Jeeves is a retired medium-difficulty Windows machine and my second box from the CPTS Preparation Track on HackTheBox Labs. The path starts with an unauthenticated Jenkins instance and continues through a KeePass database, Pass-the-Hash and an NTFS Alternate Data Stream.

🕵️ Enumeration

After spawning the machine and connecting to the HTB Labs VPN, I started with a full TCP port and service scan:

🔍 Initial Nmap Scan

nmap -Pn -sT -sC -sV -p- --open --min-rate 1000 -T4 \
  <TARGET_IP> \
  -oA nmap/jeeves-full

The options used here are:

Fluffy is an Easy-rated Windows machine and my first box from the new CPTS Preparation Track on HackTheBox Labs. It’s a great box if you want to get hands-on with modern Active Directory attacks. We start from an assumed-breach perspective, inject a crafted .library-ms file via an SMB share to harvest NTLM hashes, and continue by abusing Generic Write privileges through Shadow Credentials. The final step to Domain Takeover is exploiting an AD CS vulnerability.

Optimum is a beginner-level machine which mainly focuses on enumeration of services with known exploits. Both exploits are easy to obtain and have associated Metasploit modules, making this machine fairly simple to complete.

🕵️ Enumeration

After spawning the machine and connecting to the VPN, we start with the initial enumeration.

🔍 Initial Nmap Scan

We begin by running an initial nmap scan with the following command:

nmap -sC -sV -vv -oA nmap/initial_scan <Target-IP>

• -sC Default script scan
• -sV Service version detection
• -vv Verbose output
• -oA Output all formats

Nmap reports only Port 80 open: