TL; DR
Gulu la phukusi la npm zisanu, yofalitsidwa m'maakaunti awiri, yotumizidwa postinstall chikwatu chomwe chimawerenga zikalata za mtambo kuchokera kwa wolandila ndikuzitumiza kunja kwa bokosi. Ma phukusiwa ali ndi mayina a mizimu ndi achifwamba — coral-wraith, ecto-corsair-whisper-6f3b9, ecto-corsair-flag-x9m4, ecto-rust-read-f3a9c1, ecto-nightly-spirit — ndi kuyika chilichonse chomwe akusonkhanitsa kukhala chabodza ecto_module: YAML manifest tisanaitumize. Timatsatira gululo ngati ectoplasm.
Katundu wolipira umagwira ntchito pokhapokha ngati wazindikira malo enaake: wolandila yemwe dzina lake ndi Chingwe cha hex cha zilembo 12 ndi chikwatu chogwirira ntchito pansi pa /app/node_modules — mawonekedwe a nyumba yokhala ndi ziwiya kapena wogwira ntchito za CI. Chipatacho chikadutsa, mbedza imafunsa Utumiki wa metadata wa AWS (IMDSv2) pa ziyeneretso za udindo wa IAM, owerengera AWS Secrets Manager m'madera atatu, amataya zinthu zosiyanasiyana zachilengedwe, amawerenga mafayilo omwe ali pansi pa /app, ndi kukanda zingwe zojambulira mbendera. Kenako zimatuluka m'njira ziwiri: chizindikiro cha kuwala kupita ku webhook.site chosonkhanitsa ndi PUT yowonekera ku raw-IP endpoint, yokhala ndi mndandanda wa zovuta zomwe zingachitike mu localhost-first.
Mafotokozedwe a phukusi lotsatira anali "CTF payload for verdaccio supply-chain testing." Tikunena kuti kudzifotokozera kumeneku ndi mfundo yooneka. Khalidwe lenilenilo — kutuluka m'malo mwa IP ya anthu onse, ma script enieni a IMDS, ma Secrets Manager enieni — ndi momwe zilili mosasamala kanthu za chizindikirocho, ndipo ndi chifukwa chake mitundu iyi idagawidwa m'magulu oipa.
Dzina limodzi mu gululo, coral-wraith, sinayime pa kutulutsidwa kamodzi kokha. Inasindikizidwanso mofulumira m'mabaibulo ambiri m'maola ochepa chabe — 1.0.0 kukwera ku 6.0.0 — ndipo kale dzina lomweli linagwiritsa ntchito mawu oti "inflamed" 9999.0.x manambala a mtundu, mawonekedwe akale a kuyesa kudalira-kusokonezaKudutsa pamenepo, katundu wolipidwa umawonekera bwino: kuchokera pa beacon ya kuwombera kamodzi kupita ku chizindikiritso chathunthu cha AWS chomwe chimakutidwa ndi macheke achilengedwe omwe amasunga chete kunja kwa cholinga chake.
| phukusi | Mayina 5; coral-wraith yokha inasindikizidwanso m'mitundu yambiri |
| Makhalidwe | npm |
| Ikani vekitala | postinstall zolemba za moyo wonse |
| Cholinga chachikulu | Zitsimikizo za udindo wa AWS IAM + mfundo zachinsinsi za Manager Secrets, zosintha zachilengedwe, /app owona |
| Exfil | webhook.site beacon + raw-IP C2 PUT |
| Chipata choyambitsa | Dzina la alendo la 12-hex + /app/node_modules cwd, kuphatikiza kuyang'ana chilengedwe komwe kumaletsa katundu wolipidwa kunja kwa nkhaniyi |
| Kuvuta | mkulu — chizindikiritso cha mtambo ndi kuulula chinsinsi choyang'aniridwa kuchokera malo omangidwa ndi ziwiya ndi nthawi yogwirira ntchito |
Kapangidwe ka kuukira
Phukusi lililonse mu gululo limapangidwa mofanana: pafupifupi lopanda kanthu index.js (module.exports = {}), mzere umodzi phukusi.json zolemba — “kukhazikitsa pambuyo”: “node postinstall.js” - ndi katundu wolipidwa mkati pambuyo pokhazikitsa.jsKuyika phukusi ndikokwanira kuyendetsa mbedza; palibe chifukwa cholowetsa kapena kuyimbira foni.
