TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation ===================================================== # Vendor Homepage: http://www.jetbrains.com # Date: 17 Oct 2017 # Version : TeamCity Version: 2017.1.5 Build: 47175 # Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64 # Author: Heliand Dema # Contact: heliand@cyber.al ===================================================== Teamcity installs two services called 'TCBuildAgent' and 'TeamCityService' with weak file permission running with SYSTEM privileges. Services configured to use an executable with weak permissions are vulnerable to privilege escalation attacks. An unprivileged user could modify or overwrite the executable with arbitrary code, which would be executed the next time the service is started. Depending on the user that the service runs as, this could result in privilege escalation. >sc qc TCBuildAgent [SC] QueryServiceConfig SUCCESS SERVICE_NAME: TCBuildAgent TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe -s c:\TeamCity\buildAgent\launcher\conf\wrapper.conf LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : TeamCity Build Agent DEPENDENCIES : SERVICE_START_NAME : LocalSystem >icacls.exe c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) Modify --- > NT AUTHORITY\Authenticated Users:(I)(M) >icacls.exe c:\TeamCity\bin\TeamCityService.exe BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) Modify --- > NT AUTHORITY\Authenticated Users:(I)(M) Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the permissions for authenticated however unprivileged users. The (M) stands for Modify, which grants an unprivileged user the ability to read, write and delete files and subfolders within this folder. ====Proof-of-Concept==== To properly exploit this vulnerability, the local attacker must insert an executable file called TeamCityAgentService-windows-x86-32.exe or TeamCityService.exe and replace the original file. Next time service starts the malicious file will get executed as SYSTEM. Disclosure Timeline: =============================Vendor Notification: 17 Oct 2017 Vendor reply "under investigation" : 17 Oct 2017 Vendor asked for additional information: 20 Oct 2017 Additional info provided: 20 Oct 2017 Vendor acknowledgement of issue : 8 Nov 2017 Fix released as version 2017.2 : 27 Nov 2017