TL; DR
Ib pawg ntawm tsib pob npm, luam tawm thoob plaws ob lub account handles, xa ib qho postinstall hook uas nyeem cov ntaub ntawv pov thawj huab los ntawm tus tswv tsev thiab xa lawv tawm ntawm lub thawv. Cov pob khoom muaj cov npe dab thiab pirate - coral-wraith, ecto-corsair-whisper-6f3b9, ecto-corsair-flag-x9m4, ecto-rust-read-f3a9c1, ecto-nightly-spirit — thiab sau txhua yam uas lawv sau tau ua ib qho cuav ecto_module: YAML manifest ua ntej xa nws. Peb taug qab cov cluster li ectoplasm.
Lub payload tsuas yog khiav thaum nws pom ib qho chaw tshwj xeeb: tus tswv tsev uas nws lub npe yog a 12-cim hex string thiab ib daim ntawv qhia ua haujlwm nyob rau hauv /app/node_modules — cov duab ntawm lub thawv tsim lossis CI tus neeg ua haujlwm. Thaum lub rooj vag ntawd dhau mus, tus nuv nug cov AWS instance metadata service (IMDSv2) rau cov ntaub ntawv pov thawj ntawm IAM lub luag haujlwm, suav cov ntaub ntawv AWS Tus Thawj Saib Xyuas Kev Zais Cia hla peb cheeb tsam, pov tseg cov hloov pauv ib puag ncig, nyeem cov ntaub ntawv hauv qab /app, thiab khawb rau cov hlua ntes-tus-flag. Tom qab ntawd nws exfiltrates qhov tshwm sim ob txoj kev: lub teeb liab mus rau ib qho webhook.site tus sau thiab ib qho manifest PUT rau qhov kawg raw-IP, nrog rau daim ntawv teev cov localhost-first fallbacks.
Cov lus piav qhia txog pob khoom tom qab nyeem "CTF payload rau verdaccio supply-chain testing." Peb tshaj tawm qhov kev piav qhia tus kheej ntawd ua qhov tseeb uas pom tau. Tus cwj pwm nws tus kheej - nyob tawm mus rau IP pej xeem, nyeem IMDS daim ntawv pov thawj tiag tiag, hu rau Secrets Manager tiag tiag - yog qhov nws yog tsis hais lub npe, thiab yog vim li cas cov versions no tau raug cais ua phem.
Ib lub npe nyob rau hauv pawg, coral-wraith, tsis tau xaus rau ntawm ib qho kev tso tawm xwb. Nws tau rov luam tawm dua sai sai los ntawm ntau kaum tawm versions hauv ob peb teev xwb - 1.0.0 nce mus rau 6.0.0 — thiab ib qho kev khiav ua ntej ntawm tib lub npe tau siv inflated 9999.0.x cov lej version, cov duab classic ntawm ib kev sim ua kom tsis meej pem ntawm kev vam khomhla qhov ntawd churn lub payload pom tseeb matured: los ntawm ib-shot host-enumeration beacon mus rau hauv AWS daim ntawv pov thawj pivot tag nrho qhwv hauv kev kuaj xyuas ib puag ncig uas ua rau nws nyob ntsiag to sab nraum nws lub hom phiaj npaj tseg.
