Tabby — Attack Chain¶
Current Path (COMPLETE — rooted)¶
nmap (22, 80, 8080) → port 80 Mega Hosting site → news.php?file= LFI path traversal → read /etc/passwd → read tomcat-users.xml → tomcat:$3cureP4s5w0rd123! (manager-script, admin-gui) → WAR deploy via text-manager API → reverse shell as tomcat → find ash's 16162020_backup.zip → exfil over /dev/tcp → zip2john crack → admin@it → password reuse → su ash → user.txt → ash in lxd group → privileged Alpine container mounting host / → root.txt
Branch Points¶
- Port 80 vs 8080: 80 hosts the Mega Hosting PHP app (the LFI). 8080 hosts Apache Tomcat (manager apps). The LFI on 80 is the key to unlocking creds for 8080.
- vhost: site references
megahosting.htb→ added to/etc/hosts. - LFI target choice: Instead of chasing user SSH keys, pivoted to leaking the Tomcat creds file because 8080 (Tomcat manager) is a clear RCE path via WAR deploy.
- GUI vs API deploy (upcoming): creds have
manager-scriptnotmanager-gui, so the browser deploy page returns 403. Must use the/manager/text/deploycurl API.
Result¶
- User flag:
b732434208e8015102dba7937f074598 - Root flag:
80aa1fdd311ffa4ad9ab3f69bc01d645