TL; DR
He rōpū o e rima ngā mōkihi npm, i whakaputaina puta noa i ngā kakau pūkete e rua, i tukuna he postinstall he matau e pānui ana i ngā tohu kapua mai i te kaihautū, ā, ka tukuna atu i waho o te pouaka. Kei roto i ngā mōkihi ngā ingoa wairua-me-pāhaia — coral-wraith, ecto-corsair-whisper-6f3b9, ecto-corsair-flag-x9m4, ecto-rust-read-f3a9c1, ecto-nightly-spirit — ā, ka whakarārangihia ngā mea katoa e kohia ana e rātou hei rūpahu ecto_module: te whakaaturanga YAML i mua i te tuku. Ka aroturukihia e mātou te taupū hei ectoplasm.
Ka oma noa te utauta ina kitea he taiao motuhake: he kaihautū ko tōna ingoa ko te Aho hex 12-pūāhua me te kōpaki mahi i raro i /app/node_modules — te āhua o tētahi kaimahi hanga ipu, kaimahi CI rānei. Ina hipa taua kēti, ka pātai te matau ki te Ratonga raraunga tauira AWS (IMDSv2) mō ngā tohu tūranga IAM, ka whakarārangihia Kaiwhakahaere Ngā Mea Huna a AWS puta noa i ngā rohe e toru, ka maka i ngā taurangi taiao, ka pānui i ngā kōnae i raro i /app, ā, ka waruhia ngā aho hopu-te-haki. Kātahi ka tangohia te hua i roto i ngā ara e rua: he tohu ki te webhook.site kaikohikohi me te PUT whakaaturanga ki te pūwāhi IP-mata, me te rārangi o ngā takahuri tuatahi-kaihautū-rohe.
Ko ngā whakaahuatanga o muri mai o te kete e kī ana "CTF payload for verdaccio supply-chain testing." Ka ripoatahia e mātou taua whakaahuatanga-ake hei meka ka kitea. Ko te whanonga tonu — te putanga ora ki tētahi IP tūmatanui, ngā pānui tohu IMDS tūturu, ngā karangatanga a te Secrets Manager tūturu — koia tonu ahakoa te tapanga, ā, koinei te take i whakarōpūtia ai ēnei putanga he kino.
Kotahi te ingoa i roto i te rōpū, coral-wraith, kāore i mutu i te tukunga kotahi. I whakaputaina anō i roto i te tere o te raupapatanga o ngā putanga maha i roto i ngā haora noa iho — 1.0.0 piki ki 6.0.0 — ā, i whakamahia e te rerenga o mua o taua ingoa anō te inflated 9999.0.x ngā tau putanga, te āhua matarohia o te nganatanga whakawhirinaki-pōhēhē. I roto i tēnā, ka hurihia te kawenga kua kitea te pakeke: mai i te tohu tatau-kaihautū kotahi-whakaahua ki roto i te porowhita tohu AWS katoa kua takaihia ki ngā tirotiro taiao e pupuri ana i a ia kia noho puku i waho o tana whāinga e hiahiatia ana.
| Kete | 5 ngā ingoa; coral-wraith i whakaputaina anōtia anake puta noa i ngā putanga maha |
| Te haukori | npm |
| Tāutahia te vector | postinstall tuhinga huringa ora |
| Whāinga matua | Ngā tohu tūranga AWS IAM + Ngā uara ngaro o te Kaiwhakahaere Ngāro, ngā taurangi taiao, /app kōnae |
| Exfil | webhook.site rama + mata-IP C2 PUT |
| Keti whakaoho | Ingoa manaaki 12-hex + /app/node_modules cwd, me tētahi tirotiro taiao e pehi ana i te kawenga i waho o taua horopaki |
| Te kaha | Tino Hāngai — tohu kapua me te whakaaturanga huna-whakahaere mai i ngā taiao hanga me te wā whakahaere kua whakakīia ki roto i ngā ipu |
Anatomi whakaeke
He rite tonu te hanganga o ia mōkihi i roto i te tautau: he mea tata kore kau taurangi.js (module.exports = {}), he rārangi kotahi mōkihi.json tuhinga — "postinstall": "pūpū postinstall.js" — me te kawenga i roto i postinstall.js. He nui te tāuta i te mōkihi hei whakahaere i te matau; kāore he kawemai, he waea rānei e hiahiatia ana.
