TeamCity 2017.1.5 Privilege Escalation

TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation

========================= TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation

=====================================================

# Vendor Homepage: http://www.jetbrains.com
# Date: 17 Oct 2017
# Version : TeamCity Version: 2017.1.5 Build: 47175
# Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64
# Author: Heliand Dema
# Contact: heliand@cyber.al
=====================================================

Teamcity installs two services called 'TCBuildAgent' and
'TeamCityService' with weak file permission running with SYSTEM privileges.
Services configured to use an executable with weak permissions are
vulnerable to privilege escalation attacks.
An unprivileged user could modify or overwrite the executable with
arbitrary code, which would be executed the next time the service is
started. Depending on the user that the service runs as, this could
result in privilege escalation.

>sc qc TCBuildAgent
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TCBuildAgent
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME :
c:TeamCityuildAgentlauncherinTeamCityAgentService-windows-x86-32.exe
-s c:TeamCityuildAgentlauncherconfwrapper.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : TeamCity Build Agent
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


>icacls.exe
c:TeamCityuildAgentlauncherinTeamCityAgentService-windows-x86-32.exe

BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
Modify --- > NT AUTHORITYAuthenticated Users:(I)(M)

>icacls.exe c:TeamCityinTeamCityService.exe

BUILTINAdministrators:(I)(F)
NT AUTHORITYSYSTEM:(I)(F)
BUILTINUsers:(I)(RX)
Modify --- > NT AUTHORITYAuthenticated Users:(I)(M)

Notice the line: NT AUTHORITYAuthenticated Users:(I)(M) which lists the
permissions for authenticated however unprivileged users.
The (M) stands for Modify, which grants an unprivileged user the ability
to read, write and delete files and subfolders within this folder.


====Proof-of-Concept====

To properly exploit this vulnerability, the local attacker must insert
an executable file called TeamCityAgentService-windows-x86-32.exe or
TeamCityService.exe and replace the original file. Next time service
starts the malicious file will get executed as SYSTEM.


Disclosure Timeline:
=============================Vendor Notification: 17 Oct 2017
Vendor reply "under investigation" : 17 Oct 2017
Vendor asked for additional information: 20 Oct 2017
Additional info provided: 20 Oct 2017
Vendor acknowledgement of issue : 8 Nov 2017
Fix released as version 2017.2 : 27 Nov 2017