Lion Cipher Lab
Exploit an unauthenticated Jenkins for RCE, then lock it down
- Penetration Testing / Red Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A continuous-integration (CI) server is where source code turns into shipped software, which makes it one of the most dangerous machines to leave exposed on the whole network. Jenkins is the most widely deployed CI server in the world, and it carries an feature that is wonderful for administrators and catastrophic in the wrong hands: the Script Console, a page that runs arbitrary Groovy code directly on the Jenkins controller, in the Jenkins process, with all of its privileges and access to all of its stored credentials. When Jenkins is secured, that page requires the Administer permission…
What you'll learn
- explaining what a CI server is, what the Jenkins Script Console does, and why an unauthenticated one is instant remote code execution on the controller
- standing up an isolated, deliberately-unsecured Jenkins in one official container so the whole exercise touches nothing but your own machine
- confirming unauthenticated code execution against your own lab with a single curl to /scriptText and reading the command output it returns
- reproducing the RCE write-primitive by having the Jenkins process create a harmless marker file, and describing accurately how that becomes full host and pipeline compromise in the real world
- applying the fix: enabling a security realm and an authorization strategy so anonymous loses Overall/Administer, then keeping Jenkins off the public network
- measuring before and after with the same probe: the /scriptText request returns command output before the fix and 403 Forbidden (or a login redirect) after it
- judgment: why a default modern Jenkins is not vulnerable, so an exposed unsecured one is always a human-made misconfiguration and not a software flaw
Steps in this lab
- What Jenkins is, and why the Script Console is remote code execution
- Stand up a deliberately-unsecured Jenkins — your machine only
- Confirm unauthenticated code execution (the 'before' measurement)
- Why this is possible here but not on a default Jenkins
- Apply the fix: a security realm and an authorization strategy
- Re-probe and confirm the fix (the 'after' measurement)
- What you just did — and how to carry it