Te kūaha ūnga. I mua i te mahi i tetahi mea, ka tirotirohia e te kawenga whānau-ecto ōna taiao:
function isAppWorker(): host = os.hostname() if host does NOT match /^[0-9a-f]{12}$/ -> exit if cwd does NOT contain "/app/node_modules" -> exit if cwd contains "/tmp/npm-safe" -> exit otherwise -> proceedKo te ingoa manaaki 12-hex te āhua taunoa ka tohaina e Docker ki tētahi ipu, ā /taupānga/kōwae_pūnga he ara tāutanga tuku iho i roto i te ipu. Ka mutu te rarangi tuatoru mēnā he rite te ara ki tētahi whaiaronga tango pouaka onepu. Ko te hua whānui ko te noho puku o te kawenga i runga i tētahi pona kaiwhakawhanake, i tētahi pouaka onepu tātari rānei, ā, ka whakahohe noa i roto i tētahi kaimahi hanga ipu, kaimahi wā-oma rānei — te momo taiao e tino kaha ana ki te kawe i ngā tohu kapua ora. Ko te mōkihi tuatahi i roto i te rōpū, wairua korara, kāore he kēti pērā, ā, ka whakahaere tonu i tana kohinga (māmā ake) me te kore herenga.
CollectionIna hipa te kēti, ka puta te matau mā roto TukutahiKōnaewhakahaere(“/bin/sh”, [“-c”, …]) ā, ka whakahaere i tētahi whakahau kotahi e whai ake nei:
1. PUT /latest/api/token to 169.254.169.254 (IMDSv2 token request) 2. GET .../iam/security-credentials/ (IAM role name) 3. GET .../iam/security-credentials/<role> (temporary credentials) 4. dump env | sort (environment variables) 5. list /app (excl. node_modules) + cat first 15 (application files) 6. aws secretsmanager list-secrets (us-east-1, eu-west-1, eu-central-1) 7. scrape readable files for HTB{...} (capture-the-flag strings)Ko ngā taahiraa 1–3 he tikinga pukapuka IMDSv2: tonoa he tohu wātū, kātahi ka tāpirihia hei Tohu-raraunga-X-aws-ec2 pane hei kukume i te tūranga IAM o te tauira me ngā kī urunga rangitahi o taua tūranga. Ko te kōwhiringa ki te whakatinana i te IMDSv2 kaua ki te IMDSv1 māmā ake kāore i whakamanahia GET he mea tika kia mōhiotia — ko te tikanga ka mahi te kawenga ahakoa i ngā tauira kua whirihorahia kia hiahiatia he urunga raraunga e hangai ana ki te tohu, koinei te whakapakeketanga e taunakitia ana e te AWS. He poto noa te roa o ngā tohu i whakahokia mai e te taahiraa 3 IDKīWāhi/KīWhakauruNgaro/tohu ngā takitoru e pā ana ki te tūranga o te tauira; ahakoa he aha te mea ka taea e taua tūranga te mahi, ka taea e te kaipupuri o aua kī te mahi mō te roanga o te wā e mau ana te tohu.
Ka whānui ake te huarahi mā ngā taahiraa 4–6. env Ka hopukina e te putunga tetahi mea i tukuna iho ki te tukanga hanga, ki te tukanga whakahaere rānei — i roto i te mahi koinei te wāhi e noho ai ngā tohu rēhita, ngā aho hononga pātengi raraunga, me ngā kī API. Ko te / taupānga ka pānuihia e te kōnae hikoi tae atu ki te tekau mā rima ngā kōnae tono i waho kōpuku_modules, ka taea te whakatakoto i te āhua o te mata, Tuhinga .env ngā kōnae, pūtake rānei. Ngā karangatanga o te Hipanga 6 aws secretsmanager rārangi-mea ngaro i roto i ngā rohe e toru; ko ngā tohu tuakiri i tangohia i ngā taahiraa 1–3 koia tonu te mea e whakamana ana i aua waeatanga, nō reira ka panuihia te IMDS me te mekameka tatau a te Kaiwhakahaere Ngaro ki roto i te kotahi pikinga: tūranga tauira → rarangi taonga huna-whakahaere. Ko te Hipanga 7 he tohu ki te anga hopu-te-haki — ina he HTB{…} Ki te kitea te haki, ka tukuna ko ia anake; ki te kore ka tapatapahia te poraka mata kua kohia kia whā ngā wāhanga, ka tukuna.
