Add JetBrains TeamCity HTTP Login Scanner #19601
Conversation
| class Teamcity < HTTP | ||
| DEFAULT_PORT = 8111 | ||
| LIKELY_PORTS = [8111] | ||
| LIKELY_SERVICE_NAMES = ['skynetflow'] # Comes from nmap 7.95 on MacOS |
There was a problem hiding this comment.
I think this is just a mismatch of scanning port 8111:
| return { status: UNABLE_TO_CONNECT, proof: res } if res.body.match?('ajax') # TODO: Get the exact error message here. | ||
| return { status: INVALID_PUBLIC_PART, proof: res } if res.body.match?('publicKeyExpired') # TODO: Invalid public part? Or Incorrect/Unable_to_connect? | ||
|
|
||
| { status: :success, proof: res } |
There was a problem hiding this comment.
Is it worth adding some positive assertions here to verify we're logged in, versus defaulting to success?
I guess it might be better to have false positives so that users report bugs for us to fix, versus false negatives that cause users to miss valid creds though 🤔
There was a problem hiding this comment.
Was there anything actionable here?
sjanusz-r7
force-pushed
the
add-teamcity-login-scanner
branch
from
a952647
to
520ac7e
Compare
| # Currently, those building blocks are not available, so this is the approach I have implemented. | ||
| timeout = res.body.match(/login only in (?<timeout>\d+)s/)&.named_captures&.dig('timeout')&.to_i | ||
| if timeout | ||
| framework_module.print_status "User '#{username}' locked out for #{timeout} seconds. Sleeping, and retrying..." |
There was a problem hiding this comment.
I think we're missing the prefix here for when we're scanning multiple hosts
msf6 auxiliary(scanner/teamcity/teamcity_login) > run http://127.0.0.1:8111 user_file=./users.txt pass_file=./pass.txt
[-] 127.0.0.1:8111 - LOGIN FAILED: test_user:mypass (Incorrect)
[-] 127.0.0.1:8111 - LOGIN FAILED: administrator:mypass (Incorrect)
[*] User 'user1' locked out for 59 seconds. Sleeping, and retrying...
i.e. the 127.0.0.1:8111 part
There was a problem hiding this comment.
Might also be nice to have the user1:#{pass} locked out - so we can see the progress in the wordlist file
| return { status: UNABLE_TO_CONNECT, proof: res } if res.body.match?('ajax') # TODO: Get the exact error message here. | ||
| return { status: INVALID_PUBLIC_PART, proof: res } if res.body.match?('publicKeyExpired') # TODO: Invalid public part? Or Incorrect/Unable_to_connect? | ||
|
|
||
| { status: :success, proof: res } |
There was a problem hiding this comment.
Was there anything actionable here?
Release NotesAdds a new bruteforce |
adfoster-r7
added
the
rn-modules
This PR adds in a new login scanner module that targets the JetBrains TeamCity service.
Docker
You can easily set up a TeamCity instance using Docker:
Latest:
10.0:
9.1.7:
Conveniently, the oldest available image in Docker and the newest images share the same encryption scheme and both work out of the box with no additional configuration or checking of the server version needed.
Verification
msfconsoleuse scanner/teamcity/teamcity_loginrun rport=8111 rhost=127.0.0.1 username=... password=...Example
Non-English Support