> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/pn.md).

# -Pn

## Maquina

<figure><img src="/files/zrA5twRDY7NyS8XUimES" alt=""><figcaption></figcaption></figure>

## Escaneo

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT     STATE SERVICE REASON         VERSION
21/tcp   open  ftp     syn-ack ttl 64 vsftpd 3.0.5
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:172.17.0.1
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              74 Apr 19 07:32 tomcat.txt
8080/tcp open  http    syn-ack ttl 64 Apache Tomcat 9.0.88
|_http-title: Apache Tomcat/9.0.88
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: UnixPORT     STATE SERVICE REASON         VERSION
 open  http    syn-ack ttl 64 Apache Tomcat 9.0.88

```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u http://172.17.0.2:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2:8080
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/docs                 (Status: 302) [Size: 0] [--> /docs/]
/examples             (Status: 302) [Size: 0] [--> /examples/]
/manager              (Status: 302) [Size: 0] [--> /manager/]
/http%3A%2F%2Fwww     (Status: 400) [Size: 841]
/http%3A%2F%2Fyoutube (Status: 400) [Size: 841]
/http%3A%2F%2Fblogs   (Status: 400) [Size: 841]
/http%3A%2F%2Fblog    (Status: 400) [Size: 841]
/**http%3A%2F%2Fwww   (Status: 400) [Size: 841]
/External%5CX-News    (Status: 400) [Size: 795]
/http%3A%2F%2Fcommunity (Status: 400) [Size: 841]
/http%3A%2F%2Fradar   (Status: 400) [Size: 841]
/http%3A%2F%2Fjeremiahgrossman (Status: 400) [Size: 841]
/http%3A%2F%2Fweblog  (Status: 400) [Size: 841]
/http%3A%2F%2Fswik    (Status: 400) [Size: 841]
Progress: 220396 / 220561 (99.93%)
===============================================================
Finished
===============================================================
```

### Ftp

Como hemos visto con el escaneo de nmap, podemos acceder por ftp de manera anónima

<figure><img src="/files/o3M2gNYcAb1oxB5HhzWQ" alt=""><figcaption></figcaption></figure>

Tan solo hay un archivo `tomcat.txt`, el cual contiene un posible usuario `tomcat`

<figure><img src="/files/EhcD2sbRSEo2HxNC3Hsn" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dtCW5H6iDFo1qZPhlcFI" alt=""><figcaption></figcaption></figure>

### Web

Si entramos en los diferente directorios encontraremos un login en `/manager`

<figure><img src="/files/yVeQ66l8A71KmwwHwyXj" alt=""><figcaption></figcaption></figure>

Si intentamos entrar en los otros 2 directorios nos dará error

{% tabs %}
{% tab title="/examples" %}

<figure><img src="/files/OMQOdxzru7ctaYvp16nu" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="/docs " %}

<figure><img src="/files/mze4rtlW7O8yyWRD8BE4" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

Continuando con el panel de login, si hacemos un login incorrecto nos saldrá este error

<figure><img src="/files/vohjoL4L9jtHV46FTDi0" alt=""><figcaption></figcaption></figure>

## Explotación

Buscando encontré unas credenciales por defecto, en la pagina de [Hacktricks](https://book.hacktricks.xyz/v/es/network-services-pentesting/pentesting-web/tomcat#credenciales-predeterminadas)

<figure><img src="/files/X7Uowve6ZMmR9Pwk7Bqp" alt=""><figcaption></figcaption></figure>

Usando el usuario `tomcat` y la contraseña `s3cr3t` conseguimos entrar

<figure><img src="/files/3oNMSu0zYW2qwH60OLXF" alt=""><figcaption></figcaption></figure>

Vemos que hay un apartado de esta web que nos permite subir archivos WAR, si buscamos el primer enlace que nos aparece es a [Hacktricks](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat), donde encontramos una reverse shell de WAR.

<figure><img src="/files/GXQU3bXHorunPTxqdoX0" alt=""><figcaption></figcaption></figure>

Si la subimos la tendremos aquí:

<figure><img src="/files/Yt3wFguFIJfnz8Qhohtg" alt=""><figcaption></figcaption></figure>

Si entramos y estamos a la escucha obtendremos la reverse shell y seremos `root`

<figure><img src="/files/b2IFpWtgus8x6jlhw2A9" alt=""><figcaption></figcaption></figure>

## Conclusión

Una maquina muy entretenida, recomendada para gente que no sabia de la existencia de tomcat.&#x20;