TCM—BUTLER WALKTHROUGH

First, log in to the machine using the provided credentials. Open Command Prompt (CMD) and run the ipconfig command to identify the machine's assigned IP address.

Next, begin the enumeration phase by performing an Nmap scan against the target IP address to identify open ports, running services, and other useful information about the system.

Port 5040: Banner-grabbing attempts using Netcat and Nmap returned no useful information. Port 445 (SMB): SMB enumeration with smbclient was attempted but returned Permission Denied, revealing no accessible shares.

Port 8080: Found a Jenkins login page

After researching Jenkins exploitation techniques, I found a GitHub repo demonstrating how Groovy can be leveraged to establish a reverse shell. Since authentication is required, we'll attempt to gain access by testing credentials based on information gathered during enumeration and research.

To perform the brute-force attack, I used Burp Suite Intruder to configure a Cluster Bomb attack, using the identified username and password fields as the payload positions.

Launch Burpsuite & turn on proxy. Capture a POST request made when clicking login.

Notice near the bottom we have "j_username=admin" and "password=password". Right click on the captured request and select "send to Intruder". From within the Intruder tab click "Clear", then highlight the username value "admin" and click "add". Do the same for the password value. Towards to top of this screen choose the attack type: "Cluster bomb".

I created custom wordlists for both payload positions, using common usernames and passwords based on the information gathered during enumeration and research.

Once the attack starts, Burp Suite Intruder cycles through the configured username and password combinations. The custom Grep string flags responses containing "Invalid" with a value of 1. Requests without this indicator stand out as potential valid credentials, so review their responses to identify the successful authentication attempt.

Try the password combination found. You will be able to successfully log in using Jenkins: jenkins.

Recall the GitHub resource demonstrating how Groovy can be leveraged to establish a reverse shell. This is the technique we'll use for exploitation. Navigate to Manage Jenkins, scroll to the bottom of the page, and select Script Console.

The resource: https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76

Change the IP address in the payload to match your Kali machine's IP address. Set up a listener using Netcat or Metasploit's multi/handler, then execute the payload by clicking Run.

After clicking on run, we will have successfully established a connection

PRIVESC: To escalate our privileges, we'll be using a tool called WINPEAS. First of all, we navigate into our butler directory and use Certutil, a built-in Windows command-line utility used to manage, backup, and troubleshoot public key infrastructure (PKI) certificates to move winpeas from our attacker to our target machine

Run the WinPeas executable

Here we can see something came up for the unquoted service path. Let's look at the status of this service while we're in terminal.

PS C:\Users\butler\Desktop> Get-Service *Wise*

Status   Name               DisplayName
------   ----               -----------
Running  WiseBootAssistant  Wise Boot Assistant
#Service Path:
C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe

PS C:\Users\butler\Desktop> Get-Service *Wise*

Status   Name               DisplayName
------   ----               -----------
Running  WiseBootAssistant  Wise Boot Assistant
#Service Path:
C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe

Let's take advantage of this by creating a payload and placing it within the vulnerable service path. When the service starts, Windows searches each directory in the path for the required executable. If we have write access to one of these directories, we can place our own executable there, causing it to be executed when the service starts.

Navigate to the "Wise" directory in the path on the Butler system. Use Certutil to transfer the shell.

Run the executable

Stop the service then Restart It

Ensure your Meterpreter or Netcat listener is running before stopping and restarting the service. Once the service starts again, the payload should execute, providing a system-level shell on the target.

Thanks for Reading!