TL; DR
Boka re mapakeji mashanu npm, yakaburitswa mumaakaundi maviri, yakatumirwa postinstall hook inoverenga magwaro egore kubva kumugadziri wewebhusaiti uye inoatumira kubva pabhokisi. Mapakeji ane mazita emweya nemakororo — coral-wraith, ecto-corsair-whisper-6f3b9, ecto-corsair-flag-x9m4, ecto-rust-read-f3a9c1, ecto-nightly-spirit — uye kuisa zvese zvavanounganidza muzvikamu zvenhema ecto_module: YAML manifest tisati taitumira. Tinotevedzera cluster se ectoplasm.
Mutoro wepayload unoshanda chete kana waona nzvimbo chaiyo: mugamuchiri ane zita rinonzi Tambo yehekisi ine mavara gumi nemaviri uye dhairekitori rinoshanda riri pasi /app/node_modules — chimiro chemuchina wakaiswa mumidziyo kana mushandi weCI. Kana gedhi iroro rapfuura, chirauro chinobvunza Sevhisi yemetadata yemuenzaniso weAWS (IMDSv2) kune zvitupa zvebasa reIAM, zvinoverengerwa AWS Zvakavanzika Maneja munzvimbo nhatu, dumps nharaunda variables, inoverenga mafaira ari pasi pa /app, uye inokwenya tambo dzekubata-mureza. Inobva yaburitsa mhedzisiro yacho nenzira mbiri: beacon kuenda ku webhook.site muunganidzi uye PUT ye manifest kune raw-IP endpoint, ine runyorwa rwe localhost-first fallbacks.
Tsananguro dzepakeji dzakazotevera dzaiti "CTF payload for verdaccio supply-chain testing." Tinoshuma kuti kuzvitsanangura uku ichokwadi chinoonekwa. Maitiro acho pachawo — kubuda pachena kuenda kuIP yeruzhinji, zvinyorwa zvechokwadi zveIMDS, kufona kweReal Secrets Manager — ndizvo zvazviri pasinei nechiratidzo, uye ndicho chikonzero nei shanduro idzi dzakaiswa muchikamu chezvakaipa.
Zita rimwe chete muboka, coral-wraith, haina kumira pakuburitswa kamwe chete. Yakaburitswazve nekukurumidza kuburikidza neshanduro dzakawanda mumaawa mashoma — 1.0.0 kukwira ku 6.0.0 — uye imwe yekare yezita rimwe chete yakashandisa izwi rakakwidzwa 9999.0.x nhamba dzeshanduro, chimiro chekare che kuyedza kuvimba-kuvhiringidzika. Pamwe chete neizvozvo, mutoro wepayload wakura zvinooneka: kubva pakuva chiratidzo chekubata-kuverengwa kwemunhu mumwe chete kuenda pakuongorora kweAWS kwakazara kwakaputirwa mukutarisa kwezvakatipoteredza kunoita kuti isanyarara kunze kwechinangwa chayo.
| Mabhokisi | Mazita mashanu; coral-wraith yoga yakaburitswazve mumhando dzakawanda |
| Ecosystem | npm |
| Isa vhekitari | postinstall chinyorwa chehupenyu hwese |
| Chinangwa chikuru | Zvitupa zvebasa reAWS IAM + Zvakavanzika zveMutariri weZvakavanzika, zvinoshanduka-shanduka zvakatipoteredza, /app mafaira |
| Exfil | webhook.site bhekoni + raw-IP C2 PUT |
| Gedhi rekutangisa | Zita remutambi rine 12-hex + /app/node_modules cwd, pamwe nekutarisa nharaunda kunodzvinyirira mutoro uri kunze kwemamiriro ezvinhu iwayo |
| Kusuruvara | yakakwirira — cloud credential uye kuburitswa pachena kwakavanzika kubva nzvimbo dzekuvaka dzakagadzirwa mumidziyo uye dzenguva yekumhanya |
Muviri wekurwisa
Pakeji yega yega muboka rakagadzirwa nenzira imwecheteyo: inenge isina chinhu index.js (module.exports = {}), mutsetse mumwe chete package.json chinyorwa — "kuiswa kwemashure": "node postinstall.js" - uye mutoro uripo mushure mekuisa.jsKuisa pasuru yakakwana kuti hook ishande; hapana chikonzero chekupinza kana kufona.
