Jeeves — HTB Writeup | The Hack Sparrow

Executive summary — Jeeves is a Medium Windows box where port 80 is a decoy (an Ask Jeeves-style site with no vulnerabilities) and the real vector lives on the non-standard port 50000: a Jenkins instance with an unauthenticated Script Console, allowing arbitrary Groovy code execution on the server → immediate RCE (user flag). Enumerating the system turns up a KeePass database that, once cracked, holds an Administrator NTLM hash stored as a backup note: Pass-the-Hash gives SYSTEM access. The final twist: root.txt isn't where it looks — it's hidden in an NTFS Alternate Data Stream inside a decoy file.

Platform	Hack The Box
Operating system	Windows
Difficulty	Medium
Status	Retired
Target IP	`10.129.228.112`

Attack map

[1] Recon -- nmap -p- reveals 80 (decoy), 135 RPC, 445 SMB, 50000 (Jetty/Jenkins)
        |
[2] Jenkins on :50000/askjeeves/ -- Script Console with no authentication (Groovy)
      +-> immediate RCE as jeeves\kohsuke  ->  user.txt
        |
[3] Local enumeration -- CEH.kdbx (KeePass database) in Documents
      exfiltrated in base64 through the Script Console itself
        |
[4] keepass2john + hashcat -m 13400 -- master password: moonshine1
        |
[5] pykeepass -- "Backup stuff" entry holding the Administrator NTLM hash
        |
[6] impacket-psexec -hashes -- Pass-the-Hash -> nt authority\system
        |
[7] root.txt is not where it looks -- dir /R reveals an Alternate Data Stream
      (hm.txt:root.txt) -> more < hm.txt:root.txt  ->  root.txt

1. Initial reconnaissance

nmap -p- 10.129.228.112

-p- scans every TCP port (1-65535). Important: many HTB boxes hide the relevant service on a non-standard port.

80/tcp    HTTP
135/tcp   RPC
445/tcp   SMB
50000/tcp additional web service

nmap -sC -sV -p 80,135,445,50000 10.129.228.112 -oA scanresult

The service on port 50000 identifies as Jetty, the Java web server typical of applications like Jenkins.

Resumen ejecutivo — Jeeves es una Medium de Windows donde el puerto 80 es una distracción (una web tipo Ask Jeeves sin vulnerabilidades) y el vector real vive en el puerto no estándar 50000: una instancia de Jenkins con la Script Console sin autenticación, que permite ejecutar código Groovy directamente en el servidor → RCE inmediato (user flag). Enumerando el sistema aparece una base de datos KeePass que, tras crackearla, contiene un hash NTLM del Administrator guardado como nota de backup: Pass-the-Hash da acceso SYSTEM. El truco final: root.txt no está donde parece, sino oculto en un Alternate Data Stream (ADS) de NTFS dentro de un fichero señuelo.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.228.112`

Mapa del ataque

[1] Recon -- nmap -p- revela 80 (distraccion), 135 RPC, 445 SMB, 50000 (Jetty/Jenkins)
        |
[2] Jenkins en :50000/askjeeves/ -- Script Console sin autenticacion (Groovy)
      +-> RCE inmediato como jeeves\kohsuke  ->  user.txt
        |
[3] Enumeracion local -- CEH.kdbx (base de datos KeePass) en Documents
      exfiltrada en base64 via la propia Script Console
        |
[4] keepass2john + hashcat -m 13400 -- contrasena maestra: moonshine1
        |
[5] pykeepass -- entrada "Backup stuff" con hash NTLM del Administrator
        |
[6] impacket-psexec -hashes -- Pass-the-Hash -> nt authority\system
        |
[7] root.txt no esta donde parece -- dir /R revela un Alternate Data Stream
      (hm.txt:root.txt) -> more < hm.txt:root.txt  ->  root.txt

1. Reconocimiento inicial

nmap -p- 10.129.228.112

-p- escanea todos los puertos TCP (1-65535). Importante: muchas máquinas de HTB esconden el servicio relevante en un puerto no estándar.

80/tcp    HTTP
135/tcp   RPC
445/tcp   SMB
50000/tcp servicio web adicional

nmap -sC -sV -p 80,135,445,50000 10.129.228.112 -oA scanresult

El servicio en el puerto 50000 se identifica como Jetty, el servidor web Java típico de aplicaciones como Jenkins.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.