Exploiting Jenkins

Jenkins is an open source automation server written in Java. It automates the non-human part of software development. In this recipe, we will look at exploitation of CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), and CVE-2019-1003002 (Pipeline: Declarative), which came out in January, 2019.

How to do it...

Let's perform the following steps:

1. Download the POC exploit from https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc.
2. Go into the directory and install the requirements using the following command:

pip install -r requirements.txt

The output of the preceding command is shown in the following screenshot:

3. The exploit requires us to have user credentials of the...