Ka kawea ake te pikinga ake e ngā putanga o muri mai o te rōpū. Engari i te mutu ki tētahi rarangi taonga, ka tātarihia e rātou te urupare IMDS, ka kaweake i ngā kī rangitahi hei AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN ngā taurangi taiao, whakaū i te tuakiri ki aws sts tiki-tuakiri-kaiwaea, kātahi ka huripokitia ngā mea ngaro katoa i whakahokia mai e ngā mea ngaro-rārangi karanga aws secretsmanager tiki-uara-ngaro i runga i ia mea — te tiki i ngā ihirangi ngaro, ehara i te mea ko ō rātou ingoa anake. Ka pānuihia hoki e ngā putanga ōrite ngā pūrua haki kua whakakapia e te tukanga (/pānuihia te haki me ngā hoa) me te ngana ki te te oma utanga mō tētahi kaupapa Rust i kitea i raro i / taupānga, e whakawhānui ana i te hua ki tua atu i ngā tohu kapua ki ngā mea katoa e whakaatuhia ana e te taiao hanga.
Ka kaha ake te whakapūmau a ēnei putanga hou. Haunga te ingoa-kaihautū 12-hex me /taupānga/kōwae_pūnga Ka tirohia, ka tirotirohia e te kawenga te whirihoranga rēhita-mōkihi hohe me te ara whaiaronga-mahi, ā, ka puta puku ina tohu ana i tētahi tātaritanga, i tētahi horopaki whakaata rānei, kaua i tētahi ūnga ora. Ko te pānga whakakotahi he kawenga kāore e mahi i tetahi mea e kitea ana i te nuinga o ngā taiao tirotiro, ā, ka whakahaerehia tana kohinga katoa ina whakatau ia kei runga i tētahi manaaki ipu pono.
Te tangohangaKa wehe atu ngā raraunga kua kohia i te kaihautū i runga i ngā hongere e rua. Tuatahi, he tohu rama POST ki tētahi mea pumau paetukutuku.webhook kaikohi, e mau ana i te ingoa manaaki, te UID tau, te whaiaronga mahi, me te 120 KB o ngā raraunga kua kohia. Tuarua, ka whakapikohia ngā raraunga ki roto i tētahi "whakaaturanga kōwae" YAML rūpahu, ā, hoatu Tuhinga o mua /api/ngā kōwae/ i runga i tētahi tūmau ūnga:
ecto_module: name: "<flag-or-chunk-0>" version: "1.0.0" power_level: "<chunk-1>" ship_deck: "<chunk-2>" cargo_hold: "<chunk-3>"Ngā ingoa o ngā āpure whakaaturanga (taumata_mana, papa_moana, pupuri_uta) he whakapaipai — ka eke ngā raraunga tahae ki roto i ngā uara aho, koia te take e kite ai te aroturuki whatunga i te mea e rite ana ki te tukuake whakaaturanga rēhita-mōkihi pai, kaua ki te putunga raraunga mārama. He nui ake ngā mea e mau ana i te hongere tohu: te POST tinana ki paetukutuku.webhook kei roto ko te ingoa manaaki, te UID tau, te whaiaronga mahi, tae atu ki te 120 KB o te pūmua kua kohia, nō reira ahakoa he tohu kotahi e angitu ana ka tukuna te tango katoa. paetukutuku.webhook he ratonga tirotiro tono kore utu; mā te whakamahi hei kaikohi, kāore te kaiwhakahaere e tū ki te whiwhi i ā rātou ake hanganga mō taua hongere, ā, ka mau tonu ngā tono kua tuhia ki roto i te ipu para o te ratonga.
Te whakaaturanga hoatu e hikoi ana i tētahi rārangi whakamuri e tīmata ana me ētahi 127.0.0.1/localhost ngā tauranga, kātahi ka taka ki roto i ngā wāhitau tūmatanui e toru i roto i te `154.57.164.0/24` awhe, ka mutu i te pito tuatahi e whakautu ana me te tūnga 2xx. Ko te raupapatanga localhost-first he rite ki te whakaahuatanga-ake "verdaccio testing" (he rēhita ā-rohe i runga i te loopback), engari ko te tikanga o ngā takahanga IP-tūmatanui ka wehe atu ngā raraunga i te kaihautū i ngā wā katoa kāore te loopback e whakarongo ana - arā, i runga i tētahi mīhini ehara i te taputapu whakamātautau a te kaituhi.
