Compromising Artifactory’s Database
Now that we know how to retrieve user credentials from backup files,
let’s explore a different vector.
If there are no backup files available, we can access the database itself
or attempt to copy it and extract the hashes manually.
As we mentioned previously,
this would assume a scenario in which we have elevated privileges
but want to get access to Artifactory itself.
The open-source version of Artifactory we’re using
locks its Derby database while the server is running.
We could attempt to remove the locks
and access the database directly to inject users,
but this is risky
and often leads to corrupted databases.
A safer option is to copy the entire database to a new location.
Let’s create a new directory and copy the database to a temporary location.
We’ll create a temporary folder in /tmp for the database.
We then copy the database from the original location,
and remove any lock files that exist from the database being in use
when it was copied.
Since Artifactory is using Derby as its default database,
we’ll need Apache’s Derby tools to be able to connect to it.
More specifically, the ij command line tool,
which allows the user to access a Derby database and perform queries against it.
The Derby tools are already installed on the controller,
but they can also be downloaded if necessary.
Fortunately for us, the default database does not require a username and password
and relies on file permissions to protect it.
Because we have root privileges, we can connect without problems.
Artifactory contains its own version of Java,
and we can use it to run the Derby connection utilities and connect
to our database.
The first part of the command calls the embedded version of Java included
as part of Artifactory.
We’re specifying that we want to run the derbyrun.jar JAR file.
The ij parameter indicates that we want to use Apache’s ij tool
to access the database.
The utility presents us with a simple prompt.
It uses SQL syntax commands to manipulate the database.
The command selects all records from the access_users table,
which holds the user records for the Artifactory system.
Each record includes the bcrypt-hashed passwords of the users we found earlier
in our database backup file approach.
As we did previously,
we can crack the hashes using Hashcat or John the Ripper on our Kali VM.