Here we are with our old friend Jenkins.
If you looked at the logo you kind of understood what you were getting yourself into.
Now this exploit is going to feel a little familiar because of Jenkins but there are paths that we have
not taken in this course and a little bit of modification to how we actually get there.
So I'm curious to see how you performed now this exploit itself does require a little bit of metal supply
and that's OK so we're going to use mostly here.
But what we're gonna do is we're going to get a low level Shell will escalate that shell up and then
we're going to perform our escalation completely.
So let's go ahead and take a look at the scan now the scan has port 80 open 3 3 8 9 and 80 80.
So go ahead and just go to those Web pages so we'll do is we'll go to port 80 and we'll go to port 80
80 and you could see that we have good old Bruce Wayne here and Alfred at Wayne Enterprises dot com.
So we've got perhaps a user name perhaps a couple of user names depending on how Capture the Flag.
This box really is.
And then we've got this admin portal.
So if we can't log in here then what we're gonna need to do is examine this further maybe we'll do some
sort of directory busting or look at the source code see where we need to go.
We can gather information here to perhaps see log in is Alfred.
Perhaps it's Bruce perhaps as this email.
So any sort of brute forcing that we might perform on this page.
It's possible.
However it's always worth just trying an avid and seeing where that gets you in life because you would
be very surprised.
I've seen this on bug bounties before where you just go and you type admin admin on a page and it loads
right up.
So that's easy right.
Now we're in here and we have the opportunity to look around just like we did before so we have this
build history we've got managed Jenkins we could look at different parts of this.
Remember last time we came in here we were able to do the groovy shell with the Jenkins CSI or the script
console and see if we can get a shell now we could try this one if we want but there was a suggested
path otherwise if we come into Alfred and we scroll down a little bit you'll see that there is a suggested
path of using power shell in here maybe its initial access.
It says you should use power shell so it says use power shell to get this.
Now how are we going to do that.
Well if we go into build history and we look at project we could take a look at the job project and
then we could go over to configure so if we scroll through configure take a look at what we can do we
can run a command here look you can see execute windows batch command.
And here we've got who am I.
But why do we have to run.
Who am I.
Why can't we run a reverse shell.
So we'll cheat a little bit.
We'll just copy this and we're going to paces into here.
Now we need to invoke power shell TCB.
P.S. 1 What is this Will we go take a look.
This is Miss Shang if you've never seen this saying this is a very popular reverse shelf to go out to
Google and just put that in here and you'll see the shaking invoked power shell that piece won.
So we'll just go ahead and grab this the raw version copy it and then we'll open a new folder and we'll
just put this in and transfer and we will get it this really quick we'll call it what it is which is
invoke power shell DCP that P.S. One and paste in here and save.
All right.
So now we need to do is we need to say OK.
So we have our IP which I don't actually know my piece.
Let's grab our IP 10 to 11 but forward at 1 14.
So go ahead and do ten eleven dot forward 114 on port 80.
We're grabbing this then we need to do it reverse of our IP address and then the port.
So let's do a reverse of 10 dot 11 enough for it at 1 14.
Our port we could just do something like four four three would be fine and now let's go ahead and run
net cap on this.
So say net cat and the LP on 4 4 3 and we'll go ahead and save this let's make sure that we also have
our Python running.
Let's open up a new tab here and we're just going to say python on that and simple HBP server on Haiti
and then we're gonna go ahead and just say build now and it should go out and grab this from poor 80.
You could see the grab happen.
It should execute.
And here we are.
So now we say who am I and we are Alfred Bruce perfect.
So if we do a little bit of enumeration we can do a system info see where we're at.
2015 looks relatively newer doesn't mean that there's not exploits here available to us but you could
see that we are running on Windows 7 Ultimate Service Pack 1 Build 76 0 1 and we can do some basic commands
so who am I and we can look at the privacy which is important so we look at the privacy.
A lot of them are disabled.
But let's look at what's enabled debug to enable change notify impersonates enabled and create global
privilege.
So what I want to do is I want to look at the impersonate now not saying this is the first path you
should've taken.
This is the path that we're taking forward the video itself.
You should have ran all of your checks.
You should have run if you're power up or you're Sherlock or Windows XP suggests or when PS however
you wanted to approach this was absolutely the correct way.
I'm just moving forward just to save time.
Now eventually what it boils down to is this impersonate token and what we're gonna do is we're gonna
elevate to a mature critter shell and with that return British Shell we're gonna go ahead and pull up
a incognito and see where we can get with that so let's go ahead and go to a motel operator shell so
quickly what we're gonna do is we're gonna close out of here and we're just gonna say MSF venom we'll
do a payload of windows and interpreter
and we find the architecture on the system X 64 based.
