Jenkins

Enumeration 1 export target=10.129.230.220 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p22,8080 -T5 $target Web Application (8080) Jenkins 2.441 There is a user, jennifer On Jenkins 2.441 there is a arbitrary file read vulnerability, CVE-2024-23897, and there is a public exploit for it: https://github.com/godylockz/CVE-2024-23897 We can get the var/jenkins_home/users/users.xml There is a user directory jennifer_12108429903186576833, let’s read its config file ...

Enumeration 1 export target=10.129.228.112 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p80,135,445,50000 -T5 $target Web Application (80) Just a search bar Typed ‘hey’ and press Search. Then got this weird error (because it is an image) We learn that database is Microsoft SQL Server 2005 - 9.00.4053.00 .NET version 2.0.50727.4223 dirsearch nothing showed up 1 2 3 4 5 6 7 # Dirsearch started Thu Aug 13 02:20:04 2026 as: /usr/lib/python3/dist-packages/dirsearch/dirsearch.py -u http://10.129.228.112/ --exclude-sizes 0B 403 312B http://10.129.228.112/%2e%2e//google.com 403 312B http://10.129.228.112/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 403 312B http://10.129.228.112/\..\..\..\..\..\..\..\..\..\etc\passwd 403 312B http://10.129.228.112/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 200 50B http://10.129.228.112/error.html Jetty (50000) ...