Hack The Box Jeeves Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Jeeves machine on Hack The Box. This one illustrates the dangers of leaving applications running with default configurations. Let’s get into it. 🍾 🙌 🎉

First, let’s enumerate open ports and running services on the target.

1┌──(root㉿kali)-[/home/kali/Desktop/Jeeves]└─# nmap --min-rate 7000 -p- -sS -sV 10.10.10.63 -Pn -o firstnmap-nmap.txtStarting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-23 12:34 ESTNmap scan report for 10.10.10.63Host is up (0.096s latency).Not shown: 65531 filtered tcp ports (no-response)PORT      STATE SERVICE      VERSION80/tcp    open  http         Microsoft IIS httpd 10.0135/tcp   open  msrpc        Microsoft Windows RPC445/tcp   open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)50000/tcp open  http         Jetty 9.4.z-SNAPSHOTService Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windowsService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 27.58 seconds

Let’s check out the web app on port 80.

Trying a keyword search always throws an error message. I threw it at a fuzzer but found nothing interesting.

Moving to port 50000, we get a blank snapshot page.

Running Gobuster against that port reveals the /askjeeves/ directory.

1┌──(root㉿kali)-[/home/kali/Desktop/Jeeves]└─# gobuster dir -u http://10.10.10.63:50000 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt===============================================================Gobuster v3.6by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)===============================================================[+] Url:                     http://10.10.10.63:50000[+] Method:                  GET[+] Threads:                 10[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt[+] Negative Status codes:   404[+] User Agent:              gobuster/3.6[+] Timeout:                 10s===============================================================Starting gobuster in directory enumeration mode===============================================================/askjeeves            (Status: 302) [Size: 0] [--> http://10.10.10.63:50000/askjeeves/]Progress: 149760 / 207644 (72.12%)^C[!] Keyboard interrupt detected, terminating.Progress: 149790 / 207644 (72.14%)===============================================================Finished===============================================================

The application is a Jenkins instance left running with default settings. Default credentials get us in.

From the Jenkins Script Console we can execute Groovy scripts. We use this to get a reverse shell.

With an initial foothold established we move to privilege escalation. The system has a KeePass database we can access.

Cracking the database gives us an NTLM hash. We pass it via psexec.py and land a shell as SYSTEM.

Root flag captured. Thanks for reading, happy hacking! :)