Builder
https://app.hackthebox.com/machines/Builder
Builder was a medium machine focused on Jenkins vulnerability.
Ports scan
Web page
Nmap scan found that port 8080 is running for Jenkins
Upon visiting the website, we found Jenkins dashboard and wapalyzer tells us the version.
Vulnerable Jenkins version
2.441
Web attack
The above link gives a better demonstration of how the attack works.
Let's downoad the jar file with:
Let's get file imp file contents now
Hmmm, we are just getting a single line.... We can use help and list all the commands to see what commands can help us to get how many lines.
My guess: the reason we have different size output with different command is because a particular command has that length of expected output size. I.e enable job i used above might give True or False or some other output that is of 1 line only.
Anyway let's continue with trying a perfect command that will result many lines. For this purpose I wrote a python script (yeah ippsec way didn't work for my shell)
I used and manually saved output in check file:
You can paste the commands in a file called check
I found out that
connect nodehas max number of output lines
we found 2 users
I tired to get ssh private key from this, but no luck
Hmm, not a user I suppose
Upon searching the directory structure of Jenkins and how it store files, I found this blog:
I could have done like ippsec way : To pull dockerfile and install jenkins and look at the directory structure, but I didn't wanna install things lol.
If we looked at
userspart in the blog
the
users.xmlfile seem intresting
We get the username:
jennifer_12108429903186576833Now we can get password inside file:
/var/jenkins_home/users/jennifer_12108429903186576833/config.xml
Password hash:
$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1aCrack hash with
johnTheRipper
Credentials:
jennifer:princess
User
Upon login the intresting url I found was: http://10.10.11.10:8080/manage/script
We can execute java code. Getting a shell code from https://www.revshells.com/
After executing Java #3 payload, i get the reverse shell
And now we can grab user.txt from /var/jenkins_home
I've looked inside credentials.xml file and found a hashed ssh private key
We can see the ssh hashed key can be decrypted using:
Going back to the script console we can run the command provided and get private key
Root
We can save and login root with the above key.
________________heapbytes's still pwning.
Last updated