CyberLens
This room was created by Tyler Ramsbey

CyberLens

Eduardo Cochella Eduardo Cochella

Eduardo Cochella

MSc. Electrical engineering | Penetration tester | Ethical Hacker | Network engineer | Red Team | Cyber researcher | Top 1% TryHackMe | Top 1% Hack The Box | CTF Player

Published May 23, 2024
+ Follow

Enumeration

Article content
Don't forget to manually define the IP addresses associated with the specific hostname
Article content
After a deep scanning, we got some information about the Ports and Services that are running.
Article content
Our first approach would be Port 80 where we found an interesting Metadata analyzer. Let's check the source code for more information.
Article content
There's an interesting JavaScript function that shows Port 61777 available. It seems that the information about the metadata goes directly there. Let's look what is the content of
Article content
It is an Apache Tika 1.17 Server
Article content
The version is vulnerable to Header Command Injection. Let's open Metasploit Framework.

Exploitation

Article content
This module exploits a command injection vulnerability in Apache Tika 1.15 - 1.17 on Windows. A file with the image/jp2 content-type is used to bypass magic bytes checking. We create a Meterpreter Session.
Article content
Meterpreter Session
Article content
And our first flag under CyberLens User.

Privilege Escalation

Article content
For the priv. escalation part, it is possible to use WinPeas or some other tool. In this case, I'm using the local exploit suggester from Metasploit Framework to verify if its possible to escalate our privileges.
Article content
We run the exploit in our Session 1, and now we are nt authority\system. Let's grab the last flag.
Article content














To view or add a comment, sign in

More articles by Eduardo Cochella

  • Ledger - Tryhackme
    May 6, 2025

    Ledger - Tryhackme

    Nmap Enumeration We are definitely facing a Domain Controller. Domain Controller After digging into ports 80 and 443…

  • Billing
    Mar 10, 2025

    Billing

    Enumeration: After running a simple service - version scan, we discovered three ports open. Port 22-ssh, 80-http…

  • You Got Mail
    Feb 10, 2025

    You Got Mail

    Enumeration Let's start this room by running Nmap. We can see the smtp, pop3 and imap are in the server.

  • Lookup - TryHackMe
    Nov 26, 2024

    Lookup - TryHackMe

    Basic Scan: SSH and HTTP are running. NMAP basic scan Analyzing the Web Application: We had to deal with a login page.

  • Cheese CTF
    Sep 25, 2024

    Cheese CTF

    NMAP enumeration It seems the all ports are running. Checking port 80, we found that a web application is running.

    1 Comment
  • Attacktive Directory
    Aug 22, 2024

    Attacktive Directory

    NMAP enumeration shows up an Active Directory environment - Kerberos Port 88 DNS_Domain_Name: spookysec.local User…

  • Injectics
    Jul 30, 2024

    Injectics

    Enumeration Ports 22 and 80 are open Web Application running on port 80 Checking the source code, we found an…

  • New York Flankees
    Jul 15, 2024

    New York Flankees

    Enumeration Port 22 and 8080-http are open Checking the request, we found a script function that leaks a token. Custom…

  • CREATIVE
    Apr 16, 2024

    CREATIVE

    Enumeration Ports 22 and 80 are open Web App Analysis - Nothing interesting Let's look for some subdomains -…

  • Hack Smarter Security
    Mar 21, 2024

    Hack Smarter Security

    Enumeration Ports 21, 22, 80, 1311, and 3389 are open Checking port 21 we found some Credit Cards and a Stolen Passport…

    1 Comment
See all articles

Insights from the community

Others also viewed

Explore topics