exploit the possibilities

TeamCity 2017.1.5 Privilege Escalation

TeamCity 2017.1.5 Privilege Escalation
Posted Dec 10, 2017
Authored by Heliand Dema

TeamCity version 2017.1.5 suffers from a local privilege escalation vulnerability due to weak file permissions.

tags | exploit, local
MD5 | 22c03cd9c7bec2d6c2dafd0fa29c7ae1

TeamCity 2017.1.5 Privilege Escalation

Change Mirror Download
TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation

=====================================================

# Vendor Homepage: http://www.jetbrains.com
# Date: 17 Oct 2017
# Version : TeamCity Version: 2017.1.5 Build: 47175
# Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64
# Author: Heliand Dema
# Contact: heliand@cyber.al
=====================================================

Teamcity installs two services called 'TCBuildAgent' and
'TeamCityService' with weak file permission running with SYSTEM privileges.
Services configured to use an executable with weak permissions are
vulnerable to privilege escalation attacks.
An unprivileged user could modify or overwrite the executable with
arbitrary code, which would be executed the next time the service is
started. Depending on the user that the service runs as, this could
result in privilege escalation.

>sc qc TCBuildAgent
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TCBuildAgent
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME :
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe
-s c:\TeamCity\buildAgent\launcher\conf\wrapper.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : TeamCity Build Agent
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


>icacls.exe
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe

BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)

>icacls.exe c:\TeamCity\bin\TeamCityService.exe

BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)

Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the
permissions for authenticated however unprivileged users.
The (M) stands for Modify, which grants an unprivileged user the ability
to read, write and delete files and subfolders within this folder.


====Proof-of-Concept====

To properly exploit this vulnerability, the local attacker must insert
an executable file called TeamCityAgentService-windows-x86-32.exe or
TeamCityService.exe and replace the original file. Next time service
starts the malicious file will get executed as SYSTEM.


Disclosure Timeline:
=============================Vendor Notification: 17 Oct 2017
Vendor reply "under investigation" : 17 Oct 2017
Vendor asked for additional information: 20 Oct 2017
Additional info provided: 20 Oct 2017
Vendor acknowledgement of issue : 8 Nov 2017
Fix released as version 2017.2 : 27 Nov 2017

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close