Skip to content

Discovery & Enum

  • automation server to build and test projects continuously
  • written in java (Jenkins was previously called Hudson)
  • it runs in servlet containers like Tomcat

Discovery

  • for an Internal pentest: we've completed our web discovery and find what we believe is a Jenkins instance.
  • usually running on Windows servers as the all-powerful SYSTEM account.
  • If we gain access via Jenkins and gain remote code execution as the SYSTEM account, we would have a foothold in AD to begin enumeration of the domain environment.
  • Jenkins runs on Tomcat port 8080 by default.
  • uses port 5000 for slave servers - used for commz between a master and a slave
  • Jenkins can use a local database, LDAP, Unix user database, delegate security to a servlet container, or use no authentication at all. Administrators can also allow or disallow users from creating accounts.

Enum

  • after logging into the account
  • find version at the bottom-left