Skip to content

Commit 20cefaf

Browse files
TheBeastofwarTheBeastofwar
committed
v1.3
1 parent cfd6223 commit 20cefaf

11 files changed

Lines changed: 76 additions & 67 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
### jdk版本
55
在windows或linux使用jdk8的哪一个版本应该都可以,在macOS里需要jdk8u较高的版本,比如jdk8u321
66
### 外置payload
7-
从release下载windows_tools或linux_tools并放在与JenkinsExploit-GUI-*-SNAPSHOT.jar相同的目录,或者可以自行打包tools_source中的python源码文件
7+
从release下载windows_tools,linux_tools或macOS_tools并放在与JenkinsExploit-GUI-*-SNAPSHOT.jar相同的目录,或者可以自行打包tools_source中的python源码文件
88

9-
如果是linux的话需要对外置payload进行chmod +x 赋予权限
9+
如果是linux或macOS的话需要对外置payload进行chmod +x 赋予权限
1010
![img.png](img/img.png)
1111
![img_1.png](img/img_1.png)
1212
### dnslog配置
@@ -33,9 +33,7 @@ bash -c {echo,Y....}|{base64,-d}|{bash,-i}
3333
## 未完待续:
3434
- CVE-2016-9299 Jenkins ldap反序列化远程代码执行,添加poc
3535
- CVE-2017-1000353 无法检测的bug
36-
- 修复在macOS系统无法运行的bug
3736
- 继续尝试把外置的payload接入到java代码中
38-
- 添加macOS的外部payload
3937
- 添加批量检测功能
4038
## 源码打包
4139
```

‎pom.xml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,17 @@
44
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
55
<modelVersion>4.0.0</modelVersion>
66

7-
<groupId>org.example</groupId>
7+
<groupId>fun.fireline</groupId>
88
<artifactId>JenkinsExploit-GUI</artifactId>
9-
<version>1.0-SNAPSHOT</version>
9+
<packaging>jar</packaging>
10+
<version>1.3-SNAPSHOT</version>
1011

1112
<properties>
1213
<maven.compiler.source>8</maven.compiler.source>
1314
<maven.compiler.target>8</maven.compiler.target>
1415
</properties>
1516

1617
<dependencies>
17-
1818
<dependency>
1919
<groupId>com.jfoenix</groupId>
2020
<artifactId>jfoenix</artifactId>
@@ -48,34 +48,35 @@
4848
<artifactId>bcprov-jdk15on</artifactId>
4949
<version>1.68</version>
5050
</dependency>
51-
5251
</dependencies>
5352

5453
<build>
55-
<finalName>JenkinsExploit-GUI-1.2-SNAPSHOT</finalName><!-- 导出jar的名字 -->
5654
<plugins>
5755
<plugin>
5856
<groupId>org.apache.maven.plugins</groupId>
59-
<artifactId>maven-shade-plugin</artifactId>
60-
<version>3.2.0</version>
57+
<artifactId>maven-assembly-plugin</artifactId>
58+
<version>3.3.0</version>
59+
<configuration>
60+
<archive>
61+
<manifest>
62+
<mainClass>fun.fireline.AppStartUp</mainClass>
63+
</manifest>
64+
</archive>
65+
<descriptorRefs>
66+
<descriptorRef>jar-with-dependencies</descriptorRef>
67+
</descriptorRefs>
68+
<finalName>JenkinsExploit-GUI-1.3-SNAPSHOT</finalName>
69+
</configuration>
6170
<executions>
6271
<execution>
72+
<id>make-assembly</id>
6373
<phase>package</phase>
6474
<goals>
65-
<goal>shade</goal>
75+
<goal>single</goal>
6676
</goals>
67-
<configuration>
68-
<transformers>
69-
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
70-
<mainClass>fun.fireline.AppStartUp</mainClass>
71-
</transformer>
72-
</transformers>
73-
</configuration>
7477
</execution>
7578
</executions>
7679
</plugin>
7780
</plugins>
7881
</build>
79-
80-
81-
</project>
82+
</project>

‎src/META-INF/MANIFEST.MF‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Manifest-Version: 1.0
2+
Main-Class: fun.fireline.AppStartUp
3+

‎src/main/java/fun/fireline/AppStartUp.java‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,6 @@ public void handle(WindowEvent event) {
