Unauthenticated RCE in JetBrains TeamCity Agent Polling Protocol

The repository contains one standalone Python 3 exploit (`CVE-2026-63077.py`) and a README. It claims to exploit CVE-2026-63077, an unauthenticated deserialization flaw in JetBrains TeamCity's agent-polling/error workflow. The script uses only Python standard-library modules and is not part of a known exploit framework. It generates random agent, database, table, column, JSP-file, guard, and response-token values; posts agent-registration XML; then posts a crafted serialized `linked-hash-map` payload intended to drive HSQLDB into writing a JSP scriptlet into the TeamCity webroot. Fetching the resulting randomized `.jspws` resource runs a supplied `bash -c` command and returns command output. The JSP contains a one-time application guard and self-deletes before execution. The tool supports individual targets, threaded target-list processing, output logging, payload debugging, and an interactive command loop. The README documents the intended chain and defaults; the displayed interactive-shell URL uses a placeholder (`xxxxxxxx.jspws`) even though actual payload filenames are randomized.

Repository contains a Python proof-of-concept exploit (exploit.py) and a descriptive README. The exploit targets JetBrains TeamCity On-Premises CVE-2026-63077, described as an unauthenticated deserialization flaw in the agent polling protocol leading to remote code execution. The code is standalone Python using only the standard library, with exploit.py as the clear entry point. Core exploit flow: it generates random identifiers/tokens, builds an agent registration XML document with a spoofed agent address 127.0.0.1:9090, obtains a temporary TeamCity agent session, then submits a crafted XML payload to /app/agents/v1/commands/error. The payload appears designed to abuse server-side deserialization and HSQLDB scripting behavior to write a JSP file into a relative web root path ../webapps/ROOT/<random>.jspws. That JSP is a one-shot scriptlet that executes an attacker-supplied command via bash -c, returns stdout/stderr in the HTTP response, appends a response token for success detection, and attempts to delete itself after first execution. The exploit then requests the generated JSP path over HTTP(S), checks for the expected token in the response, strips HSQLDB-related wrapper text from output, and records successful command results to result.txt. The README documents single-target and multi-target usage, notes disabled TLS verification, and highlights operational limitations such as dependence on bash and the hard-coded web-root path. Overall, this is a real offensive PoC for unauthenticated network/web exploitation that provides arbitrary command execution rather than mere detection.

Repository contains a single Python proof-of-concept exploit and a README. The main file, CVE-2026-63077.py, targets JetBrains TeamCity CVE-2026-63077 and performs unauthenticated RCE through TeamCity agent polling functionality. The exploit flow is: generate randomized identifiers; build synthetic agent registration XML; register to /app/agents/v1/register; craft a malicious XStream gadget graph that instantiates an HSQLDB datasource and uses connectionInitSqls to create a table, insert a JSP scriptlet, and write it into the TeamCity webroot as a randomized .jspws file; submit that XML to /app/agents/v1/commands/error with TeamCity session headers; then request the dropped JSPWS path to execute the attacker-supplied OS command. The JSP payload is intentionally one-shot: it sets an application guard attribute, deletes its own source file, launches Runtime.exec(command), and prints a random token only if execution reaches that point. The README documents usage, expected output, and the underlying gadget chain. Overall, this is a real exploit PoC rather than a scanner: it provides direct command execution capability but does not include a reusable interactive shell framework or payload customization beyond the supplied command string.