Chipata cholozera. Asanachite chilichonse, katundu wa ecto-family amafufuza malo ozungulira:
function isAppWorker(): host = os.hostname() if host does NOT match /^[0-9a-f]{12}$/ -> exit if cwd does NOT contain "/app/node_modules" -> exit if cwd contains "/tmp/npm-safe" -> exit otherwise -> proceedDzina la hostname la 12-hex ndi mawonekedwe okhazikika omwe Docker imapatsa chidebe, ndipo /app/node_modules ndi njira yachizolowezi yokhazikitsira mkati mwa chidebe. Gawo lachitatu limathandiza ngati njirayo ikuwoneka ngati chikwatu chochotsera cha sandboxed. Zotsatira zake ndizakuti katundu wolipidwa amakhalabe pa laputopu ya wopanga mapulogalamu kapena sandbox yowunikira ndipo amangogwira ntchito mkati mwa womanga kapena wogwirira ntchito nthawi yayitali - mtundu wa malo omwe angakhale ndi ziyeneretso za mtambo wamoyo. Phukusi loyambirira kwambiri mu gulu, korali-wokwera, ilibe chipata choterocho ndipo imayendetsa zosonkhanitsa zake (zosavuta) mopanda malire.
KusonkhanitsaChipata chikadutsa, zipolopolo za zingwe zimatulukira execFileSync(“/bin/sh”, [“-c”, …]) ndipo imayendetsa lamulo limodzi lokha lomwe, motsatira:
1. PUT /latest/api/token to 169.254.169.254 (IMDSv2 token request) 2. GET .../iam/security-credentials/ (IAM role name) 3. GET .../iam/security-credentials/<role> (temporary credentials) 4. dump env | sort (environment variables) 5. list /app (excl. node_modules) + cat first 15 (application files) 6. aws secretsmanager list-secrets (us-east-1, eu-west-1, eu-central-1) 7. scrape readable files for HTB{...} (capture-the-flag strings)Gawo 1–3 ndi buku lophunzitsira IMDSv2: pemphani chizindikiro cha gawo, kenako chiphatikizeni ngati Chizindikiro cha X-aws-ec2-metadata mutu kuti mukoke gawo la IAM la chitsanzocho ndi makiyi olowera kwakanthawi a gawolo. Kusankha kugwiritsa ntchito IMDSv2 m'malo mwa IMDSv1 yosavomerezeka yosavuta GETANI ndikofunikira kudziwa - zikutanthauza kuti katundu wolipidwa umagwira ntchito ngakhale pazinthu zomwe zakonzedwa kuti zifunike mwayi wopeza metadata pogwiritsa ntchito token, womwe ndi kuuma komwe kumalimbikitsidwa ndi AWS. Zitsimikizo zomwe zabwezedwa ndi gawo lachitatu ndi za kanthawi kochepa. AccessKeyId/Chinsinsi Chofikira/Chizindikiro Ma triple anayang'ana pa udindo wa chitsanzo; chilichonse chimene udindowo ungachite, mwini makiyi amenewo akhoza kuchita kwa moyo wonse wa chiphasocho.
Gawo 4–6 likulitsani kutenga. kutumiza dump imagwira chilichonse chomwe chimapangidwa kapena njira yogwirira ntchito yomwe yalowa - m'malo mwake ndi pomwe ma tokeni a registry, zingwe zolumikizira database, ndi makiyi a API nthawi zambiri amakhala. / app Kuyenda kwa fayilo kumawerenga mafayilo opitilira khumi ndi asanu a pulogalamu kunja zigawo, zomwe zingasinthe mawonekedwe a pamwamba, .fm mafayilo, kapena gwero. Kuyitanitsa kwa Gawo 6 mndandanda wa zinsinsi za aws m'magawo atatu; ziyeneretso zomwe zatulutsidwa mu magawo 1-3 ndizo zomwe zimatsimikizira kuyitana kumeneko, kotero IMDS imawerenga ndi unyolo wa Secrets Manager pamodzi kukhala kukwezedwa kumodzi: udindo wa chitsanzo → zinthu zosungidwa zachinsinsi zoyendetsedwa. Gawo 7 ndi chizindikiro cha kujambula mbendera — pamene HTB{…} mbendera imapezeka kuti imatumizidwa yokha, apo ayi thunthu losaphika lomwe lasonkhanitsidwa limadulidwa mzidutswa zinayi ndikutumizidwa.