Gedhi rekunanga. Usati waita chero chinhu, ecto-family payload inoongorora zvakaipoteredza:
function isAppWorker(): host = os.hostname() if host does NOT match /^[0-9a-f]{12}$/ -> exit if cwd does NOT contain "/app/node_modules" -> exit if cwd contains "/tmp/npm-safe" -> exit otherwise -> proceedZita remutambi rine 12-hex ndiro chimiro chakasarudzika chinopihwa neDocker kumudziyo, uye /app/node_modules inzira yekuisa mumudziyo wekare. Chikamu chechitatu chinobuda kana nzira yacho ichiita sedhairekitori rekubvisa sandboxed. Mhedzisiro yacho ndeyekuti payload inoramba yakarara palaptop yemugadziri kana sandbox yekuongorora uye inongoshanda chete mukati memugadziri wekuvaka kana mushandi wenguva yekumhanya - rudzi rwenzvimbo inogona kutakura zvitupa zvegore rehupenyu. Pakeji yekutanga muboka, korari-wraith, haina gedhi rakadaro uye inoshandisa muunganidzwa wayo (uri nyore) pasina miganhu.
KuunganidzaKana gedhi rapfuura, mabara ehoko anobuda nepa execFileSync(“/bin/sh”, [“-c”, …]) uye inomhanya murairo mumwe chete wecompound uyo, muhurongwa:
1. PUT /latest/api/token to 169.254.169.254 (IMDSv2 token request) 2. GET .../iam/security-credentials/ (IAM role name) 3. GET .../iam/security-credentials/<role> (temporary credentials) 4. dump env | sort (environment variables) 5. list /app (excl. node_modules) + cat first 15 (application files) 6. aws secretsmanager list-secrets (us-east-1, eu-west-1, eu-central-1) 7. scrape readable files for HTB{...} (capture-the-flag strings)Matanho 1–3 ndiwo mabhuku ekutora IMDSv2: kumbira chiratidzo chemusangano, wobva wachibatanidza se Chiratidzo cheX-aws-ec2-metadata header yekudhonza basa reIAM remuenzaniso uye makiyi ekupinda kwenguva pfupi ebasa iroro. Sarudzo yekushandisa IMDSv2 pane kushandisa IMDSv1 isina kusimbiswa iri nyore. WANA Zvakakosha kuziva — zvinoreva kuti muripo unoshanda kunyangwe pamikana yakagadzirirwa kuda mukana wekuwana metadata unobva pa token, inova iyo kuomeswa kunokurudzirwa neAWS. Zvitupa zvinodzoserwa nedanho rechitatu ndezvenguva pfupi. AccessKeyId/SecretAccessKey/Chiratidzo triples dzakatarisa basa remuenzaniso; chero basa iroro rinogona kuita, muridzi wemakiyi iwayo anogona kuita kwehupenyu hwese hwechitupa.
Matanho 4–6 anowedzera kukosha kwekutora. approx dump inobata chero chinhu chakagara nhaka kubva pakuvaka kana kuti maitiro ekushanda — mukuita uku ndipo panowanzogara ma registry tokens, database connection strings, uye API keys. /app kuverenga mafaira ekushandisa anosvika gumi nemashanu panze node_modules, iyo inogona kugadzirisa pamusoro, .env mafaira, kana kuti kwakabva. Danho rechitanhatu rekufona runyorwa rwezvakavanzika zveAWS munzvimbo nhatu; zvitupa zvakatorwa mumatanho 1-3 ndizvo chaizvo zvinosimbisa mafoni iwayo, saka IMDS inoverenga pamwe chete neSecrets Manager enumeration chain kuita escalation imwe chete: instance role → managed-secret inventory. Danho rechinomwe chiratidzo chekutora-mureza — kana HTB{…} mureza unowanikwa unotumirwa wega, zvikasadaro dumbu risina kuunganidzwa rinochekwa kuita zvidimbu zvina rotumirwa.