| Tej pob khoom | 5 lub npe; coral-wraith nyob ib leeg rov luam tawm thoob plaws ntau kaum ob versions |
| ecosystem | npm |
| Nruab vector | postinstall tsab ntawv sau txog lub neej |
| Lub hom phiaj tseem ceeb | Cov ntaub ntawv pov thawj ntawm AWS IAM lub luag haujlwm + Cov nqi zais cia ntawm Secrets Manager, cov hloov pauv ib puag ncig, /app cov ntaub ntawv |
| Exfil | webhook.site beacon + raw-IP C2 PUT |
| Lub rooj vag qhib | 12-hex lub npe tswj hwm + /app/node_modules cwd, ntxiv rau kev kuaj xyuas ib puag ncig uas tswj cov payload sab nraum qhov xwm txheej ntawd |
| Qhov tseem ceeb | siab — daim ntawv pov thawj huab thiab kev tshaj tawm zais cia los ntawm Cov chaw tsim khoom thiab cov chaw ua haujlwm hauv lub thawv |
Kev tawm tsam lub cev
Txhua lub pob khoom hauv pawg tau tsim tib txoj kev: ib qho ze-khoob index.js (module.exports = {}), ib kab pob.json tsab ntawv sau — “postinstall”: “node postinstall.js” - thiab qhov hnyav ntawm lub load postinstall.js. Kev txhim kho lub pob khoom txaus kom khiav lub hook; tsis tas yuav import lossis hu.
Lub rooj vag tsom. Ua ntej ua ib yam dab tsi, ecto-family payload xyuas nws ib puag ncig:
function isAppWorker(): host = os.hostname() if host does NOT match /^[0-9a-f]{12}$/ -> exit if cwd does NOT contain "/app/node_modules" -> exit if cwd contains "/tmp/npm-safe" -> exit otherwise -> proceedLub npe hostname 12-hex yog lub qauv qub uas Docker muab rau lub thawv, thiab /app/node_modules yog ib txoj kev teeb tsa hauv lub thawv ib txwm muaj. Kab lus thib peb tiv thaiv yog tias txoj kev zoo li daim nplaub tshev rho tawm hauv sandboxed. Qhov cuam tshuam tiag tiag yog tias qhov payload nyob twj ywm ntawm lub laptop tsim tawm lossis lub sandbox tshuaj xyuas thiab tsuas yog ua haujlwm hauv lub thawv tsim lossis lub sijhawm ua haujlwm - hom ib puag ncig uas yuav nqa cov ntaub ntawv pov thawj huab nyob. Lub pob khoom qub tshaj plaws hauv pawg, tus dab phem coral, tsis muaj lub rooj vag zoo li no thiab khiav nws cov khoom sau (yooj yim dua) yam tsis muaj kev txwv.
CollectionThaum lub rooj vag hla mus, tus nuv yuav tawm los ntawm execFileSync(“/bin/sh”, [“-c”, …]) thiab khiav ib qho lus txib sib xyaw ua ke uas, raws li kev txiav txim:
1. PUT /latest/api/token to 169.254.169.254 (IMDSv2 token request) 2. GET .../iam/security-credentials/ (IAM role name) 3. GET .../iam/security-credentials/<role> (temporary credentials) 4. dump env | sort (environment variables) 5. list /app (excl. node_modules) + cat first 15 (application files) 6. aws secretsmanager list-secrets (us-east-1, eu-west-1, eu-central-1) 7. scrape readable files for HTB{...} (capture-the-flag strings)Cov Kauj Ruam 1–3 yog phau ntawv kawm IMDSv2 nrhiav: thov ib lub cim qhia kev sib tham, tom qab ntawd muab nws txuas ua X-aws-ec2-metadata-token header kom rub lub luag haujlwm IAM ntawm lub instance thiab lub luag haujlwm ntawd cov yuam sij nkag mus ib ntus. Kev xaiv los siv IMDSv2 es tsis yog IMDSv1 uas tsis tau lees paub yooj yim dua. TAU tsim nyog sau tseg - nws txhais tau tias qhov payload ua haujlwm txawm tias ntawm cov piv txwv teeb tsa kom xav tau kev nkag mus rau metadata raws li token, uas yog AWS-pom zoo hardening. Cov ntaub ntawv pov thawj xa rov qab los ntawm kauj ruam 3 yog luv luv Tus lej nkag mus/SecretAccessKey/Token peb npaug tsom mus rau lub luag haujlwm ntawm qhov piv txwv; txawm yog lub luag haujlwm ntawd ua tau dab tsi los xij, tus tuav cov yuam sij ntawd tuaj yeem ua tau rau lub neej ntawm daim ntawv pov thawj.