Mabaibulo ena mu gululo amapititsa patsogolo kukwera kwa zinthu. M'malo mongoyima pa malo osungira zinthu, amafufuza yankho la IMDS, ndikutumiza makiyi osakhalitsa ngati AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN zosintha zachilengedwe, tsimikizirani kuti ndinu ndani ndi aws sts kupeza-caller-identity, kenako bwerezani chinsinsi chilichonse chomwe chabwezedwa ndi zinsinsi za mndandanda akuitanira aws secretsmanager get-secret-value pa chilichonse — kupeza zomwe zili mkati mwachinsinsi, osati mayina awo okha. Mabaibulo omwewo amawerenganso ma binaries a mbendera omwe amasinthidwa ndi njira (/kuwerenga mbendera ndi abwenzi) ndipo yesani kuthamanga kuthamanga motsutsana ndi pulojekiti iliyonse ya Rust yomwe yapezeka pansi pa / app, kukulitsa zokolola kupitirira ziyeneretso za mitambo kupita ku chilichonse chomwe malo omanga amavumbula.
Mabaibulo ena otsatirawa amadziteteza okha kwambiri. Kuwonjezera pa dzina la 12-hex-hostname ndi /app/node_modules Poyang'ana, katundu wolipira amawunika momwe pulogalamu yogwirira ntchito imagwirira ntchito komanso njira yogwirira ntchito ndipo amatuluka mwakachetechete akamawonetsa kusanthula kapena mawonekedwe agalasi m'malo mwa cholinga chamoyo. Zotsatira zake zonse ndi katundu wolipira womwe suchita chilichonse chomwe chimawonedwa m'malo ambiri owunikira ndipo umayendetsa zonse zomwe wasonkhanitsa pokhapokha ngati umadziona kuti uli pa wolandila weniweni.
ExfiltrationDeta yosonkhanitsidwa imasiya wolandila pa njira ziwiri. Choyamba, chizindikiro cha kuwala POST ku chokhazikika webusaiti ya webhook chosonkhanitsa, chokhala ndi dzina la hostname, UID ya manambala, chikwatu chogwira ntchito, ndi mpaka 120 KB ya deta yosonkhanitsidwa. Chachiwiri, deta imapindidwa kukhala "module manifest" yabodza ya YAML ndipo Ikani ku /api/ma module/ pa seva yolunjika:
ecto_module: name: "<flag-or-chunk-0>" version: "1.0.0" power_level: "<chunk-1>" ship_deck: "<chunk-2>" cargo_hold: "<chunk-3>"Mayina a manifest field (mulingo_wamphamvu, sitima_yokwerera, katundu_wosungidwa) ndi zokongoletsera — deta yobedwa imalowa mkati mwa zingwe, ndichifukwa chake network monitor imawona zomwe zimawoneka ngati benign package-registry manifest upload m'malo mongoyang'ana deta yodziwika bwino. Njira ya beacon imanyamula zambiri: POST thupi webusaiti ya webhook imaphatikizapo dzina la hostname, UID ya manambala, chikwatu chogwirira ntchito, ndi mpaka 120 KB ya blob yosonkhanitsidwa, kotero ngakhale beacon imodzi yopambana imapereka chidziwitso chonse. webusaiti ya webhook ndi ntchito yowunikira mafomu aulere; kugwiritsa ntchito ngati chosonkhanitsa kumatanthauza kuti wogwiritsa ntchitoyo sadzayenera kulandira zomangamanga zakezake za njira imeneyo, ndipo zopempha zolembedwazo zimapitirirabe m'chidebe cha ntchitoyo.
Chidziwitso Ikani akutsatira mndandanda wa zolephera zomwe zimayamba ndi zingapo 127.0.0.1/localhost madoko kenako amagwera m'ma adilesi atatu a anthu onse mu `154.57.164.0/24` range, kuyima pamalo oyamba omwe amayankha ndi 2xx status. Kuyitanitsa kwa localhost-first kumagwirizana ndi kufotokoza kwa "verdaccio testing" (registry yakomweko pa loopback), koma ma fallback a public-IP amatanthauza kuti deta imachoka pa host nthawi iliyonse loopback ikakhala kuti siikumvetsera — kutanthauza, pa makina aliwonse omwe si makina oyesera a wolembayo.
