Category: Fullpwn

Solver: lmarschk

Flag: HTB{c1_cd_c00k3d_up_1337!}


When scanning the machine, we get the following results

Nmap scan report for
Host is up (0.036s latency).
Not shown: 65532 filtered ports
80/tcp   open  http    Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Mega Engines
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8080/tcp open  http    Jetty 9.4.43.v20210629
| http-robots.txt: 1 disallowed entry
|_http-server-header: Jetty(9.4.43.v20210629)
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 109.79 seconds

When looking at port 8080, we find a Jenkins with an open registration form. When registering there, we can create a new project via New Item -> Freestyle Project.

After Job creation, we can add a build step named Execute Windows batch command. With this we can execute single commands on the host system as the Jenkins is configured to run jobs as oliver.

To trigger running of the job, we have to enable Trigger build remotely. Therefore, we add an authentication token to trigger a single build. We set the token to token, so our URL is

The output of the job script can be read via the Jenkins web ui. Via the output we are able to find the file C:\, which contains the flag.

Our full batch job script is:


dir C:\
dir C:\Users
dir C:\Users\oliver
dir C:\Users\oliver\Desktop
dir C:\Users\oliver\Documents

dir C:\Users\oliver\Desktop\user.txt

Further notes

By modifying the config file of Jenkins, it is also possible to get full administration access to the Jenkins platform. To achieve that, we have to modify the config.xml in the Jenkins configuration directory, which is available in the variable JENKINS_HOME by setting the value use-security to false. To apply these settings we have to restart Jenkins, which can be done by calling restart to jenkins.exe. Afterwards, the user created by us is essentially an admin user on Jenkins.

With that said, we are also able to execute Groovy scripts without invoking a job. Unfortunately as the machine blocks all outgoing network connections, we were not able to fetch any data from external sources or establish an reverse shell.