So we're gonna need 64 bit architecture we'll do reverse TCB and we'll add in the 64 bit.
All right.
And then we'll say l host equals ten eleven forward 114 L four equals and we'll say seven seven seven
seven file type is executable and then we'll just put this into a shell we'll call Shell X that you
see just because I don't know if I have a shell in here I guess it really doesn't matter but I'll write
this out and then we're gonna go ahead and search you till this on over if we can or we can do a power
shell to grab so we'll can try a different technique if you want to grab with power shell.
So we'll do here is first let's go ahead and
start up MSF venom or MSF console.
We're gonna need to catch the shell with our multi handler
so we can say use multi handler
and then we're just gonna say set payload windows X 64.
INTERPRETER reverse DCP set.
Host to tend eleven up forward at 114.
Set our airport to all sevens and that should be good to run.
Let's check the options.
Looks good to me.
I'm going to run that now with our shell here.
We're in a power Shell Shell so we can quickly run some sort of power shell and I'm going to show you
an example really quick.
OK so we're gonna do is we're gonna go ahead and try to paste this in and it's just a basic power shell
man that says hey I want you to download this file off of this server and then I want you to save it
as Shell that XY.
Now what I'm gonna do is make sure that we are hosting this.
So let's go back and host this file and I'm going to run this command here.
Now you can find this command just by downloading or just by searching a basic download command.
And then once we download it all we have to do is do a start process to say start process and then we'll
say Shell X Di XY or shell that you see at this point sorry.
We'll see if you pop a shell
get you Aidid or Alpha Bruce.
So we have successfully brought the shell over.
So if this doesn't work for you for some reason you can also use web delivery and generate a power shell
exploit which may even be easier.
But here we are.
We're good.
Now let's go ahead and load up incognito and we could do to get prints here as well.
Don't forget about get Cribbs and you can see that we do have the impersonate available to us.
So with Incognito let's go ahead and list the tokens and you could see that we have a few different
tokens available to us.
One is the authority system.
So all I'm going to do is just copy the authority system and try to elevate into that so let's copy
that unless let's just say impersonate token and we'll paste this and see if it works OK.
And now we'll say get you I.D. and now authority system.
If we drop into a shall see if it works case we have an issue creating a shell here.
So let's do a quick P.S. And look at what's going on.
It could be that our shell that we're on is not not working for us.
So let's try to migrate off of what we're on right now into a different service.
So let's go ahead and just say migrate 30 32 and see if that works for us.
Unfortunately that failed and that does happen sometimes.
So let's go ahead and rerun this and it should be straightforward and we'll just have to find another
process to run into
and I'm I'm going to hunt down the SBC hosts.
So we're going to try to go into anything that's running as authorities system the next one that I see
as SBC host is thirty six.
So we can try to migrate into that.
See if that works
and now it completed successfully get you I.D. let's see if we are tried typing shell and now we have
a shell.
Who am I.
Authority system.
So let's retrace that really quick just to make sure we're on the same page.
Sometimes when we have a shell even though we are showing as authority system we're not fully on the
authority system.
If we type in Shell and we can't drop into the channel we're having some issues.
So we have limited commands because of that we need to migrate off of what we're at.
So we're on.
Originally this 28 16 this shell and we're on the shell even though we elevated as as Bruce so we elevated
from Bruce to authority system.
We're still stuck here on this shell.
So we're still kind of in this weird place.
We need to move off of this.
So I was looking for different SBC hosts because they're pretty reliable that are running as authorities
system because that's who we are who we want to be.
And we were able to migrate into 17 36 so it's patients with migration sometimes it works sometimes
it doesn't.
Here we are we got it to work and we elevated.
So let's take this and think about it really quick.
We have gone through yet another type of Jeeves exploit their Jenkins exploit.
Right.
We did Jeeves and now we've done this Jenkins slash Alfred box and it was a different path.
Just a little bit different path but something that you should have gotten something that you've seen
before.
And then when we got to this potato or net potato when we got to this impersonation exploit.
Not all potatoes when we got to this Incognito exploit which is again very very possible from a real
world perspective.
I love incognito.
It's a great tool it's comes up on interviews so it's definitely important to know we came across sex
boy and we were able to utilize it to move into another user so that delegate token was available to
us we migrated into that delegate token and or you personally that delegate token and then we were able
to migrate into a different PPD and successfully captured authority system.
So we are done with three boxes now we've got two left to go so from here we're gonna go ahead and take
on Bastion from hack the box.
So it's getting a little bit harder but we're almost through this capstone so I'll catch you over as
we walk through bastion in the next video.