Incident Response Report: JetBrains TeamCity — Auth Bypass, Web Shell & Credential Tampering

Platform: CyberDefenders Challenge: JetBrains Category: Network Forensics Difficulty: Medium Tools: Wireshark, AbuseIPDB Achievement: Proof of Completion

1. Executive Summary

Incident Type: CI/CD Server Compromise / Authentication Bypass / Web Shell Deployment / Credential Tampering

Exploited Application: JetBrains TeamCity 2023.11.3 (build 147512)

A packet capture (Capture.pcap) was collected after anomalous traffic was detected against a JetBrains TeamCity CI/CD server. Analysis of the full PCAP reconstructs a complete multi-phase attack chain:

The attacker (23.158.56.196) first performed a brute-force attack against the TeamCity login page, then pivoted to exploit CVE-2024-27198 — a critical authentication bypass in the TeamCity REST API that allowed account creation without valid credentials. Using the newly created administrator account, the attacker uploaded a JSP web shell via the plugin upload mechanism, executed system commands through it (including a Docker container escape), and finally tampered with existing user credentials to establish persistent backdoor access.

Indicators of Compromise (IOCs)

Type	Indicator	Description
TeamCity Server	3.71.79.4:8111	Targeted CI/CD server
Attacker IP	23.158.56.196	External threat actor (GTHost, Frankfurt, Germany)
Internal Server	172.31.25.119	TeamCity internal/backend IP
Docker Network	172.17.0.2	Container reverse proxy / Docker bridge
Exploited App	TeamCity 2023.11.3 (build 147512)	Vulnerable to CVE-2024-27198
CVE	CVE-2024-27198	Authentication bypass in TeamCity REST API
Auth Bypass Endpoint	/hax?jsp=/app/rest/server;.jsp	Semicolon injection path traversal
Created Account	c91oyemw	Rogue SYSTEM_ADMIN account created via API
Account Password	CL5vzdwLuK	Credential set during API account creation
Web Shell Name	NSt8bHTg.zip / NSt8bHTg.jsp	Malicious plugin uploaded via /admin/pluginUpload.html
Web Shell Path	/plugins/NSt8bHTg/NSt8bHTg.jsp	Active shell endpoint after plugin installation
Tampered Credential File	/tmp/Creds.txt	File written via web shell command execution
MITRE Technique	T1565.001	Stored Data Manipulation — credential file tampering

MITRE ATT&CK Mapping Overview

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application (TeamCity CVE-2024-27198)	T1190
Persistence	Create Account — REST API admin creation	T1136.001
Execution	Server-Side Web Shell (JSP)	T1505.003
Privilege Escalation	Valid Accounts — Rogue Admin	T1078
Defense Evasion	Container Escape via Docker	T1611
Impact	Stored Data Manipulation — Credential Tampering	T1565.001

---

2. Phase 1: Network Triage — Identifying the Attacker (Questions 1–3)

Objective: Identify the attacker’s IP, the targeted server, and the number of endpoints in the capture.

Opening Capture.pcap in Wireshark and navigating to Statistics → Endpoints immediately reveals the full set of IP addresses communicating in this capture.

The Conversations view (Statistics → Conversations → IPv4) confirms the attacker’s primary communication path: 23.158.56.196 ↔ 172.17.0.2 with 4,166 packets and 2 MB of data — the heaviest external conversation in the capture.

Cross-referencing 23.158.56.196 on AbuseIPDB confirms it is associated with prior malicious activity — reported for web app attacks and brute-force attempts, registered to GTHost (Frankfurt, Germany, AS63023).

Answer Q1

What is the attacker’s IP address?

23.158.56.196

Answer Q2

What is the IP address of the targeted TeamCity server?

3.71.79.4

Answer Q3

How many IPv4 endpoints are present in the packet capture?

411

---

3. Phase 2: Brute-Force Attack (Questions 4–5)

Objective: Identify the brute-force target endpoint and the number of attempts made.

Applying the Wireshark filter ip.addr == 23.158.56.196 && http isolates all HTTP traffic from the attacker. Scrolling through the early packets reveals a high-volume sequence of POST requests to /loginSubmit.html — the TeamCity authentication endpoint — returning alternating 200 and 401 status codes.

The 401 responses confirm failed authentication attempts. The pattern of request sizes (1388 bytes, 1396 bytes, 1132 bytes) reflects different credential pairs being submitted. The attacker also probed /authenticationTest.html?csrf — TeamCity’s CSRF token endpoint — between attempts, indicating an automated tool aware of TeamCity’s form-based authentication flow.

Answer Q4

What endpoint was targeted during the brute-force attack?

/loginSubmit.html

Answer Q5

What HTTP status code indicated failed login attempts?

401

---

4. Phase 3: CVE-2024-27198 Authentication Bypass (Questions 6–9)

Objective: Identify the CVE exploited, the bypass endpoint, the rogue account created, and the TeamCity version.

