Web
Nmap discovered a Web server on target port 8080
The running service is Jetty 9.4.43.v20210629
Webroot
it’s jenkins
Jenkins
Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. It is a server-based system that runs in servlet containers such as Apache Tomcat. It supports version control tools, including AccuRev, CVS, Subversion, Git, Mercurial, Perforce, ClearCase, and RTC, and can execute Apache Ant, Apache Maven, and sbt based projects as well as arbitrary shell scripts and Windows batch commands.
I tried a number of weak and default credentials, but no luck
Registration
The create an account button leads to a registration page
creating a new account; test:qwe123
A new account successfully created and I am redirected to the Dashboard
There is also the version information for this particular instance; Jenkins 2.317
Users
It would appear that admin is the only other user
Nodes
Checking the Build Executor Status shows a single node; Windows Server 2019
That must be the target system
Build History
The Build History is empty
Build
It would appear that I, as the test user, am able to create a new build
This is a dangerous privilege that essentially allows anyone to create a build could potentially poses a significant threat