TeamCity 2017.1.5 Privilege Escalation

`TeamCity 2017.1.5 - Weak file permissions - Privilege Escalation  
  
=====================================================  
  
# Vendor Homepage: http://www.jetbrains.com  
# Date: 17 Oct 2017  
# Version : TeamCity Version: 2017.1.5 Build: 47175  
# Tested on: Windows 7 Ultimate SP1 (EN) and Windows 10 x64  
# Author: Heliand Dema  
# Contact: [email protected]  
=====================================================  
  
Teamcity installs two services called 'TCBuildAgent' and  
'TeamCityService' with weak file permission running with SYSTEM privileges.  
Services configured to use an executable with weak permissions are  
vulnerable to privilege escalation attacks.  
An unprivileged user could modify or overwrite the executable with  
arbitrary code, which would be executed the next time the service is  
started. Depending on the user that the service runs as, this could  
result in privilege escalation.  
  
>sc qc TCBuildAgent  
[SC] QueryServiceConfig SUCCESS  
  
SERVICE_NAME: TCBuildAgent  
TYPE : 110 WIN32_OWN_PROCESS (interactive)  
START_TYPE : 2 AUTO_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME :  
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe  
-s c:\TeamCity\buildAgent\launcher\conf\wrapper.conf  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : TeamCity Build Agent  
DEPENDENCIES :  
SERVICE_START_NAME : LocalSystem  
  
  
>icacls.exe  
c:\TeamCity\buildAgent\launcher\bin\TeamCityAgentService-windows-x86-32.exe  
  
BUILTIN\Administrators:(I)(F)  
NT AUTHORITY\SYSTEM:(I)(F)  
BUILTIN\Users:(I)(RX)  
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)  
  
>icacls.exe c:\TeamCity\bin\TeamCityService.exe  
  
BUILTIN\Administrators:(I)(F)  
NT AUTHORITY\SYSTEM:(I)(F)  
BUILTIN\Users:(I)(RX)  
Modify --- > NT AUTHORITY\Authenticated Users:(I)(M)  
  
Notice the line: NT AUTHORITY\Authenticated Users:(I)(M) which lists the  
permissions for authenticated however unprivileged users.  
The (M) stands for Modify, which grants an unprivileged user the ability  
to read, write and delete files and subfolders within this folder.  
  
  
====Proof-of-Concept====  
  
To properly exploit this vulnerability, the local attacker must insert  
an executable file called TeamCityAgentService-windows-x86-32.exe or  
TeamCityService.exe and replace the original file. Next time service  
starts the malicious file will get executed as SYSTEM.  
  
  
Disclosure Timeline:  
=============================Vendor Notification: 17 Oct 2017  
Vendor reply "under investigation" : 17 Oct 2017  
Vendor asked for additional information: 20 Oct 2017  
Additional info provided: 20 Oct 2017  
Vendor acknowledgement of issue : 8 Nov 2017  
Fix released as version 2017.2 : 27 Nov 2017  
`