After the brute-force phase, the attack changes character entirely. A new request pattern appears: GET requests to /hax?jsp=/app/rest/server;.jsp — a non-standard path that weaponizes a semicolon injection flaw in TeamCity’s URL routing.

Searching for TeamCity 2023.11.3 CVE confirms this is CVE-2024-27198 — a critical authentication bypass disclosed in March 2024 that allows unauthenticated access to the TeamCity REST API by appending ;.jsp to any URL path. The CVSS score is 9.8 (Critical).

Following the TCP stream of the CVE exploitation request shows the server’s XML response confirming the exact TeamCity build information — and then a POST request that creates a new user account with SYSTEM_ADMIN privileges:

The attacker then navigated to the admin panel (/admin/admin.html?item=plugins) to confirm their access — the HTTP response confirms the admin panel was served:

Answer Q6

What CVE was exploited for authentication bypass?

CVE-2024-27198

Answer Q7

What endpoint did the attacker use to exploit the vulnerability?

/hax?jsp=/app/rest/server;.jsp

Answer Q8

What username and password were used for the rogue admin account?

c91oyemw : CL5vzdwLuK

Answer Q9

What version of TeamCity is running on the server?

2023.11.3

---

5. Phase 4: Web Shell Upload & Deployment (Questions 10–12)

Objective: Identify the web shell filename, the upload endpoint, and the mechanism used.

With admin access secured, the attacker navigated to the plugin management interface and uploaded a malicious plugin archive. The POST requests filter http.request.method == "POST" && ip.src == 23.158.56.196 reveals the sequence clearly:

Following the TCP stream of the plugin upload packet reveals the full multipart form-data payload. The uploaded file is NSt8bHTg.zip — a specially crafted TeamCity plugin archive containing a JSP page that accepts a cmd GET/POST parameter and executes it via ProcessBuilder:

After the upload, the plugin is automatically installed and activated. All subsequent attacker requests are POST to /plugins/NSt8bHTg/NSt8bHTg.jsp:

Answer Q10

What is the filename of the uploaded web shell?

NSt8bHTg.jsp

Answer Q11

What endpoint was used to upload the web shell?

/admin/pluginUpload.html

Answer Q12

What parameter does the web shell accept for command execution?

cmd

---

6. Phase 5: Container Escape & Credential Tampering (Questions 13–15)

Objective: Reconstruct the commands executed via the web shell, identify the container escape, and document the credential tampering.

Following the web shell communication streams reveals the full command execution chain. One stream stands out — a request where the cmd value (URL-decoded) contains a Docker-specific command sequence designed to escape the container and execute a command on the host:

A separate web shell stream shows credential tampering — the attacker used the web shell to write a specially crafted string to a credentials file at /tmp/Creds.txt:

MITRE ATT&CK T1565.001 (Stored Data Manipulation) maps precisely to this action — the attacker is inserting false credential data into a file to influence downstream processes or mislead incident responders:

Answer Q13

What command was used to escape the Docker container?

docker run --rm -it -v /:/host ubuntu chroot /host

Answer Q14

What file did the attacker write to during the credential tampering phase?

/tmp/Creds.txt

Answer Q15

What MITRE ATT&CK technique does the credential file tampering represent?

T1565.001 — Stored Data Manipulation

---

7. Conclusion

The JetBrains investigation reconstructs a clean, multi-phase CI/CD server compromise that required no user interaction and no prior credentials — only a vulnerable, internet-exposed TeamCity instance.

1. Reconnaissance: AbuseIPDB confirmed 23.158.56.196 as a known threat actor IP prior to the incident.
2. Brute-Force: Automated credential stuffing against /loginSubmit.html (401 responses) — ultimately unsuccessful, but used to profile the login mechanism.
3. Authentication Bypass: CVE-2024-27198 semicolon injection against /hax?jsp=/app/rest/server;.jsp — unauthenticated SYSTEM_ADMIN account creation in a single API call.
4. Web Shell: TeamCity plugin upload mechanism abused to deploy NSt8bHTg.jsp — a full OS command execution shell disguised as a plugin.
5. Container Escape: Docker privileged container mount used to access host filesystem.
6. Impact: Credential file tampered at /tmp/Creds.txt — Stored Data Manipulation (T1565.001).

Key Takeaways for the SOC:

1. CVE-2024-27198 is trivially exploitable — a single HTTP request creates a SYSTEM_ADMIN account with no authentication required. Any TeamCity instance below version 2023.11.4 is critically exposed if network-accessible.
2. Plugin upload = code execution in TeamCity. Restrict plugin upload permissions to dedicated service accounts and audit the plugin directory regularly for unexpected .jsp or .jar files.
3. Docker without --security-opt no-new-privileges and without proper namespace isolation allows trivial host filesystem access. Always enforce --cgroupns=private and restrict --privileged flag usage.
4. CI/CD servers are high-value targets — they hold secrets, source code, deployment keys, and often have broad network access. They must be treated as Tier-0 assets with equivalent monitoring and hardening.

---

Analysis Date: April 21, 2026 Analyst: El OMARI Zakaria