## https://sploitus.com/exploit?id=1ED7ABBD-DA80-5E6F-801E-FF5BF8E68234
PoC exploit for CVE-2019-1003000, CVE-2019-1003001, and CVE-2019-1003002, which are related to Script Security, Pipeline: Groovy, and Pipeline: Declarative plugins in Jenkins. This exploit allows users with Overall/Read permission and Job/Configure (and optional Job/Build) to bypass the sandbox protection and execute arbitrary code on the Jenkins master or node. The exploit uses a maliciously modified build script in sandbox mode to run arbitrary Java packages from an external Maven repository, and then uses the ProcBuilder class to run system shell commands. The payload is defined in the exploit.py script, which connects to the Jenkins server, crafts the payload, modifies the job with the payload, puts the job build to the queue, and waits for the job to run. The exploit requires the python-jenkins library to interact with the Jenkins server.