Nthawi
Gululo likuwonetsa kukula kwa mphamvu pang'onopang'ono osati dontho limodzi. Timalikonza potengera khalidwe lomwe lawonedwa, osati pofalitsa nthawi yowonera:
Chizindikiro chachikulu cha gululo ndi kufalikira kwake: m'malo mwa phukusi limodzi ndi mtundu umodzi, dzina lomwelo limasindikizidwanso mobwerezabwereza motsatizana, lililonse limatulutsidwa pang'ono pa lomaliza, pamodzi ndi abale angapo otchulidwa mosiyana omwe ali ndi katundu wofanana. kunong'oneza Banja la code linagawanika m'zigawo ziwiri zapafupi — chimodzi chimalepheretsa kuzindikira zinthu ziwiri zofunika, china zitatu (kuwerenga mafayilo ena) — koma zonse ziwiri zimakhala ndi katundu wofanana; kusiyana kwake ndi kusinthasintha kwa code, osati foloko ya khalidwe. kunong'oneza kupitirira malire omwe anafufuzidwa (mpaka osachepera 1.0.25 panthawi yolemba) adawonedwa amoyo pa registry, ndipo korali-wokwera Dzina linapitiriza kukwera makwerero akeake pawindo lomwelo.
Zizindikiro za mgwirizano
Zizindikiro zonse zomwe zili pansipa zachotsedwa kuchokera ku gwero la phukusi pa disk. Zizindikiro za netiweki zasinthidwa.
Network
Khalidwe/fayilo
Ma hashes a fayilo (sha256, ojambulidwa panthawi yowunikira)
Khalidwe ndi kudziwika kwa anthu
Mayina asanu a maphukusi adasindikizidwa pansi pa ma handle awiri a akaunti ya npm, koma amagawana zomangamanga zokwanira kuti awawone ngati gulu limodzi: zomwezo ecto_module chiwonetsero cha manifest, chomwecho ECT-472839 chizindikiro choyamba cha sinki, chomwecho webusaiti ya webhook ID ya wosonkhanitsa, ndi ma endpoints a C2 omwewo 154.57.164.0/24` block. Phukusi la mbewu (`coral-wraith, yosavuta komanso yosatsekedwa) ndipo banja la ecto-lotetezedwa motero limawerengedwa ngati ma reterations pa chida chimodzi m'malo mwa zoyesayesa zodziyimira pawokha.
Ma phukusiwa amafotokoza okha, m'mabaibulo ena, monga "Kulipira kwa CTF kwa mayeso a verdaccio supply-chain." Timaika chizindikiro chimenecho ngati chowonadi ndipo sitimachibwerezanso ngati chopeza chokhudza cholinga. Zimene code imachita n’zosamveka bwino ndipo sizidalira momwe imalembedwera: imawerenga ziyeneretso za udindo wa IAM kuchokera ku instance metadata service, imalemba zinsinsi zoyendetsedwa m’madera atatu a AWS, ndipo imatumiza zotsatira zake ku IP ya anthu onse ndi wosonkhanitsa ma webhook wachitatu. Njira yoyesera ya loopback-only singafunike mndandanda wa public-IP fallback, ma reads a IMDS credential, kapena ma cross-region Secrets Manager amaitana. Chifukwa chakuti kutuluka ndi kufika kwa ziyeneretso ndi zenizeni, mitundu yotetezedwayo idagawidwa kukhala yoipa.
Chipata chogwiritsa ntchito chidebe chokha ndicho chinthu chodziwika bwino kwambiri pa ntchito. Ndi njira yopewera — kukhala chete pa ma laputopu ndi m'ma sandbox osanthula — komanso njira yowunikira, kuwombera kokha komwe udindo weniweni wa IAM ndi zinsinsi zenizeni zilipo. Akatswiri omwe amayendetsa ma phukusi awa mu sandbox wamba sangaone chilichonse; khalidweli limangowonekera pansi pa dzina la hostname la Docker komanso njira yokhazikitsira mkati mwa chidebe.
