> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/tony-the-tiger.md).

# Tony The Tiger

![](/files/-MczJwhb8kLZq9U4tJJH)

## Support Material

![](/files/-MczKZV95onmcJ6DWWq7)

![](/files/-MczKnpolkk-9QHNM08r)

![](/files/-MczLJzkfa7lKlDsgn0-)

## Reconnaissance

Lets run nmap scans to find open ports and services

![](/files/-MczLmPw_WYnrObP-_vR)

![](/files/-MczLwb1Splz9rInw4kG)

![](/files/-MczM0WKbkubdXYSGLrL)

![](/files/-MczMdzMejPZzRp_1yiT)

## Find Tony's flag

Lets visit the webpage

![](/files/-MczNL5LS0q329y5lVOj)

Reading the blogs, we can read that the photos might have a deeper meaning to them, so lets download the images to our machine and use our `steganography` skills to find hidden information in the images.

The first image can be found when we click read more on the second blog

![](/files/-MczNkBeY5yfYAs53SvD)

And the next picture can be found on the first blog

![](/files/-MczNqNHGyyPFgMNifwv)

We can go to the source code and the get the location of the images so that we can download them to our machine

![](/files/-MczOlyO4y1jo6tM0vik)

We get nothing with `steghide`

![](/files/-MczPA895dTWQwpdjglX)

Lets use the `strings` command

![](/files/-MczPMepVaSF4ciBeAYu)

We have the flag

## Exploit

![](/files/-MczPaT-6BAHiCWUIVsN)

Once downloaded, lets unzip this file

![](/files/-MczQ3prI_rn6V3HWf84)

Lets now go check out the application running on port 8080

![](/files/-MczRCXhgjnZs3_nchzf)

Its called `JBoss`. Lets try to login , lets click Administration Console

![](/files/-MczRSwbBC72YIcSk2qe)

We do not have credentials so lets go to google and look for default creds and see if they work.

![](/files/-MczRmgcYTgoFFFK6_s_)

Lets see if these work

![](/files/-MczRs5Zx5X47nof3xcN)

And they do , we are logged in. Lets go to Google to look for vulnerabilities for the application.

![](/files/-MczT5U1bv47JNCU41vu)

Lets clone this github repo and use this tool

![](/files/-MczTCIztsMKwRrk01OP)

We have some requirements that we need to download, so lets do that

![](/files/-MczTiEih95u22S43jRF)

Lets run the exploit

```
python jexboss.py 10.10.121.22:8080
```

![](/files/-MczUA9nbPvPUIh-X3Pu)

We can run command on the machine, lets run a reverse shell script to get a reverse shell on the machine.

Lets first start a Netcat listener

![](/files/-MczUxgrzw_Bbx-IFP1d)

Lets now run the command

![](/files/-MczV7vxae7H3fKykkZZ)

![](/files/-MczVBCXLJcEZmndWFoL)

We have a shell on the machine, lets stabilize the shell

![](/files/-MczVMd0-TikbMsGmRCK)

Looking through the machine, we see this interesting file

![](/files/-MczVfZRRt2OV-xg67Vo)

We have the password for the user `JBoss`, lets switch users

![](/files/-MczVshIxm3gD5t3FKUC)

## Privilege Escalation

Lets run `sudo -l` to see what we can run as other users

![](/files/-MczWCBBRzeScb6BSpCs)

Looks like we can run the `find` command. Lets go to [GTFOBins ](https://gtfobins.github.io/gtfobins/find/#sudo)and find the command to get root on the machine.

![](/files/-MczWYiLnV1cG2odPcv5)

Lets run this command

![](/files/-MczWaqV7AZ_Ju7B5gs8)

We are root.

The flag for task 6 can be found here

![](/files/-MczWsGpSQ_YvTirmuKH)

And the final flag here

![](/files/-MczWzNXm9krWWbAxTSx)

Its base64 and md5 encoded so you can decode it on your own :)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://writeups.adityadindi.com/tryhackme/untitled/tony-the-tiger.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.