Once enumeration is complete, and if a vulnerable version of Jenkins has been found, we can move on to the exploitation phase. In this section, we will learn about the various exploits that can be discovered by @orangetsai and how they can be chained together to execute system commands on a Jenkins server.
First, we will look at two of the most famous exploits of 2019, discovered by @orangetsai (https://blog.orange.tw/), which exploited Jenkins and returned a shell. These exploits were later added to Metasploit as unauthenticated RCEs.
