Introductie van Team Foundation Server decryption tool

Twee nieuwe tools om gevoelige informatie te decoderen

Introductie van Team Foundation Server decryption tool

Tijdens penetratietesten komen we soms servers tegen met software die gevoelige informatie gebruikt als onderdeel van het onderliggende proces, zoals Microsoft’s Team Foundation Server (TFS). TFS kan worden gebruikt voor de ontwikkeling van code, versiebeheer en automatische inzet op targetsystemen. Deze blogpost biedt twee tools om gevoelige informatie die is opgeslagen in de TFS-database te decoderen.

Deze blog is alleen in het Engels beschikbaar.

Decrypting TFS secrets

Within Team Foundation Server (TFS), it is possible to automate the build, testing and deployment of new releases. With the use of variables it is possible to create a generic deployment process once and customize it per environment.1 Sometimes specific tasks need a set of credentials or other sensitive information and therefor TFS supports encrypted variables. With an encrypted variable the contents of the variables is encrypted in the database and not visible for the user of TFS.

TFS_Variable

However, with the correct amount of access rights to the database it is possible to decrypt the encrypted content. Sebastian Solnica wrote a blogpost about this, which can be read on the following link: https://lowleveldesign.org/2017/07/04/decrypting-tfs-secret-variables/

Fox-IT wrote a PowerShell script that uses the information mentioned in the blogpost. While the blogpost mainly focused on the decryption technique, the PowerShell script is built with usability in mind. The script will query all needed values and display the decrypted values. An example can be seen in the following screenshot:

tfs_decrypted

The script can be downloaded from Fox-IT’s Github repository: https://github.com/fox-it/Decrypt-TFSSecretVariables

It is also possible to use the script in Metasploit. Fox-IT wrote a post module that can be used through a meterpreter session. The result of the script can be seen in the screenshot below.

msf_tfs

There is a pull request pending and hopefully the module will be part of the Metasploit Framework soon. The pull request can be found here: https://github.com/rapid7/metasploit-framework/pull/9930

References

[1] https://docs.microsoft.com/en-us/vsts/build-release/concepts/definitions/release/variables?view=vsts&tabs=batch
[2] https://lowleveldesign.org/2017/07/04/decrypting-tfs-secret-variables

Nu bij Fox-IT

Neem contact op

+31 (0) 15 284 79 99

fox@fox-it.com

Delft