Jenkins RCE Creating/Modifying Project
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
This method is very noisy because you have to create a hole new project (obviously this will only work if you user is allowed to create a new project).
Create a new project (Freestyle project) clicking "New Item" or in /view/all/newJob
Inside Build section set Execute shell and paste a powershell Empire launcher or a meterpreter powershell (can be obtained using unicorn). Start the payload with PowerShell.exe instead using powershell.
Click Build now
If Build now button doesn't appear, you can still go to configure --> Build Triggers --> Build periodically and set a cron of * * * * *
Instead of using cron, you can use the config "Trigger builds remotely" where you just need to set a the api token name to trigger the job. Then go to your user profile and generate an API token (call this API token as you called the api token to trigger the job). Finally, trigger the job with: curl <username>:<api_token>@<jenkins_url>/job/<job_name>/build?token=<api_token_name>
Go to the projects and check if you can configure any of them (look for the "Configure button"):
If you cannot see any configuration button then you cannot configure it probably (but check all projects as you might be able to configure some of them and not others).
Or try to access to the path /job/<proj-name>/configure or /me/my-views/view/all/job/<proj-name>/configure __ in each project (example: /job/Project0/configure or /me/my-views/view/all/job/Project0/configure).
If you are allowed to configure the project you can make it execute commands when a build is successful:
Click on Save and build the project and your command will be executed. If you are not executing a reverse shell but a simple command you can see the output of the command inside the output of the build.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
