> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/tony-the-tiger.md).

# Tony The Tiger

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczJt8hB2HNCVFjrHjZ%2F-MczJwhb8kLZq9U4tJJH%2Fimage.png?alt=media\&token=d750c9bf-a258-4e22-8401-e4a8e4ef827e)

## Support Material

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczJt8hB2HNCVFjrHjZ%2F-MczKZV95onmcJ6DWWq7%2Fimage.png?alt=media\&token=b4eea652-57fc-4977-a0bb-812c5bdc9f17)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczJt8hB2HNCVFjrHjZ%2F-MczKnpolkk-9QHNM08r%2Fimage.png?alt=media\&token=7d21024b-96c1-4c3b-90bb-7d2deb6d77f5)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczJt8hB2HNCVFjrHjZ%2F-MczLJzkfa7lKlDsgn0-%2Fimage.png?alt=media\&token=86860fcd-8617-45dc-8980-282485d40087)

## Reconnaissance

Lets run nmap scans to find open ports and services

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLME7ur-JDmPtoy7x%2F-MczLmPw_WYnrObP-_vR%2Fimage.png?alt=media\&token=08f93652-ced6-4270-a8c8-5484edd06690)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczLwb1Splz9rInw4kG%2Fimage.png?alt=media\&token=095672b3-b436-4148-bba4-542c8cf9dc2a)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczM0WKbkubdXYSGLrL%2Fimage.png?alt=media\&token=b6c053a6-3a84-429b-9fda-b457492482c9)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczMdzMejPZzRp_1yiT%2Fimage.png?alt=media\&token=2fde8a78-dabe-41d2-bbbe-fce955afdc2b)

## Find Tony's flag

Lets visit the webpage

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczNL5LS0q329y5lVOj%2Fimage.png?alt=media\&token=0ed8e7b9-0083-49fc-b9d6-316e46ffb8a9)

Reading the blogs, we can read that the photos might have a deeper meaning to them, so lets download the images to our machine and use our `steganography` skills to find hidden information in the images.

The first image can be found when we click read more on the second blog

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczNkBeY5yfYAs53SvD%2Fimage.png?alt=media\&token=b0662bc5-6d4e-4846-8f01-db8fc08ffdcb)

And the next picture can be found on the first blog

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczNqNHGyyPFgMNifwv%2Fimage.png?alt=media\&token=86526174-b63b-49da-8531-a22e148550c8)

We can go to the source code and the get the location of the images so that we can download them to our machine

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczLoHMn2itHbsp1JIf%2F-MczOlyO4y1jo6tM0vik%2Fimage.png?alt=media\&token=b4b5979d-b4cd-4680-be76-d036aab6075b)

We get nothing with `steghide`

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczPA895dTWQwpdjglX%2Fimage.png?alt=media\&token=832b453e-0d4c-4b18-85ed-d9d08b1a32c9)

Lets use the `strings` command

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczPMepVaSF4ciBeAYu%2Fimage.png?alt=media\&token=49f904f4-2333-45f7-9932-51ebe1093a9a)

We have the flag

## Exploit

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczPaT-6BAHiCWUIVsN%2Fimage.png?alt=media\&token=e5fdab2a-b7cf-48ba-8b92-378eee6cdc1f)

Once downloaded, lets unzip this file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczQ3prI_rn6V3HWf84%2Fimage.png?alt=media\&token=8f2ad272-8686-4cac-b98b-9fc68bf788bc)

Lets now go check out the application running on port 8080

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczRCXhgjnZs3_nchzf%2Fimage.png?alt=media\&token=dcdadb71-bd8e-4c42-8a60-8ef2ca73935c)

Its called `JBoss`. Lets try to login , lets click Administration Console

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczRSwbBC72YIcSk2qe%2Fimage.png?alt=media\&token=441ad726-44bc-418c-a09a-4ab694191d56)

We do not have credentials so lets go to google and look for default creds and see if they work.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczRmgcYTgoFFFK6_s_%2Fimage.png?alt=media\&token=9340a289-4b87-4c0c-8008-51e5b332d76d)

Lets see if these work

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczRs5Zx5X47nof3xcN%2Fimage.png?alt=media\&token=df54fbff-51ce-4e52-b6ae-d4547ad786d2)

And they do , we are logged in. Lets go to Google to look for vulnerabilities for the application.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczT5U1bv47JNCU41vu%2Fimage.png?alt=media\&token=4ee18cb1-044d-4ffa-ba77-15425ff35aea)

Lets clone this github repo and use this tool

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczOzQbANy0ND2Mz4LW%2F-MczTCIztsMKwRrk01OP%2Fimage.png?alt=media\&token=be0a657b-17d4-47e3-98c3-d53661891f1b)

We have some requirements that we need to download, so lets do that

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczTU2l2Esu1OZUjxVV%2F-MczTiEih95u22S43jRF%2Fimage.png?alt=media\&token=e31a628b-c4e1-4f0f-85c6-dcaca13d7655)

Lets run the exploit

```
python jexboss.py 10.10.121.22:8080
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczTU2l2Esu1OZUjxVV%2F-MczUA9nbPvPUIh-X3Pu%2Fimage.png?alt=media\&token=9a47f05d-ddd1-48b4-9c7d-fe92b30e7d15)

We can run command on the machine, lets run a reverse shell script to get a reverse shell on the machine.

Lets first start a Netcat listener

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczTU2l2Esu1OZUjxVV%2F-MczUxgrzw_Bbx-IFP1d%2Fimage.png?alt=media\&token=a6e3ecd0-aa7a-4577-a052-c696d68f8c0e)

Lets now run the command

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczV7vxae7H3fKykkZZ%2Fimage.png?alt=media\&token=f3a33750-34b0-48bf-949f-cf5c0906924d)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczVBCXLJcEZmndWFoL%2Fimage.png?alt=media\&token=33a6399a-3ffe-4aba-bae3-3e980da9c890)

We have a shell on the machine, lets stabilize the shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczVMd0-TikbMsGmRCK%2Fimage.png?alt=media\&token=29647a1f-72f6-4fe1-8ecb-1dc0672108cc)

Looking through the machine, we see this interesting file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczVfZRRt2OV-xg67Vo%2Fimage.png?alt=media\&token=20edbe19-ac95-404e-b0d8-946ce8c6fd8d)

We have the password for the user `JBoss`, lets switch users

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczVshIxm3gD5t3FKUC%2Fimage.png?alt=media\&token=863240cd-0663-4e21-95e4-7487be273378)

## Privilege Escalation

Lets run `sudo -l` to see what we can run as other users

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczWCBBRzeScb6BSpCs%2Fimage.png?alt=media\&token=9d86af8c-237c-4339-a6eb-6451deaa1ea7)

Looks like we can run the `find` command. Lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/find/#sudo)and find the command to get root on the machine.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczWYiLnV1cG2odPcv5%2Fimage.png?alt=media\&token=9fd49045-0f98-403c-b821-06e122458d3a)

Lets run this command

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczWaqV7AZ_Ju7B5gs8%2Fimage.png?alt=media\&token=23d7a716-3b7f-4480-aa14-0bf37ab4d54a)

We are root.

The flag for task 6 can be found here

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczWsGpSQ_YvTirmuKH%2Fimage.png?alt=media\&token=d9514c38-d476-41a2-9b3a-ec69ac250dd2)

And the final flag here

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MczUzzcSkBKGVpMWsrC%2F-MczWzNXm9krWWbAxTSx%2Fimage.png?alt=media\&token=44b1f1ea-817f-442a-b835-04ab8d899dfe)

Its base64 and md5 encoded so you can decode it on your own :)