支持检测:

• • CVE-2015-8103/CVE-2016-0788 Jenkins 反序列化远程代码执行 https://github.com/Medicean/VulApps/tree/master/j/jenkins/1
• • CVE-2016-0792 Jenkins XStream 反序列化远程代码执行 https://github.com/jpiechowka/jenkins-cve-2016-0792
• • CVE-2017-1000353 Jenkins-CI 远程代码执行漏洞 https://github.com/vulhub/CVE-2017-1000353
• • CVE-2018-1000600 Jenkins GitHub SSRF+信息泄露
• • CVE-2018-1000861 Jenkins 绕过 Groovy 沙盒未授权命令执行漏洞 https://github.com/orangetw/awesome-jenkins-rce-2019
• • CVE-2018-1999002 Jenkins 任意文件读取 https://mp.weixin.qq.com/s/MOKeN1qEBonS8bOLw6LH\_w
• • CVE-2019-1003000 Jenkins 远程代码执行 https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc
• • CVE-2019-1003005/CVE-2019-1003029 远程代码执行(Script Security Plugin 沙箱绕过) https://github.com/orangetw/awesome-jenkins-rce-2019
• • CVE-2024-23897 Jenkins CLI 接口任意文件读取漏洞 https://github.com/vulhub/vulhub/blob/master/jenkins/CVE-2024-23897

CVE-2024-43044-jenkins

项目地址：https://github.com/convisolabs/CVE-2024-43044-jenkins

Exploit Usages:
    java -jar exploit.jar mode_secret <jenkinsUrl> <nodeName> <nodeSecretKey>
    java -jar exploit.jar mode_attach <jenkinsUrl> <cmd>
    java -jar exploit.jar mode_attach <cmd>

Jenkins 靶场

docker 靶场
https://github.com/vulhub/vulhub/tree/master/jenkins

扩展

• • Jenkins CLI 风险与利用姿势 https://mp.weixin.qq.com/s/Wy-1qqj\_\_PCtZ0C68TGzBQ
• • 记一次 Jenkins 后台注入内存马测试 https://mp.weixin.qq.com/s/szFks8-YdlrOsv8LfKE-xQ
• • 浅谈 jenkins 后渗透 https://mp.weixin.qq.com/s/q5A4APOPnGNo4zjulv0ugQ
• • https://blog.convisoappsec.com/en/analysis-of-cve-2024-43044/
• • 实战 Jenkins 到 AD 域控 https://mp.weixin.qq.com/s/0J7uOWqPTF-u2qZUar1NCg
• • 漏洞分析｜死磕 Jenkins 漏洞回显与利用效果 https://mp.weixin.qq.com/s/pKXKasKwHhOFM10mI0yoWA

总结

• • https://github.com/TheBeastofwar/JenkinsExploit-GUI
• • https://github.com/convisolabs/CVE-2024-43044-jenkins