Jeeves
Nmap Scan
$ nmap -sC -sV -Pn -oN nmap 10.10.10.63
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-17 08:58 +08
Nmap scan report for 10.10.10.63
Host is up (0.034s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Ask Jeeves
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open http Jetty 9.4.z-SNAPSHOT
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Error 404 Not Found
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windowsGetting user
Port 80
There is a website on port 80.
However, after reviewing the source code, it seems that any input will be directed to error.html.
Directory Enumeration
After running gobuster with 2 different wordlist, there are no interesting result that is returned from the scan.
Virtual Host enumeration
Since we do not have the domain name for this target, we cannot do virtual host enumeration.
Port 50000
When we try to access port 50000, we are returned with this error.
Directory enumeration
Jenkins on Port 50000
So there is Jenkins page running on port 50000
After some enumeration on the website, we can see that there is script console feature under the Manage Jenkins tab.
Jenkins RCE using Groovy script
So by following the example on the website, we test if the following script will work before putting our actual payload.
Sure enough, this payload actually worked. This means we can put in our powershell one-liner reverse shell payload.
We will first craft the payload first using this python script
After generating the payload, we can just execute it with the same exact script but with some adjustments.
After running it, I am able to get a reverse shell out of it.
After going the kohsuke 's Desktop, we are able to see the user.txt flag.
Privilege Escalation
Keypass
After enumerating the target for a while, we can see that there is a keypass file on the user's document folder.
Next, we will try to crack the master password for this password file.
After we cracked the password file, these are the password that we have gathered.
We will then try the passwords on the Administrator user. However, none of the password works.
However, the last password looks very suspicious as it follows the format of a NTLM Hash. So we will try to pass the hash and see if it works. It turns out that it worked and we have the LM Hash for the Administrator.
So to get the shell, we will just use impacket-psexec to login as the Administrator user.
However, when we are at the Desktop, we will notice that the root.txt flag is not there, but instead there is a hm.txt there. It also tell us to look deeper, which could suggest alternate data stream (ADS).
Alternate Data Stream
Upon using dir /R we can see that the root.txt flag is hidden.
We can use the following command to get the content of the flag.
Last updated