Pwn TeamCity in the Cloud

This beginner lab shows how a JetBrains TeamCity server deployed in AWS can be fully compromised through common bad practices and default settings. You pivot from AWS keys to EC2 user data, reuse a leaked database password over SSH, abuse the default super user login, gain root code execution via a build step, and finally decrypt stored TeamCity secrets to reach an S3 bucket.

In a red team operation against Huge Logistics, your team obtained AWS credentials through phishing. Your objective is to move deeper into the AWS infrastructure, find vulnerabilities, and escalate privileges.

• Basic Linux command line knowledge
• AWS CLI installed and configured
• Provided AWS access keys

• Brute force IAM permissions with the Pacu exploitation framework
• Retrieve and decode base64 encoded EC2 instance user data to recover credentials
• Exploit password reuse to log in over SSH and abuse the TeamCity super user token from server logs
• Achieve root command execution using a TeamCity Command Line build step and catch a reverse shell
• Stabilize a reverse shell into a fully interactive TTY
• Locate and decrypt TeamCity zxx secrets using the fixed DES3 key to recover an AWS secret access key
• Use recovered keys to enumerate and pivot to a protected S3 bucket

TeamCity is a widely deployed CI/CD server, and in 2021 the New York Times reported that Russian hackers may have leveraged it to breach US government and private networks. Shodan shows thousands of TeamCity login pages exposed directly to the internet.