1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Udp
8
  include Msf::Auxiliary::Report
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Jenkins Server Broadcast Enumeration',
15
        'Description' => %q{
16
          This module sends out a udp broadcast packet querying for
17
          any Jenkins servers on the local network.
18
          Be advised that while this module does not identify the
19
          port on which Jenkins is running, the default port for
20
          Jenkins is 8080.
21
        },
22
        'Author' => [
23
          'Adam Compton <[email protected]>',
24
          'Matt Schmidt <[email protected]>'
25
        ],
26
        'References' => [
27
          [ 'URL', 'https://wiki.jenkins-ci.org/display/JENKINS/Auto-discovering+Jenkins+on+the+network' ]
28
        ],
29
        'License' => MSF_LICENSE,
30
        'Notes' => {
31
          'Reliability' => UNKNOWN_RELIABILITY,
32
          'Stability' => UNKNOWN_STABILITY,
33
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
34
        }
35
      )
36
    )
37
    deregister_udp_options
38
  end
39

40
  def parse_reply(pkt)
41
    # if empty packet, exit
42
    return unless pkt[1]
43

44
    # strip to just the IPv4 address
45
    if pkt[1] =~ /^::ffff:/
46
      pkt[1] = pkt[1].sub(/^::ffff:/, '')
47
    end
48

49
    # check for and extract the version string
50
    ver = pkt[0].scan(/version>(.*)<\/version/i).flatten.first
51

52
    # if a version was identified, then out and store to DB
53
    if ver
54
      print_good("#{pkt[1]} - Found Jenkins Server #{ver} Version")
55
      report_host(
56
        host: pkt[1],
57
        info: "Jenkins v.#{ver} (port typically 8080)"
58
      )
59
    end
60
  end
61

62
  def run
63
    print_status('Sending Jenkins UDP Broadcast Probe ...')
64

65
    udp_sock = connect_udp
66

67
    udp_sock.sendto('\n', '255.255.255.255', 33848, 0)
68

69
    # loop a few times to account for multiple or slow responders
70
    iter = 0
71
    while (r = udp_sock.recvfrom(65535, 0.1)) && (iter < 20)
72
      parse_reply(r)
73
      iter += 1
74
    end
75
  end
76
end
77

78