Using Metasploit for automated exploitation

For this demonstration, we will use Metasploit to exploit the Jenkins server and get a meterpreter shell on it. Jenkins has its own script console where a user can type in and run arbitrary code. This is dangerous if the user's credentials are stolen, as anyone can then run arbitrary code using the script console. The Metasploit module we will be using, takes advantage of this and attempts to run code that would create a connection to the remote machine.

Let's see how the exploitation is done:

1. SSH into the Kali machine and load the Metasploit framework by issuing the following command:

msfconsole

2. Next, we will search Metasploit for any exploits related to Jenkins:

search jenkins

The output of the preceding command is as follows:

We are presented with a number of modules that are related to Jenkins.

3. We will use the jenkins_script_console...