[trevor69000]

https://app.hackthebox.com/machines/598
All the best everyone

[kimera]

Let the game begin...

[trevor69000]

PORT    STATE SERVICE    VERSION
22/tcp  open  ssh        OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|  256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
|_  256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
80/tcp  open  http        nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://runner.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
8000/tcp open  nagios-nsca Nagios NSCA
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

[willow]

raft-medium-directories on port 8000:

200      GET        1l        1w        3c http://10.10.11.13:8000/health
200      GET        1l        1w        9c http://10.10.11.13:8000/version
[####################] - 24s    30014/30014  0s      found:2      errors:0     
[####################] - 24s    30002/30002  1253/s  http://10.10.11.13:8000/

---

custom wordlist + vhost scan found teamcity.runner.htb

[trevor69000]

https://github.com/H454NSec/CVE-2023-42793


[~/runner/CVE-2023-42793]
└─$ python3 CVE-2023-42793.py -u http://teamcity.runner.htb       
[+] http://teamcity.runner.htb/login.html ..............

[jsvensson]

In meterpreter:
exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198

[willow]

Doing it manually is a pain in the ass, make sure that on the build configuration page your build type is composite, NOT regular. Otherwise it'll yell at you about agents or something.

[jsvensson]

In meterpreter:
exploit/multi/http/jetbrains_teamcity_rce_cve_2024_27198

this isn't the way

it is the way as i found /data/teamcity_server/datadir/config/projects/AllProjects/pluginData/ssh_keys/id_rsa in this docker
for user john

[meoami]

any hints for priv? i got the container

[KattRulez]

Too easy for a medium rated machine

any hints for priv? i got the container

Investigate about volumes in portainer, hope it helps
https://docs.portainer.io/user/docker/volumes/add

---

Hello , did you found a way to esclate from john user? can you give me any hint ?

I post it here so everyone can know.

Look a way to dump the database of TeamCity and search for passwords