category: purple

link:

Brains

Brains lab: Divided into two parts:

  1. Offensive Part (Red Team): You will be the attacker exploiting a CVE vulnerability in "TeamCity" to bypass authentication and execute remote commands to access the system and obtain the flag.
  2. Defensive Part (Blue Team): You will work as a security analyst to analyse system logs using Splunk to track the traces of the attack and answer questions related to users and malware.

First, the offensive part (Red Team):

I scanned the victim's ports using the nmap tool.

sudo nmap -p- -sV -sC -T4  <TARGET_IP>

And after that, I found these ports open:

image.png

From the image, it's clear that ports 80, 22 and 50000 are open.

I tried port 80 and it showed a blank page with no information, not even in the source code.

After that, I tried port 5000 and it brought up a login page by TeamCity version 3.11.2023.

image.png

After that, I searched for a vulnerability for TeamCity Auth bypass to RCE (CVE-2024-27198) and found this article explaining the vulnerability and how to exploit it.