Exploit Jenkins in the Cloud

This beginner lab shows how a cloud-based Jenkins instance can be abused through common misconfigurations and bad practices. You find an unauthenticated Jenkins server, harvest AWS keys exposed by the S3 Explorer plugin, and decrypt a concealed secret key using the built-in Script Console. You then use a Groovy reverse shell to gain a foothold as the jenkins user and escalate to root by exploiting password reuse.

During a security assessment for Huge Logistics you are handed several IP addresses, and one stands out. You investigate it, exploit the vulnerabilities you find, and escalate your permissions within their AWS environment.

• Basic Linux command line knowledge
• Familiarity with the AWS CLI
• Basic understanding of reverse shells

• Discover and assess an exposed Jenkins instance with Nmap
• Harvest clear text AWS keys exposed by the Jenkins S3 Explorer plugin
• Decrypt concealed Jenkins secrets using hudson.util.Secret.decrypt in the Script Console
• Enumerate S3 buckets and recover a backup script leaking an SSH passphrase
• Gain a foothold with a Groovy reverse shell run from the Jenkins Script Console
• Upgrade a weak reverse shell to a stable interactive TTY
• Escalate to root by exploiting password reuse, and apply Jenkins authentication and authorization hardening

Jenkins servers are attractive targets because they hold source code and credentials and can execute commands on the underlying system, and they are frequently left outdated or misconfigured. Exposed instances have repeatedly been abused to steal sensitive data or deploy crypto miners.