Cov Kauj Ruam 4–6 ua kom txoj kev xav dav dua. kwv yees cov ntaub ntawv pov tseg ntes txhua yam uas cov txheej txheem tsim lossis lub sijhawm khiav tau txais los ntawm - hauv kev xyaum qhov no yog qhov chaw sau npe cov cim npe, cov hlua txuas database, thiab cov yuam sij API feem ntau nyob. /app kev taug kev ntawm cov ntaub ntawv nyeem txog kaum tsib daim ntawv thov sab nraud node_modules, uas tuaj yeem teeb tsa qhov chaw, .env cov ntaub ntawv, lossis qhov chaw. Kauj ruam 6 hu aws secretsmanager daim ntawv teev-secrets hauv peb cheeb tsam; cov ntaub ntawv pov thawj rub tawm hauv cov kauj ruam 1–3 yog qhov tseeb uas lees paub cov kev hu xov tooj ntawd, yog li IMDS nyeem thiab Secrets Manager enumeration saw ua ke rau hauv ib qho kev nce qib: lub luag haujlwm piv txwv → tswj hwm-zais cia cov khoom muag. Kauj ruam 7 yog lub nod rau capture-the-flag framing - thaum ib qho HTB{…} pom tus chij nws raug xa mus rau nws tus kheej, txwv tsis pub cov blob raw uas tau sau los raug txiav ua plaub daim thiab xa mus.
Cov qauv tom qab hauv pawg neeg nqa qhov kev nce qib ntxiv. Es tsis txhob nres ntawm cov khoom muag, lawv txheeb xyuas cov lus teb IMDS, xa tawm cov yuam sij ib ntus raws li AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN cov hloov pauv ib puag ncig, lees paub qhov tseeb nrog aws sts get-caller-identity, thiab tom qab ntawd rov ua dua txhua qhov zais cia rov qab los ntawm daim ntawv teev lus zais hu aws secretsmanager get-secret-value ntawm txhua - rov qab tau cov ntsiab lus zais cia, tsis yog lawv lub npe xwb. Cov qauv qub kuj nyeem cov txheej txheem hloov cov chij binaries (/nyeem chij thiab cov phooj ywg) thiab sim ua ib qho kev thauj khoom tawm tsam txhua qhov project Rust pom nyob rau hauv /app, nthuav dav qhov kev sau qoob loo dhau ntawm cov ntaub ntawv pov thawj huab mus rau txhua yam uas qhov chaw tsim kho pom.
Cov qauv tom qab no kuj tseem ua rau lawv tus kheej nruj dua. Ntxiv rau 12-hex-hostname thiab /app/node_modules kev kuaj xyuas, lub payload tshuaj xyuas qhov kev teeb tsa pob khoom-npe thiab txoj kev ua haujlwm-directory thiab tawm ntsiag to thaum lawv qhia txog kev tshuaj xyuas lossis daim iav ntsiab lus es tsis yog lub hom phiaj nyob. Qhov cuam tshuam ua ke yog lub payload uas tsis ua dab tsi pom tau hauv feem ntau qhov chaw tshuaj xyuas thiab khiav nws cov khoom sau tag nrho tsuas yog qhov twg nws txiav txim siab nws tus kheej nyob rau ntawm lub thawv ntim khoom tiag tiag.
