6 ms·
Was the original attack via jenkins? all it says some vague privilege escalation was used to upload c file. what?
by waitwhat7 14y ago
Was the original attack via jenkins? all it says some vague privilege escalation was used to upload c file. what?
- reginaldo 14y agoI believe the issue was related to the fact that the user running Jenkins was a full passwordless sudo user. Maybe the attacker used the groovy console too...
- ihsw 14y agoNo the author seems to indicate that it was on their application code and an attacker was able to get OS access, and the attacker subsequently replaced the ssh service with one that instead ignores login attempts and harvests the username/password pairs. It seems to have been a coincidence that their Jenkins service was not secured.
- indigo_daddy 14y agoWhat I got from the article is that they likely ssh brute-forced the Jenkins service user and then had passwordless sudo; however you wouldn't think that this user would have a shell assigned.