Adding a Secondary Artifactory Admin Account
In addition to the vectors we’ve already explored,
we can also gain access to Artifactory by adding a secondary administrator account
through a built-in backdoor.
If an administrator account is corrupted, or they lose access to the system,
Artifactory offers an alternative option for gaining administrative access.
This method requires a restart of the Artifactory process,
meaning there is some risk of data corruption or production downtime.
As a result, this may not be an appropriate solution for all engagements.
This approach requires write access to the access folder,
and the ability to change permissions on the newly-created file,
which usually requires root or sudo access.
First, we need to create a file through sudo called bootstrap.creds,
providing the credentials for the account we want to add.
This will create a new user called “haxmin”
with the displayed password.
Next, we’ll need to chmod the file to 600.
For this user to be created, we need to restart the Artifactory process.
Because Artifactory is being run as a daemon process, we can stop it,
and then restart it.
During the restart stage, Artifactory will load our bootstrap credential file
and process the new user.
We can verify this by examining the console.log file,
for the string “Create admin user”.
Once Artifactory is running again,
we can log in with our newly-created account.
We now have admin access to Artifactory and can modify binaries as we see fit.
In a real-world scenario, if the user was using Artifactory as a repository,
running an update on their local system
would trigger a download of the updated binary.
The next time the binary is run by the user, they would be compromised.
The same would occur if Artifactory was being used as a simple file store
for shared binary files.
Any subsequent downloads of our updated file
would result in the user being compromised.
Artifactory is an excellent option for compromising
many targets in a single effort
and can help to expand access significantly
within an internal network.