3434

3535

3636
public static void main(String[] args) {
37-
// try {
38-
// URL iconURL = AppStartUp.class.getClassLoader().getResource("img/sec.png");
39-
// java.awt.Image image = new ImageIcon(iconURL).getImage();
40-
// com.apple.eawt.Application.getApplication().setDockIconImage(image);
41-
// } catch (Exception e) {
42-
// // Won't work on Windows or Linux.
43-
// }
44-
4537
launch(args);
4638
}
4739
}

‎src/main/java/fun/fireline/controller/JenkinsController.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,9 @@ public class JenkinsController extends MainController{
4141
"\tCVE-2019-1003000 Jenkins 远程代码执行 https://github.com/adamyordan/cve-2019-1003000-jenkins-rce-poc\r\n"+
4242
"\tCVE-2019-1003005/CVE-2019-1003029 远程代码执行(Script Security Plugin沙箱绕过) https://github.com/orangetw/awesome-jenkins-rce-2019\r\n"+
4343
"\tCVE-2024-23897 Jenkins CLI 接口任意文件读取漏洞 https://github.com/vulhub/vulhub/blob/master/jenkins/CVE-2024-23897\r\n" +
44-
"\t未完待续:\r\n"+
44+
"未完待续:\r\n"+
4545
"\tCVE-2016-9299 Jenkins ldap反序列化远程代码执行,poc添加\r\n"+
4646
"\tCVE-2017-1000353无法显示的bug\r\n"+
47-
"\t修复macOS上无法运行的bug\r\n"+
48-
"\t添加macOS的外部payload\r\n"+
4947
"\t添加批量检测功能\r\n"+
5048
"\t继续尝试把外置的payload接入到java代码中\r\n\r\n"+
5149

‎src/main/java/fun/fireline/controller/MainController.java‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,12 @@
3131
public class MainController {
3232
public static Logger logger = Logger.getLogger(MainController.class);
3333
@FXML
34-
private MenuItem proxySetupBtn;
35-
@FXML
3634
private MenuItem dnslogSetupBtn;
3735
@FXML
3836
private Label tool_name;
3937
@FXML
4038
private Label author;
4139
@FXML
42-
private Label proxyStatusLabel;
43-
@FXML
4440
private Label dnslogStatusLable;
4541
@FXML
4642
private VBox selectButton; // 漏洞种类按钮
@@ -166,8 +162,4 @@ private void refreshPage(String page){
166162
}
167163
}
168164

169-
public void setProxyStatusLabel(String value) {
170-
this.proxyStatusLabel.setText(value);
171-
}
172-
173165
}

‎src/main/java/fun/fireline/core/Constants.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ public class Constants {
55

66
public static String NAME = "JenkinsExploit-GUI";
77

8-
public static String VERSION = "v1.2";
8+
public static String VERSION = "v1.3";
99

1010
public static String AUTHOR = "by initial";
1111

@@ -26,7 +26,10 @@ public class Constants {
2626
"\t添加Jenkins指纹验证和版本获取功能,使得能够通过版本先匹配一下CVE\r\n"+
2727
"\t修复进行all检测后还得再次对特定的CVE进行检测的bug\r\n"+
2828
"v1.2\r\n"+
29-
"\t可以配置dnslog.pw或ceye.io dnslog平台来进行自动化无回显命令执行或SSRF验证";
29+
"\t可以配置dnslog.pw或ceye.io dnslog平台来进行自动化无回显命令执行或SSRF验证\r\n"+
30+
"v1.3\r\n"+
31+
"\t经过测试,发现macOS系统上的各种报错基本都是jdk版本的问题或者macOS的一些设置的问题,所以代码没有什么大的变化\r\n"+
32+
"\t添加macOS的外部payload";
3033

3134
public static String[] ENCODING = {
3235
"UTF-8",

‎src/main/java/fun/fireline/exp/jenkins/CVE_2018_1000600.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@
77
import fun.fireline.tools.Response;
88

99
import java.util.HashMap;
10-
import java.util.regex.Matcher;
11-
import java.util.regex.Pattern;
1210

1311
import static fun.fireline.tools.Tools.dnslog_verify;
1412
import static fun.fireline.tools.Tools.getRandomString;

