Jenkins-CI Remote Code Execution Vulnerability (CVE-2017-1000353)
Hey Ninja,
Principle
Reference reading https://blogs.securiteam.com/index.php/archives/3171
Environment construction
Spawn the lab to run Jenkins. After waiting for the lab to deploy, visit http://your-ip:8080 to see that jenkins has successfully run without manual installation.
Testing process
Step 1. Generate a serialized string
Refer to https://github.com/vulhub/CVE-2017-1000353, first download [CVE-2017-1000353-1.1-SNAPSHOT-all.jar](https://github.com/vulhub/CVE-2017 -1000353/releases/download/1.1/CVE-2017-1000353-1.1-SNAPSHOT-all.jar), which is the tool to generate the POC.
Execute the following command to generate a bytecode file:
java -jar CVE-2017-1000353-1.1-SNAPSHOT-all.jar jenkins_poc.ser "touch /tmp/success"
jenkins_poc.ser is the name of the generated bytecode file
"touch ..." is any command to execute
After executing the above code, the jenkins_poc.ser file is generated, which is the serialized string.
Step 2. Send data packets and execute commands
Download exploit.py, python3 execute python exploit.py http://your-ip:8080 jenkins_poc. ser, send the bytecode file just generated to the target:
<img style="height: 200px" title="howto" alt="Alt text" src="https://s3.selfmade.ninja/labassets/jenkins1.png">Enter docker and find that /tmp/success has been successfully created, indicating that the command execution vulnerability has been exploited successfully:
<img style="width: 200px" title="howto" alt="Alt text" src="https://s3.selfmade.ninja/labassets/jenkins2.png">