exploit the possibilities

TeamCity 2017.1.5 Privilege Escalation

TeamCity 2017.1.5 Privilege Escalation
Posted Dec 10, 2017
Authored by Heliand Dema

TeamCity version 2017.1.5 suffers from a local privilege escalation vulnerability due to weak file permissions.

tags | exploit, local
MD5 | 22c03cd9c7bec2d6c2dafd0fa29c7ae1

TeamCity 2017.1.5 Privilege Escalation

Change Mirror Download
TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation

=====================================================

# Vendor Homepage: http://www.jetbrains.com
# Date: 17 Oct 2017
# Version : TeamCity Version: 2017.1.5 Build: 47175
# Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64
# Author: Heliand Dema
# Contact: heliand@cyber.al
=====================================================

Teamcity installs two services called 'TCBuildAgent' and
'TeamCityService' with weak file permission running with SYSTEM privileges.
Services configured to use an executable with weak permissions are
vulnerable to privilege escalation attacks.
An unprivileged user could modify or overwrite the executable with
arbitrary code, which would be executed the next time the service is
started. Depending on the user that the service runs as, this could
result in privilege escalation.

>sc qc TCBuildAgent
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TCBuildAgent
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME :
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe
-s c:\TeamCity\buildAgent\launcher\conf\wrapper.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : TeamCity Build Agent
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


>icacls.exe
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe

BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)

>icacls.exe c:\TeamCity\bin\TeamCityService.exe

BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)

Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the
permissions for authenticated however unprivileged users.
The (M) stands for Modify, which grants an unprivileged user the ability
to read, write and delete files and subfolders within this folder.


====Proof-of-Concept====

To properly exploit this vulnerability, the local attacker must insert
an executable file called TeamCityAgentService-windows-x86-32.exe or
TeamCityService.exe and replace the original file. Next time service
starts the malicious file will get executed as SYSTEM.


Disclosure Timeline:
=============================Vendor Notification: 17 Oct 2017
Vendor reply "under investigation" : 17 Oct 2017
Vendor asked for additional information: 20 Oct 2017
Additional info provided: 20 Oct 2017
Vendor acknowledgement of issue : 8 Nov 2017
Fix released as version 2017.2 : 27 Nov 2017
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close