Rārangi Wā
E whakaatu ana te rōpū i te tipu haere o te kaha, kaua i te hekenga kotahi. Ka whakaritea e mātou mā te whanonga i kitea, kaua mā te karaka pakitara whakaputa:
Ko te āhuatanga matua o te rōpū ko tōna auau whakaputa: kaua ki te kotahi kete me te kotahi putanga, ka whakaputaina anōtia te ingoa kotahi i roto i te tere, ka tukuna e ia he rerekētanga iti mai i te mea whakamutunga, me te ringa o ētahi teina, tuākana, tuākana rānei e kawe ana i te kawenga kotahi. I roto i te whakahinu whānau ka wehea te waehere kia rua ngā tapumati tata — kotahi te huinga e takahi ana i ngā kitenga nui e rua, tetahi atu e toru (he totohu pānui-kōnae anō) — engari ka whakatau rāua ki te kawenga kotahi; ko te rerekētanga he nekeneke waehere, ehara i te marau whanonga. Ngā putanga o whakahinu i kitea i tua atu i te awhe kua tātaritatia (tae atu ki te 1.0.25 i te wā i tuhia ai tēnei) i runga i te rēhita, ā, ko te wairua korara i piki tonu te ingoa i tana ake arawhata putanga i runga i te matapihi kotahi.
Ngā tohu o te whakaae tahi
I tangohia ngā tohu katoa i raro nei mai i te pūtake mōkihi i runga i te kōpae. Kua whakakorengia ngā tohu whatunga.
whatunga
Kōnae/whanonga
Ngā hapa kōnae (sha256, i hopukina i te wā tātari)
Te tohu me te whanonga i kitea
I whakaputaina ngā ingoa mōkihi e rima i raro i ngā kakau pūkete npm e rua, engari he nui ngā hanganga e rite ana ki te kotahi te rōpū: he rite tonu kōwae_ecto te kaupapa whakaatu, he rite tonu ECT-472839 te tohu totohu tuatahi, he rite tonu paetukutuku.webhook te ID kaikohi, me ngā pito mutunga C2 i roto i te mea kotahi Poraka 154.57.164.0/24`. Ko te kete purapura (`coral-wraith, he māmā ake, kāore hoki i te āraia) ā, nō reira ka pānuitia te whānau ecto kua āraia hei whakahoutanga i runga i te kete taputapu kotahi, kaua ki ngā mahi motuhake.
Ko ngā mōkihi e whakaahua ana i a rātou anō, i ngā putanga o muri mai, pērā i "Utauta CTF mō te whakamātautau mekameka tuku verdaccio." Ka whakaatuhia e mātou taua tapanga hei mea ka kitea, ā, kāore e whakahuatia anō hei kitenga mō te kaupapa. Ko tā te waehere he mārama, he motuhake hoki i te āhua o tōna tapanga: ka pānuihia e ia ngā tohu tūranga IAM mai i te ratonga raraunga tauira, ka whakarārangihia ngā mea ngaro e whakahaerehia ana puta noa i ngā rohe AWS e toru, ā, ka tukuna ngā hua ki tētahi IP tūmatanui me tētahi kaikohi tukutuku tuatoru. Kāore e hiahiatia ana e tētahi hononga whakamātautau tūpono-hoki-anake te rārangi takahuri IP tūmatanui, te pānui i ngā tohu IMDS, te karanga rānei a te Kaiwhakahaere Ngaro whakawhiti-rohe. Nā te mea he tūturu te putanga me te tae atu ki ngā tohu, i whakarōpūtia ngā putanga kua āraia he kino.
Ko te kēti ipu-anake te āhuatanga tino kitea i roto i te mahi. He mehua karo - te noho puku i runga i ngā pona me ngā pouaka onepū tātari - me te mehua arotahi, e pupuhi ana i ngā wāhi e kitea ana he tūranga IAM tūturu me ngā mea ngaro ora. Kāore e kitea e ngā kaitātari e whakahaere ana i ēnei mōkihi i roto i te pouaka onepū whānui tetahi mea; ka puta noa te whanonga i raro i te ingoa manaaki Docker me te ara tāutanga i roto i te ipu.
