Jenkins Script Security Plugin Groovy Sandbox Bypass RCE

This repository is a proof-of-concept (PoC) exploit for multiple Jenkins vulnerabilities (CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002) that allow an attacker with Overall/Read and Job/Configure permissions to bypass the Groovy sandbox and execute arbitrary code on the Jenkins master or node. The main exploit is implemented in 'exploit.py', a Python script that connects to a target Jenkins instance using the 'python-jenkins' library, modifies a pipeline job to inject a malicious Groovy script, triggers a build, and retrieves the output of the executed system command from the job's console output. The payload leverages Groovy's AST transformation annotations (specifically '@Grab') to import the 'ProcBuilder' class from an external Maven repository, enabling execution of arbitrary shell commands. The repository also includes a sample vulnerable Jenkins environment under 'sample-vuln', which can be used for local testing. The exploit demonstrates full remote code execution (RCE) capabilities and can be used to run any system command, including spawning a reverse shell. The attack vector is network-based, targeting Jenkins HTTP endpoints. The repository is well-structured, with clear documentation and usage instructions in the README.

This repository is a comprehensive collection of exploit and proof-of-concept (PoC) code targeting a variety of vulnerabilities across multiple platforms and products. The structure is organized into directories for HEVD (HackSysExtremeVulnerableDriver) kernel exploits (covering stack overflow, use-after-free, arbitrary write, type confusion, race condition, and stack overflow with GS), Metasploit modules (for erlang cookie RCE, pfSense graph injection, SyncBreeze buffer overflow), personal exploits (for DELL EMC OneFS, Nimsoft nimcontroller, SyncBreeze, Sysdig Monitor, VXSearch), and ported exploits (for Oracle 9i XDB, Allied Telesyn AT-TFTP, LabF nfsAxe, Jenkins, Allok AVI, MySQL UDF, and WebDAV). The main capabilities include local and remote privilege escalation, remote code execution, and information disclosure. The exploits use a variety of payloads, including custom shellcode, msfvenom-generated payloads, and ROP chains, and target both local and network attack vectors. Notable fingerprintable endpoints include device handles (e.g., \\.\HackSysExtremeVulnerableDriver), HTTP/FTP services, and specific file paths (e.g., .zshrc for persistence). The repository demonstrates advanced exploitation techniques and is suitable for research, education, and penetration testing purposes.