Jeeves is a retired medium-difficulty Windows machine and my second box from the CPTS Preparation Track on HackTheBox Labs. The path starts with an unauthenticated Jenkins instance and continues through a KeePass database, Pass-the-Hash and an NTFS Alternate Data Stream.

🕵️ Enumeration

After spawning the machine and connecting to the HTB Labs VPN, I started with a full TCP port and service scan:

🔍 Initial Nmap Scan

nmap -Pn -sT -sC -sV -p- --open --min-rate 1000 -T4 \
  <TARGET_IP> \
  -oA nmap/jeeves-full

The options used here are: