metasploit-gs/documentation/modules/exploit/linux/http/jenkins_cli_deserialization.md

Vulnerable Application

An unauthenticated Java object deserialization vulnerability exists in the CLI component found in Jenkins versions v2.56 and below.

Installation

Vulnerable version of Jenkins can be downloaded from here. Additionally, a jdk will need to be installed on the target system.

To start Jenkins, navigate to the location of the downloaded war file and execute: java -jar <jenkins-file>.war. To test if Jenkins is properly working, the CLI component can be accessed by navigating to http://localhost:8080/cli.

Verification Steps

1. Install the application
2. Start msfconsole
3. Do: exploit/linux/http/jenkins_cli_deserialization
4. Do: set RHOST <ip>
5. Do: run
6. You should get a shell.

Options

No options

Scenarios

Version and OS