find Tony's flag

Lets visit the webpage

![](/files/-MczNL5LS0q329y5lVOj)

Reading the blogs, we can read that the photos might have a deeper meaning to them, so lets download the images to our machine and use our `steganography` skills to find hidden information in the images.

The first image can be found when we click read more on the second blog

![](/files/-MczNkBeY5yfYAs53SvD)

And the next picture can be found on the first blog

![](/files/-MczNqNHGyyPFgMNifwv)

We can go to the source code and the get the location of the images so that we can download them to our machine

![](/files/-MczOlyO4y1jo6tM0vik)

We get nothing with `steghide`

![](/files/-MczPA895dTWQwpdjglX)

Lets use the `strings` command

![](/files/-MczPMepVaSF4ciBeAYu)

We have the flag

## Exploit

![](/files/-MczPaT-6BAHiCWUIVsN)

Once downloaded, lets unzip this file

![](/files/-MczQ3prI_rn6V3HWf84)

Lets now go check out the application running on port 8080

![](/files/-MczRCXhgjnZs3_nchzf)

Its called `JBoss`. Lets try to login , lets click Administration Console

![](/files/-MczRSwbBC72YIcSk2qe)

We do not have credentials so lets go to google and look for default creds and see if they work.

![](/files/-MczRmgcYTgoFFFK6_s_)

Lets see if these work

![](/files/-MczRs5Zx5X47nof3xcN)

And they do , we are logged in. Lets go to Google to look for vulnerabilities for the application.

![](/files/-MczT5U1bv47JNCU41vu)

Lets clone this github repo and use this tool

![](/files/-MczTCIztsMKwRrk01OP)

We have some requirements that we need to download, so lets do that

![](/files/-MczTiEih95u22S43jRF)

Lets run the exploit

```
python jexboss.py 10.10.121.22:8080
```

![](/files/-MczUA9nbPvPUIh-X3Pu)

We can run command on the machine, lets run a reverse shell script to get a reverse shell on the machine.

Lets first start a Netcat listener

![](/files/-MczUxgrzw_Bbx-IFP1d)

Lets now run the command

![](/files/-MczV7vxae7H3fKykkZZ)

![](/files/-MczVBCXLJcEZmndWFoL)

We have a shell on the machine, lets stabilize the shell

![](/files/-MczVMd0-TikbMsGmRCK)

Looking through the machine, we see this interesting file

![](/files/-MczVfZRRt2OV-xg67Vo)

We have the password for the user `JBoss`, lets switch users

![](/files/-MczVshIxm3gD5t3FKUC)

## Privilege Escalation

Lets run `sudo -l` to see what we can run as other users

![](/files/-MczWCBBRzeScb6BSpCs)

Looks like we can run the `find` command. Lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/find/#sudo)and find the command to get root on the machine.

![](/files/-MczWYiLnV1cG2odPcv5)

Lets run this command

![](/files/-MczWaqV7AZ_Ju7B5gs8)

We are root.

The flag for task 6 can be found here

![](/files/-MczWsGpSQ_YvTirmuKH)

And the final flag here

![](/files/-MczWzNXm9krWWbAxTSx)

Its base64 and md5 encoded so you can decode it on your own :)