ExfiltrationCov ntaub ntawv sau tau tawm hauv tus tswv tsev ntawm ob txoj kab ke. Ua ntej, lub teeb liab NCEJ mus rau qhov ruaj khov webhook.site tus sau, nqa lub npe hostname, tus lej UID, daim nplaub tshev ua haujlwm, thiab txog li 120 KB ntawm cov ntaub ntawv sau. Qhov thib ob, cov ntaub ntawv raug muab tais rau hauv YAML "module manifest" cuav thiab muab rau /api/modules/ ntawm lub server uas koj xav tau:
ecto_module: name: "<flag-or-chunk-0>" version: "1.0.0" power_level: "<chunk-1>" ship_deck: "<chunk-2>" cargo_hold: "<chunk-3>"Cov npe ntawm cov teb manifest (theem fais fab, lub nkoj, tuav khoom) yog kev kho kom zoo nkauj - cov ntaub ntawv raug nyiag caij mus rau hauv cov nqi hlua, uas yog vim li cas tus saib xyuas network pom qhov zoo li qhov xa tawm pob khoom-registry manifest es tsis yog qhov pov tseg cov ntaub ntawv pom tseeb. Lub beacon channel nqa ntau dua: tus NCEJ lub cev rau webhook.site suav nrog lub npe hostname, tus lej UID, daim nplaub tshev ua haujlwm, thiab txog li 120 KB ntawm cov blob sau, yog li txawm tias ib qho beacon ua tiav xa tag nrho cov txiaj ntsig. webhook.site yog ib qho kev pabcuam tshuaj xyuas kev thov dawb; siv nws ua tus sau txhais tau tias tus neeg teb xov tooj yeej tsis tas yuav sawv ntsug txais cov khoom siv ntawm lawv tus kheej rau qhov channel ntawd, thiab cov kev thov kaw tseg yuav nyob hauv lub thoob khib nyiab ntawm qhov kev pabcuam.
Daim ntawv qhia muab taug kev ib daim ntawv teev npe rov qab uas pib nrog ntau yam 127.0.0.1/localhost cov chaw nres nkoj thiab tom qab ntawd poob mus rau peb qhov chaw nyob rau hauv `154.57.164.0/24` ntau yam, nres ntawm thawj qhov kawg uas teb nrog 2xx xwm txheej. Qhov kev txiav txim localhost-thawj zaug yog sib xws nrog "verdaccio testing" tus kheej piav qhia (lub npe hauv zos ntawm loopback), tab sis cov pej xeem-IP fallbacks txhais tau tias cov ntaub ntawv tawm ntawm tus tswv tsev thaum twg loopback tsis mloog - uas yog hais, ntawm txhua lub tshuab uas tsis yog tus sau tus kheej lub cuab yeej sim.
Ncua sij hawm
Cov pawg qhia txog kev loj hlob ntawm lub peev xwm ntxiv es tsis yog ib qho poob. Peb txiav txim nws los ntawm kev pom tus cwj pwm, tsis yog los ntawm kev tshaj tawm phab ntsa-muab tawm:
Qhov tseem ceeb ntawm pawg yog nws qhov kev tshaj tawm: es tsis yog ib pob thiab ib qho version, tib lub npe raug tshaj tawm dua thiab dua hauv kev sib law liag sai, txhua tus tso tawm qhov sib txawv me me ntawm qhov kawg, nrog rau ob peb tug kwv tij sib txawv uas nqa tib lub payload. Hauv ntxhi tsev neeg cov lej faib ua ob lub cim ntiv tes ze - ib pawg tripping ob qhov kev kuaj pom tseem ceeb, lwm peb (lub dab dej nyeem cov ntaub ntawv ntxiv) - tab sis ob qho tib si daws teeb meem rau tib lub payload; qhov sib txawv yog code drift, tsis yog kev coj cwj pwm. Cov versions ntawm ntxhi dhau ntawm qhov ntau yam uas tau tshuaj xyuas (txog li tsawg kawg 1.0.25 thaum lub sijhawm sau ntawv) tau pom nyob rau ntawm daim ntawv sau npe, thiab tus dab phem coral lub npe txuas ntxiv nce nws tus kheej lub ntaiv hla lub qhov rais tib yam.