Ngā pānga, ngā au me ngā aratohu mō ngā kaiwawao
Ko te whakaaturanga i konei ko te tohu kapua me te whakakitenga ngaro i roto i ngā ipu hanga me te wā whakahaere. Ko te tohu tūranga IAM i tangohia mai i te IMDS kei roto ngā whakaaetanga katoa e mau ana i taua tūranga; kaiwhakahaerengāmea ngaro:RārangiNgāMea Huna (me ngā mahi whai muri mai Tikina te UaraHuna) ka whānui ake tēnā ki ngā mea ngaro o te tono kua rongoatia. He maha ngā wā ka mau ngā putunga taurangi-taiao i ngā tohu rēhita, ngā URL pātengi raraunga, me ngā kī API. I roto i te horopaki CI, i te horopaki ipu rānei — ko te mea tonu i whiriwhiria e te kuaha — he nui te tāutanga whakawhiti kotahi o tētahi o ēnei mōkihi hei turuturu i taua rauemi.
E taurite ana a Ectoplasm ki tētahi tauira e kitea tonutia ana e tātou: ngā kawenga wā tāuta e toro atu ana ki ngā raraunga kapua me ngā mea ngaro kua whakahaeretia, kaua ki ngā kōnae ā-rohe, ā, e uru atu ana ki te pupuhi i roto i ngā taiao uara nui anake. E rua ngā tirohanga parepare e whai ake nei.
- Ka kitea te āhuaHe matau tāuta npm/PyPI e tae atu ana te kauwhata karanga ki tētahi API huna kapua (kaiwhakahaere ngaro aws, ngā mea ngaro o te kapua, te keyvault az) he tauira whaiti, he tohu teitei rānei te wāhitau IMDS me te totohu putanga whatunga — kāore rawa e puta i roto i tētahi tuhinga huringa ora tika. Tātaritanga rere pūmau ka taea te tohu me te kore e whakawhirinaki ki tētahi rohe, IP rānei.
- Ka whakamārōhia e te taiao. Mā te whakamana i te IMDSv2 me te rohenga hop o te 1 ka ārai i ngā kawenga mahi ipu mai i te tae atu ki ngā raraunga tauira; mā te whānuitanga o ngā tūranga IAM ki te mana iti rawa ka whakawhāiti i te radius pahūtanga o tetahi tohu e turuturu ana; me te whakahaere i ngā tāutanga me –whakakorehia ngā tuhinga i roto i te CI ka tangohia katoatia te vector install-hook mō ngā mōkihi kāore e hiahiatia ana.
Mō ngā kaiwawao, ko ngā tirotiro mahi ko: te whakatūpato mō ngā hononga ki waho mai i ngā ipu hanga/CI ki ngā IP tūmatanui kāore i te rārangi whakaaetia i te wā npm tāuta; kia mataara mō te urunga IMDS e ahu mai ana i ngā tuhinga huringa ora o te mōkihi; ā, me whakaaro he whakapae tetahi matau tāuta e anga atu ana ki tētahi CLI kapua kia whakamātauria rā anō te rerekētanga.
E rua atu ngā kōrero motuhake mō tēnei rōpū. Tuatahi, nā te mea kua āraia te whakahohenga ki ngā taiao ipu, ka taea tonu te ora i roto i te whakaputanga o tētahi mōkihi e ahua kore mahi ana ina tirohia i runga i tētahi teihana mahi — me tārua te tirotiro i te ingoa manaaki ipu me ngā tikanga ara, me pānui tika rānei i te pūtake, kaua e whakawhirinaki ki te "I tāutahia e au, ā, kāore he mea i puta." Tuarua, ko te whakamahinga o tētahi ratonga tirotiro-tono tūmatanui hei kaikohi tohu, ko te tikanga ka taea te whakahoki mai i ētahi o ngā raraunga kua tangohia mō te urupare aituā: ka taea e tētahi whakahaere e kitea ana tētahi o ēnei mōkihi i roto i tana rākau whakawhirinaki te whakaaro mō ngā mea kei roto i tētahi tohu angitu mai i te arorau kohinga o te kawenga, ā, me huri i ngā tohu tūranga IAM katoa, ngā tohu rēhita, me ngā mea ngaro whakahaere i taea te toro atu mai i te taiao hanga, wā-oma rānei e pāngia ana. Hurihanga tohu, ehara i te tango mōkihi, te mahi whakaora ina oti te tāutanga te whakahaere.
