Jeeves HTB
IP
10.10.10.63initial Nmap scan
sudo nmap -sV -sC -A -oA inital_nmap 10.10.10.63Full Nmap scan
nmap -p- -sV -oA nmap_full 10.10.10.63Nothing to interesting
While we wait for the full scan to complete, we'll work off the initial scan
Ports open
80: HTTP Microsoft IIS 10.0
135: RPC
445: SMB
5000: HTTP Jetty(9.4.z-SNAPSHOT)
SMB
checking if SMB has anonymous authentication
it does not
Port 80 HTTP
the first thing we see is some kind of search engine
Lets do some dir busting and see if we can discover anything interesting
we dont find anything interesting
catching a request with burp shows nothing interesting we are redirected to a /error.html
But we do see the following
this doesn't seem right, could be a rabbit hole
port 50000 HTTP
When we navigate to port 50000 we can see the following
Not a lot going on here lets perform some directory busting and see if we can find anything interesting
we do find an interesting directory
Looks like we Jenkins running on the server
Jenkins
What is jenkins
an open-source continuous integration/continuous delivery and deployment (CI/CD) automation software DevOps tool is written in java
from the initial home page, we can see the version
Jenkins ver: 2.87
if we refer to
we can see this version of Jenkins, we can take advantage of the script console and groovy to generate a reverse shell onto the target machine
Let's just confirm this and see if we can execute cmd.exe
as we can see we have code execution on the system
First lets prepare our reverse shell
well use the nishang repo
copy the
Invoke-PowerShellTcp.ps1into our working directory (or where you will transfer from)
Within the
Invoke-PowerShellTcp.ps1we want to edit the script
Notice at the bottom of the script we added the actual command to execute it with the IP and port we wish to connect from, this little command will execute first giving our script our IP address and Port number to establish the connection
Let's start up our python server read to transfer the file and execute it
Start our netcat listener
Now lets pickup our Powershell script and execute it, in the script console
Once we run the console we can see we have a shell on the system
Privilege escalation via kohsuke
Alright let's get some information about the system
systeminfo
well copy and paste this into systeminfo.txt and run wes-ng against it and see if we can find priv esc exploit
first let's update wes
Now let's run it against systeminfo.txt
we do have a number of exploits we could possibly use but will keep this in our back pocket
Let's see what other users are on the machine
Nothing too interesting here
user privileges
possible rotten potato attack, again back pocket
Within the C:\Users\Administrator.jenkins we do find secret.key
Running the hash through hash-identifier we can see it is most likely a sha-256 hash, lets try and crack it
hmm can't crack it
within the C:\Users\Administrator.jenkins\users\admin we do find a config.xml file which contains
API token
and a password hash
Let's see if we can crack it
While we wait for the hash lets keep hunting around
Managed to escalate privileges for the hash cracked
In C:\Users\kohsuke\Documents we do find a keepass file, this is interesting let's download this onto our local machine
to download the file to our local machine
Let's set up an SMB server on our local machine
Target machine
Now we have the CEH.kdbx file on our local machine
we can download the keepass password manager onto our local machine
When we try to open the CEH.kdbx file, we are prompted for a master password
what we can do is use keepass2john to convert the KeePass database files into a format that can be cracked with John
Now we can run john against our new hash
we have the password
Lets open our kdbx file again
enter the password
passwords
Looks like we have an NTLM hash for Backup stuff
and a domain/username
what we can do is utilise the pth-winexe to perform a pass-the-hash attack gaining a shell on the system
then we can pass the Backup stuff hash, as this seems to be the only hash in the password database
we have successfully passed the hash using the administrator NTLM hash
Reading the Flag
Notice the C:\Users\Administrator\Desktop we can't seem to find the root.txt flag
this is because the hm.txt is an NTF attribute that supports various attributes including a Hidden attribute meaning you can hide another file within another so essentially this hm.txt acts like a folder as it does as a file but if
We can view alternative data streams revelling the hidden file
and to read the contents of the file we can use PowerShell for this
Last updated