[marlowfinch42]

TeamCity SYSTEM_ADMIN at a warehouse-automation group in the Nordics. User row, not an
exploit artefact, so patching does not remove it.

Reach: SYSTEM on a domain-joined Windows build host | SQL Server 2017 sysadmin on the same
instance | 28 databases | a deployment-automation database with 1,133 targets, 130 customer
environments, 75 customer identifiers (64 prod-named), 4,632 releases | 296 obscured values, 25 of 85 VCS
roots authenticate as a named person | 15 sysadmin logins including the Domain Admins group.

Not included: no domain admin, no customer or ERP data, no push to the customer hosts, no
persistence.

Verified by builds and catalog reads, SELECT only. 37 audit rows, 0 build records, 0 files
left. Three redacted proofs on request.

Escrow. Domain after escrow.

[marlowfinch42]

EL-1 — summary and contact
TeamCity SYSTEM_ADMIN user row, SYSTEM on a domain-joined build host, and SQL sysadmin on the instance behind it — warehouse-automation group, Nordics, EUR 250M+.

---

WHAT YOU GET

• TeamCity SYSTEM_ADMIN — a user row, not an exploit artefact; patching the instance does not remove it
  
• SYSTEM on a domain-joined Windows build host (Server 2016 class, single AD domain)
  
• SQL Server 2017 sysadmin on the instance that host uses; IS_SRVROLEMEMBER('sysadmin') = 1
  
• 28 databases on that instance, including the deployment-automation database
  

WHAT IT REACHES

• 1,133 deployment targets across 130 numbered customer environments
  
• 75 distinct customer identifiers, 64 production-named
  
• 4,632 releases
  
• 296 obscured values: 77 secure VCS properties and 219 password-typed parameters, deduping to three secrets
  
• 25 of 85 VCS roots authenticate as a named person
  
• 15 logins hold sysadmin, including the domain's Domain Admins group and two named engineers
  

WHAT IT DOES NOT

• No domain admin — a domain group has a login here; that is an inbound path, not a credential we hold
  
• No customer or ERP data
  
• No push to the customer hosts
  
• No persistence
  

PROOF
Verified by queuing builds and reading the catalog with SELECT only. Three redacted proofs on request.
Footprint: 37 audit rows under one account, zero build records, zero files left on the agent.

ESCROW & DELIVERY
Escrow. Domain after escrow.

CONTACT
Session: 056457879f5d86ec1af015e56a31a70104c48801b23710ea2cf542377ceeac5a51
Tox: 01A91BC469691569D4D9840C02417D324FD2DA3552F2F5AACCA8D99896EBBD18EFC66AFDC08C