Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 6 steps · 5 edges

Jenkins /script Groovy console → RCE → AD

Jenkins script console exposed unauth on the corporate intranet — Groovy 'execute()' = RCE as the Jenkins service account, often a domain user with broad agent access.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: foothold inside the corporate network. Jenkins master reachable. Default admin credentials, anonymous read access, or a known exploitable user.

§ Steps

  1. 01
    Run system commands as Jenkins userExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Move laterally with harvested credsLateral Movement
    T1550.002— Pass the Hash
  3. 03
    Default / leaked admin credentialsCredential Access
    W-AUTH-DEFAULT— Default Credentials
  4. 04
    Open /script Groovy consoleExecution
    CI-PIPELINE-RCE— Jenkins Script Console RCE
  5. 05
    Discover Jenkins UIDiscovery
    N-NMAP-INTERNAL— Internal Nmap Sweep
  6. 06
    Dump cached AD creds from agentsCredential Access
    W-LSASS-PROCDUMP— LSASS via procdump / comsvcs.dll

§ References

§ Frequently asked

What is the "Jenkins /script Groovy console → RCE → AD" attack path?
Jenkins script console exposed unauth on the corporate intranet — Groovy 'execute()' = RCE as the Jenkins service account, often a domain user with broad agent access. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Run system commands as Jenkins user (T1059) — a execution primitive. Assumed environment: foothold inside the corporate network.
What is the final impact of this kill-chain?
The final step lands on Dump cached AD creds from agents (W-LSASS-PROCDUMP), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers