/tags/pass-the-hash/ Recent content in Pass-the-Hash on v4lle's Blog Hugo en-US Fri, 04 Sep 2026 00:00:00 +0000 /posts/jeeves/ Fri, 04 Sep 2026 00:00:00 +0000 /posts/jeeves/ <p><img src="/posts/jeeves/jeeves.png" alt="jeeves"></p> <p><strong>Jeeves</strong> is a retired medium-difficulty Windows machine and my second box from the CPTS Preparation Track on HackTheBox Labs. The path starts with an unauthenticated Jenkins instance and continues through a KeePass database, Pass-the-Hash and an NTFS Alternate Data Stream.</p> <hr> <h2 id="-enumeration">🕵️ Enumeration</h2> <p>After spawning the machine and connecting to the HTB Labs VPN, I started with a full TCP port and service scan:</p> <h2 id="-initial-nmap-scan">🔍 Initial Nmap Scan</h2> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">nmap -Pn -sT -sC -sV -p- --open --min-rate <span class="m">1000</span> -T4 <span class="se">\ </span></span></span><span class="line"><span class="cl"><span class="se"></span> &lt;TARGET_IP&gt; <span class="se">\ </span></span></span><span class="line"><span class="cl"><span class="se"></span> -oA nmap/jeeves-full </span></span></code></pre></div><p>The options used here are:</p>