Cov cim qhia txog kev sib haum xeeb
Tag nrho cov cim qhia hauv qab no tau rho tawm los ntawm pob khoom ntawm disk. Cov cim qhia network tau raug tshem tawm.
network
Kev coj cwj pwm/cov ntaub ntawv
Cov ntaub ntawv hashes (sha256, ntes tau thaum lub sijhawm tshuaj xyuas)
Kev Ua Tus Kheej & Kev Coj Tus Cwj Pwm Uas Tau Pom
Tsib lub npe pob khoom tau luam tawm nyob rau hauv ob lub npm account handles, tab sis lawv sib koom txaus infrastructure los kho lawv ua ib pawg: tib yam ecto_module daim duab qhia meej, tib yam ECT-472839 lub cim qhia lub dab dej tseem ceeb, tib yam webhook.site Tus lej sau, thiab C2 qhov kawg hauv tib qho 154.57.164.0/24` thaiv. Lub pob noob (`coral-wraith, yooj yim dua thiab ungated) thiab tsev neeg gated ecto yog li nyeem ua qhov rov ua dua ntawm ib qho cuab yeej es tsis yog kev siv zog ywj pheej.
Cov pob khoom piav qhia lawv tus kheej, hauv cov qauv tom qab, raws li "CTF payload rau verdaccio kev sim cov khoom xa tuaj." Peb tshaj tawm daim ntawv lo ntawd ua qhov tseeb uas pom tau thiab tsis rov hais dua nws ua qhov kev tshawb pom txog lub hom phiaj. Qhov uas cov lej ua yog qhov tseeb thiab ywj pheej ntawm nws tau cim li cas: nws nyeem cov ntaub ntawv pov thawj IAM lub luag haujlwm los ntawm cov kev pabcuam metadata piv txwv, suav cov lus zais tswj hwm thoob plaws peb thaj tsam AWS, thiab xa cov txiaj ntsig mus rau IP pej xeem thiab tus neeg sau webhook thib peb. Ib qho kev sim loopback-xwb tiag tiag yuav tsis xav tau daim ntawv teev npe rov qab pej xeem-IP, IMDS cov ntaub ntawv pov thawj nyeem, lossis hla thaj tsam Secrets Manager hu. Vim tias qhov egress thiab credential ncav cuag yog qhov tseeb, cov gated versions tau raug cais ua phem.
Lub rooj vag tsuas yog lub thawv yog qhov tseem ceeb tshaj plaws hauv kev ua haujlwm. Nws yog ob qho tib si kev ntsuas kev zam - nyob ntsiag to ntawm cov laptops thiab hauv kev tshuaj xyuas sandboxes - thiab kev ntsuas kev tsom mus rau, tua tsuas yog qhov twg lub luag haujlwm IAM tiag tiag thiab cov lus zais nyob yuav muaj feem ntau. Cov kws tshuaj ntsuam xyuas khiav cov pob no hauv lub thawv sandbox dav dav yuav tsis pom dab tsi; tus cwj pwm tsuas yog tshwm sim hauv qab Docker-style hostname thiab txoj hauv kev teeb tsa hauv-thawv.
Kev cuam tshuam, cov qauv & kev taw qhia rau cov neeg tiv thaiv
Qhov kev nthuav tawm ntawm no yog cov ntaub ntawv pov thawj huab thiab kev qhia zais cia hauv cov thawv tsim thiab lub sijhawm khiav. Daim ntawv pov thawj lub luag haujlwm IAM rub los ntawm IMDS nqa txhua qhov kev tso cai uas lub luag haujlwm tuav; secretsmanager: Daim Ntawv Teev Cov Lus Qhia (thiab txhua yam kev ua raws li Tau Txais Tus Nqi Zais Cia) nthuav dav qhov ntawd mus rau cov lus zais cia ntawm daim ntawv thov. Cov chaw pov tseg ib puag ncig feem ntau nqa cov cim npe sau npe, cov URL ntawm cov ntaub ntawv hauv paus ntaub ntawv, thiab cov yuam sij API. Hauv CI lossis lub thawv - raws nraim li lub rooj vag xaiv rau - ib qho kev teeb tsa hloov pauv ntawm ib qho ntawm cov pob no txaus kom xau cov ntaub ntawv ntawd.
