0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
TeamCity 2017.1.5 Privilege Escalation Vulnerability
[TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation
=====================================================
# Vendor Homepage: http://www.jetbrains.com
# Date: 17 Oct 2017
# Version : TeamCity Version: 2017.1.5 Build: 47175
# Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64
# Author: Heliand Dema
# Contact: heliand@cyber.al
=====================================================
Teamcity installs two services called 'TCBuildAgent' and
'TeamCityService' with weak file permission running with SYSTEM privileges.
Services configured to use an executable with weak permissions are
vulnerable to privilege escalation attacks.
An unprivileged user could modify or overwrite the executable with
arbitrary code, which would be executed the next time the service is
started. Depending on the user that the service runs as, this could
result in privilege escalation.
>sc qc TCBuildAgent
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: TCBuildAgent
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME :
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe
-s c:\TeamCity\buildAgent\launcher\conf\wrapper.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : TeamCity Build Agent
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
>icacls.exe
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe
BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)
>icacls.exe c:\TeamCity\bin\TeamCityService.exe
BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)
Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the
permissions for authenticated however unprivileged users.
The (M) stands for Modify, which grants an unprivileged user the ability
to read, write and delete files and subfolders within this folder.
====Proof-of-Concept====
To properly exploit this vulnerability, the local attacker must insert
an executable file called TeamCityAgentService-windows-x86-32.exe or
TeamCityService.exe and replace the original file. Next time service
starts the malicious file will get executed as SYSTEM.
Disclosure Timeline:
=============================Vendor Notification: 17 Oct 2017
Vendor reply "under investigation" : 17 Oct 2017
Vendor asked for additional information: 20 Oct 2017
Additional info provided: 20 Oct 2017
Vendor acknowledgement of issue : 8 Nov 2017
Fix released as version 2017.2 : 27 Nov 2017
# 0day.today [2024-11-16] #