‎src/main/java/fun/fireline/exp/jenkins/CVE_2019_1003000.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package fun.fireline.exp.jenkins;
22

33
import fun.fireline.core.ExploitInterface;
4-
import fun.fireline.exp.tools.dnslogSetting;
54
import fun.fireline.tools.Jenkins_Info;
65

76
import java.io.BufferedReader;

‎src/main/resources/fxml/Jenkins.fxml‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,9 @@
22

33
<?import com.jfoenix.controls.JFXButton?>
44
<?import com.jfoenix.controls.JFXTabPane?>
5-
<?import javafx.scene.control.ChoiceBox?>
6-
<?import javafx.scene.control.Tab?>
7-
<?import javafx.scene.control.TextArea?>
8-
<?import javafx.scene.control.TextField?>
9-
<?import javafx.scene.layout.AnchorPane?>
10-
<?import javafx.scene.text.Font?>
11-
<?import javafx.scene.text.Text?>
12-
5+
<?import javafx.scene.control.*?>
6+
<?import javafx.scene.layout.*?>
7+
<?import javafx.scene.text.*?>
138
<AnchorPane prefHeight="647.0" prefWidth="1046.0" stylesheets="@../css/main.css" xmlns="http://javafx.com/javafx/8.0.171" xmlns:fx="http://javafx.com/fxml/1" fx:controller="fun.fireline.controller.JenkinsController">
149

1510
<children>
@@ -39,6 +34,7 @@
3934

4035
<JFXTabPane layoutY="35.0" prefHeight="612.0" prefWidth="1048.0">
4136
<tabs>
37+
4238
<Tab text="基本信息">
4339
<content>
4440
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="644.0" prefWidth="901.0">
@@ -51,6 +47,7 @@
5147
</AnchorPane>
5248
</content>
5349
</Tab>
50+
5451
<Tab text="文件读取/命令执行">
5552
<content>
5653
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="180.0" prefWidth="200.0">
@@ -69,6 +66,45 @@
6966
</AnchorPane>
7067
</content>
7168
</Tab>
69+
70+
<!-- <Tab text="批量检查">
71+
<content>
72+
<AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="180.0" prefWidth="200.0">
73+
<children>
74+
<ChoiceBox fx:id="thread" layoutX="66.0" layoutY="6.0" prefHeight="3.0" prefWidth="36.0" />
75+
<Text layoutX="19.0" layoutY="26.0" strokeType="OUTSIDE" strokeWidth="0.0" text="线程">
76+
<font>
77+
<Font size="15.0" />
78+
</font>
79+
</Text>
80+
<Button fx:id="import_file" layoutX="800.0" layoutY="5.0" mnemonicParsing="false" onAction="#get_execute_cmd" prefHeight="18.0" prefWidth="50.0" text="导入">
81+
<font>
82+
<Font size="15.0" />
83+
</font>
84+
</Button>
85+
<TextField fx:id="file_path" layoutX="129.0" layoutY="6.0" prefHeight="27.0" prefWidth="660.0" />
86+
<Text fx:id="time" layoutX="923.0" layoutY="24.0" strokeType="OUTSIDE" strokeWidth="0.0" text="用时 %s">
87+
<font>
88+
<Font size="15.0" />
89+
</font>
90+
</Text>
91+
<TableView fx:id="table_view" layoutY="40.0" prefHeight="524.0" prefWidth="1040.0">
92+
<columns>
93+
<TableColumn fx:id="id" prefWidth="57.0" text="序号" />
94+
<TableColumn fx:id="target" prefWidth="481.0" text="目标" />
95+
<TableColumn fx:id="isVul" prefWidth="500.0" text="是否存在漏洞" />
96+
</columns>
97+
</TableView>
98+
<Button fx:id="export_file" layoutX="860.0" layoutY="5.0" mnemonicParsing="false" onAction="#get_execute_cmd" prefHeight="18.0" prefWidth="50.0" text="导出">
99+
<font>
100+
<Font size="15.0" />
101+
</font>
102+
</Button>
103+
</children></AnchorPane>
104+
</content>
105+
</Tab>-->
106+
107+
72108
</tabs>
73109
</JFXTabPane>
74110

0 commit comments

Comments
 (0)