Ectoplasm haum rau tus qauv uas peb tseem pom: cov payloads uas siv sijhawm teeb tsa uas ncav cuag cov metadata huab thiab cov lus zais uas tswj hwm es tsis yog cov ntaub ntawv hauv zos, thiab qhov ntawd qhib lawv tus kheej kom tua hluav taws tsuas yog hauv cov chaw muaj nqis siab. Ob qho kev soj ntsuam tiv thaiv ua raws.
- Cov duab no pom tauIb qho npm/PyPI install hook uas nws daim duab hu xov tooj ncav cuag ob qho tib si cloud secrets API (aws secretsmanager, gcloud cov lus zais, az keyvault) lossis qhov chaw nyob IMDS thiab lub network egress sink yog ib qho qauv nqaim, muaj teeb liab siab - nws yuav luag tsis tshwm sim hauv tsab ntawv sau txog lub neej raug cai. Kev tshuaj xyuas dej ntws zoo li qub tuaj yeem cim nws yam tsis tas yuav nyob ntawm ib qho chaw sau npe lossis IP tshwj xeeb.
- Kev ua kom ib puag ncig ruaj khov ua rau nws tsis khov. Kev siv IMDSv2 nrog qhov txwv hop ntawm 1 tiv thaiv cov haujlwm thawv kom tsis txhob ncav cuag cov metadata piv txwv; kev ntsuas IAM lub luag haujlwm rau qhov tsawg kawg nkaus txoj cai txwv qhov tawg ntawm txhua daim ntawv pov thawj uas xau; thiab khiav kev teeb tsa nrog –tsis quav ntsej cov ntawv sau hauv CI tshem tawm cov vector install-hook tag nrho rau cov pob khoom uas tsis xav tau nws.
Rau cov neeg tiv thaiv, cov kev kuaj xyuas uas siv tau yog: ceeb toom txog kev sib txuas tawm ntawm cov thawv tsim / CI mus rau cov IP pej xeem uas tsis tau tso cai thaum lub sijhawm npm nruab; saib xyuas IMDS nkag los ntawm cov ntawv sau txog lub neej ntawm pob khoom; thiab kho txhua qhov kev teeb tsa uas siv rau huab CLI raws li qhov tsis ntseeg kom txog thaum muaj pov thawj lwm yam.
Ob daim ntawv ntxiv tshwj xeeb rau pawg no. Ua ntej, vim tias kev ua kom ua haujlwm yog gated rau cov chaw ntim khoom, ib pob khoom uas zoo li inert thaum kuaj xyuas ntawm lub chaw ua haujlwm tseem tuaj yeem nyob hauv kev tsim khoom - kev kuaj xyuas yuav tsum rov ua dua lub npe host thiab txoj kev, lossis nyeem qhov chaw ncaj qha, es tsis txhob cia siab rau "Kuv tau teeb tsa nws thiab tsis muaj dab tsi tshwm sim." Qhov thib ob, kev siv cov kev pabcuam pej xeem thov-tshuaj xyuas ua tus sau beacon txhais tau tias qee cov ntaub ntawv exfiltrated yuav rov qab tau rau qhov xwm txheej teb: ib lub koom haum uas pom ib qho ntawm cov pob khoom no hauv nws tsob ntoo vam khom tuaj yeem xav txog qhov beacon ua tiav yuav muaj dab tsi los ntawm payload's sau logic, thiab yuav tsum tig txhua qhov IAM lub luag haujlwm credentials, registry tokens, thiab cov secrets tswj hwm uas tau ncav cuag los ntawm kev tsim kho lossis runtime ib puag ncig cuam tshuam. Kev hloov pauv daim ntawv pov thawj, tsis yog kev tshem tawm pob khoom, yog qhov kev kho kom rov zoo thaum lub sijhawm teeb tsa tau khiav.