Zotsatira, zochitika, ndi malangizo kwa oteteza
Kuwonekera apa ndi chinsinsi cha mtambo ndi kuulula chinsinsi mkati mwa zotengera zomangira ndi zogwirira ntchito. Chitsimikizo cha udindo wa IAM chochokera ku IMDS chili ndi zilolezo zilizonse zomwe udindowo uli nazo; woyang'anira zinsinsi: MndandandaZinsinsi (ndi zotsatira zilizonse PezaniChinsinsi Chachinsinsi) imakulitsa izi ku zinsinsi za mapulogalamu osungidwa. Ma dumps osinthika chilengedwe nthawi zambiri amakhala ndi ma tokeni a registry, ma URL a database, ndi makiyi a API. Mu CI kapena container - zomwe chipata chimasankhira - kukhazikitsa kamodzi kokha kwa phukusi limodzi mwa izi ndikokwanira kutulutsa zinthuzo.
Ectoplasm ikugwirizana ndi njira yomwe tikupitilizabe kuwona: zolipira zomwe zimayikidwa nthawi yoyika zomwe zimafikira metadata yamtambo ndi zinsinsi zoyang'aniridwa m'malo mwa mafayilo am'deralo, ndipo zomwe zimangodziwombera zokha m'malo okwera mtengo. Zotsatira ziwiri zodzitchinjiriza zimatsatira.
- Kapangidwe kake kamapezeka. Cholumikizira cha npm/PyPI chomwe graph yake yoyimbira imafikira API ya zinsinsi za mitambo (woyang'anira zinsinsi za aws, zinsinsi za gcloud, az keyvault) kapena adilesi ya IMDS ndi sinki yotuluka pa netiweki ndi njira yopapatiza komanso yotsika kwambiri — sizimachitika kawirikawiri mu script yovomerezeka ya moyo wonse. Kusanthula kwa kayendedwe ka madzi kosasunthika akhoza kuyiyika chizindikiro popanda kudalira domain kapena IP iliyonse.
- Kuuma kwa chilengedwe kumalepheretsa. Kukhazikitsa IMDSv2 ndi malire a hop a 1 kumaletsa ntchito zambiri za chidebe kufika pa metadata ya instance; kuwunika maudindo a IAM kuti akhale ochepa kumachepetsa mtunda wa blast wa credential iliyonse yomwe imatuluka; ndikugwiritsa ntchito ma installs ndi -osanyalanyaza zolemba mu CI imachotsa vekitala ya install-hook kwathunthu pamaphukusi omwe sakufunikira.
Kwa oteteza, njira zowunikira ndi izi: chenjezo pa maulumikizidwe otuluka kuchokera ku zotengera zomangira/CI kupita ku ma IP a anthu onse omwe saloledwa panthawi ya npm kukhazikitsa; yang'anirani mwayi wa IMDS wochokera ku zolemba za moyo wa phukusi; ndipo ganizirani ngati mbedza iliyonse yokhazikitsa yomwe imagundana ndi CLI yamtambo ndiyokayikitsa mpaka itatsimikiziridwa kuti si yolondola.
Mfundo zina ziwiri zokhudzana ndi gululi. Choyamba, chifukwa kuyatsa kumayikidwa m'malo okhala ndi ziwiya, phukusi lomwe limawoneka lopanda ntchito likayang'aniridwa pa malo ogwirira ntchito likhoza kukhalabe lopangidwa - kuwunika kuyenera kubwereza dzina la hostname ya chidebe ndi momwe zinthu zilili, kapena kuwerenga gwero mwachindunji, m'malo modalira "Ndinayika ndipo palibe chomwe chinachitika." Chachiwiri, kugwiritsa ntchito ntchito yowunikira mapempho a anthu onse ngati chosonkhanitsa ma beacon kumatanthauza kuti zina mwa deta zomwe zachotsedwa zitha kubwezeretsedwanso kuti zithetsedwe: bungwe lomwe limapeza limodzi mwa ma phukusi awa mumtengo wake wodalira limatha kuganizira zomwe beacon yopambana ikanakhala nayo kuchokera ku mfundo yosonkhanitsa ya payload, ndipo liyenera kusinthasintha ziyeneretso zilizonse za udindo wa IAM, ma tokeni olembetsa, ndi zinsinsi zoyang'aniridwa zomwe zinali zotheka kupezeka kuchokera ku malo omanga kapena nthawi yogwirira ntchito omwe akhudzidwa. Kusinthasintha kwa ziphaso, osati kuchotsa phukusi, ndi njira yokonzanso zinthu ikangoyamba kuyikidwa.
