2018 Derbycon CTF - Jenkins

Just like last year; the Derbycon CTF was awesome! I had the honor of competing on team illuminopi this year and we got second place.

Sitting next to and working with such highly skilled hackers was so fulfilling and rewarding it is easy to justify the means of getting there, staying awake for way too long, and even getting "iced" with a hot can of poison called Smirnoff.

Hot Poison

My goal for this year was to contribute over 5000 points and writeup at least one challenge where full exploitation was necessary. I met both of these challenges so without further ado, here's how we popped the Jenkins box.

Jenkins -  192.168.253.45

[1] Initial Recon:  nmap revealed 8080 and I browsed to the website.

 

Jenkins Login Page

[2] Create an account 

I followed the "create an account" link and filled out the form as seen below:

Create an Account

After the account was successfully created, the following page loaded:

Successful Account Creation

[3] Manage Jenkins

Under the "Manage Jenkins" menu selection, there is a function called "Script Console." Consoles are always interesting because it usually means that you can interact with the target in some way.

Manage Jenkins Utilities

The Script Console presented a text input box which is simply a web-based Groovy shell into the Jenkins runtime. Groovy can do things like read files, create sub-processes, and execute commands.

The following command was issued to read the /etc/passwd and similarly /home/jenkins/flag.txt files: 

def command = """cat /etc/passwd"""

def proc = command.execute()
proc.waitFor()
println "return code: ${ proc.exitValue()}"
println "stderr: ${proc.err.text}"
println "stdout: ${proc.in.text}"

You had to scroll down a little bit, but the output returned looked like this:

Found Flag in /etc/passwd

At this point, a web_delivery shell could have been launched, or some other payload, but I opted to use the multi/http/jenkins_script_console metasploit module.

[4] Exploiting Jenkins with Metasploit

Jenkins_script_console Module Options

Meterpreter Session

[5] Privesc

From within my meterpreter session, I dropped to a shell and issued the "sudo -l" command which returned the following:

Jenkins User May Use Sudo to Less the Syslog File 

I then used Less to start a shell:

Root Shell Obtained

[6] Pillage!

At this point it was time to try and find all five (5) flags hidden on the box. 

/etc/passwd - KristyAreYouDoingOkayRd3KPP6acM5zjSD9
/home/jenkins.flag - WhyDon'tYouGetAJobwmjz9WPHQTd7paPx
/root/.bash_history - Nevergonnafindmep26nFMWDraFnzHxW
/var/lib/jenkins/users/admin/config.xml - GiveItToMeBabyUh-huhUh-huhHRuttS7g6Hxv3QSr
Fifth flag was not found or otherwise missed. For example; we cracked the ctf user's password but I'm not sure it was tried as the fifth flag. 

If you ever have the chance to attend Derbycon - I highly recommend spending some time at its CTF. Even though "yee-haw" was borked, there was no shortage of claps, high fives, and that oh so nice rush of capturing the flag.

-strupo_