Prerequisites

• Python 3.x
• Python libraries
  • To install the dependencies pip3 install -r requirements.txt

Examples

1. Exploit with random username, password, and email:

   root@kitploit:~

   python exploit.py -u http://target.com
   

2. Exploit with specified username, password, and email:

   root@kitploit:~

   python exploit.py -u http://target.com -n admin -p admin123 -e [email protected]
   

Output

Upon successful exploitation, the script prints the URL, username, and password of the created admin account then save the output in token file.

Remote Code Execution (RCE) Script

Description This script allows executing commands on a vulnerable TeamCity server exploiting CVE-2023-42793. It first enables the debug processes and then executes the specified command using the appropriate API endpoints.

Usage

Options

• -u, --url URL : Target URL (required)
• -t, --token-file : TO specify the file containing the token
• -c, --command COMMAND: Specify command to execute (RCE)
• -P, --port PORT: Specify port (default is 80)

Example

Exploit with a specified command:

For reverse shell

• In this command for reverse shell replace {IP} with your ip and {port} with the port you are listening on
• Creat a listener using nc for ex nc -nvlp 5555
• For more check revshells

Notes

• This script has been tested on Runner.htb from hack the box
• This script is for educational purposes only.
• Use it responsibly and only on systems you are authorized to test.

Credits

• Zyad Elsayed
  • GitHub Repository: Zyad-Elsayed
  • LinkedIn account: zyad-abdelbary
• Original Exploit for admin account: ByteHunter (Exploit-DB)

Resources

• CVE-2023-42793 Description: Official description of the CVE vulnerability.
• Exploit Database Entry: Original exploit code on Exploit Database.
• TeamCity Blog: Blog post discussing the CVE-2023-42793 vulnerability in TeamCity.
• TeamCity Documentation: Official documentation for TeamCity.