teamcity-CVE-2026-63077-pcap

teamcity teamcity-CVE-2026-63077 exploitation pcap

info: https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/

https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/

Target: teamcity server 2025.11.3 (docker) 192.168.64.31 port 8111

Exploit: https://github.com/sfewer-r7/CVE-2026-63077 - ran from 192.168.64.32 w/ command to curl webhook.site

pcap might be useful for testing suricata rules.

from_honeypot* files - tar has java samples that were dropped. pcap has traffic associated with the exploitation. obviously, the files are from honeypot/real attacks.