Shanduro dzinotevera muboka dzinoendesa mberi kukura kwacho. Pane kumira panzvimbo inochengeterwa zvinhu, vanoongorora mhinduro yeIMDS, votumira makiyi echinguvana se AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN zvinoshanduka-shanduka zvakatipoteredza, simbisa kuzivikanwa kwako ne aws sts kuwana-kuzivikanwa-kwemunhu anofona, uye wobva wavhura zvakavanzika zvese zvinodzoserwa zvakavanzika zverunyorwa achidana aws secretsmanager get-secret-value pane imwe neimwe — kutora zviri mukati zvakavanzika, kwete mazita avo chete. Shanduro idzodzo dzinoverengawo mabhinari emureza akatsiviwa nemaitiro (/mureza wekuverenga neshamwari) uye edza a charge run kurwisa chero chirongwa cheRust chinowanikwa pasi pe /app, kuwedzera goho kupfuura magwaro egore kusvika kune chero chinhu chinofumurwa nenzvimbo yekuvaka.
Mavhezheni aya ekupedzisira anozvidzivirirawo zvakanyanya. Pamusoro pezita rekuti 12-hex-hostname uye /app/node_modules Inotarisa, payload inoongorora active package-registry configuration uye working-directory path uye inobuda chinyararire painoratidza ongororo kana mirror context kwete live target. Mugumisiro wakabatana ipayload isingaonekwe munzvimbo zhinji dzekuongorora uye inoshandisa muunganidzwa wayo wakazara chete apo inozviona sekuti iri pacontainer host chaiyo.
Exfiltration. Data rakaunganidzwa rinosiya host iri pamatanho maviri. Chekutanga, beacon POST kune yakatarwa webhook.site muunganidzi, ane zita remubati, nhamba yeUID, dhairekitori rinoshanda, uye kusvika ku120 KB yedata rakaunganidzwa. Chechipiri, data rinopetwa kuita "module manifest" yenhema yeYAML uye isa to /api/modules/ pane server yakanangwa:
ecto_module: name: "<flag-or-chunk-0>" version: "1.0.0" power_level: "<chunk-1>" ship_deck: "<chunk-2>" cargo_hold: "<chunk-3>"Mazita emunda we manifest (simba_level, chikepe_chengarava, kutakura zvinhu) zvinoshongedza — data rakabiwa rinofamba mukati me string values, ndosaka network monitor ichiona zvinoita se benign package-registry manifest upload pane data dump iri pachena. Beacon channel ine zvakawanda: iyo POST muviri ku webhook.site inosanganisira zita remutambi, nhamba yeUID, dhairekitori rekushanda, uye kusvika ku120 KB yebhuku rakaunganidzwa, saka kunyange beacon imwe chete inobudirira inopa kutorwa kwakazara. webhook.site ibasa rekuongorora zvikumbiro mahara; kurishandisa semuunganidzi zvinoreva kuti mushandi haambofaniri kumirira kugamuchira zvivakwa zvake zvechiteshi ichocho, uye zvikumbiro zvakanyorwa zvinoramba zviri mubhini rebasa.
Chiratidzo isa runyorwa rwezvipingamupinyi zvinotanga neakawanda 127.0.0.1/localhost zviteshi uye zvinozopedzisira zvasvika pakutaura kwevanhu vatatu mu`154.57.164.0/24` range, ichimira panzvimbo yekutanga inopindura ine 2xx status. Kurongeka kwe localhost-first kunoenderana netsananguro ye "verdaccio testing" (registry yemuno pa loopback), asi public-IP fallbacks zvinoreva kuti data rinobuda muhost pese parinenge risingateereri - kureva kuti, pamuchina usiri wemunyori we test rig.
Nemakore
Chikamu chinoratidza kukura kwesimba remunhu pane kudonha kamwe chete. Tinoronga nemaitiro akaonekwa, kwete nekushandisa wachi yekumadziro:
Chinhu chinonyanya kukosha muboka iri ndechekuburitsa kwaro: pane kuburitsa rimwe chete neshanduro imwe chete, zita rimwe chete rinodzokororwa kakawanda, rimwe nerimwe richiburitsa musiyano mudiki pane rekupedzisira, pamwe chete nehama shomanana dzine mazita akasiyana dzakatakura mutoro mumwe chete. zevezeve mhuri yekodhi yakakamurwa kuita zvigunwe zviviri zvepedyo — imwe seti ichikanganisa kuongororwa kaviri kwakakosha, imwe mitatu (imwe sink yekuverenga mafaira) — asi ese ari maviri anoenderana nemutengo mumwe chete; musiyano uripo ndewekukanganiswa kwekodhi, kwete forogo yemaitiro. zevezeve kupfuura huwandu hwakaongororwa (kusvika pa1.0.25 panguva yekunyora) zvakaonekwa zviripo parejista, uye korari-wraith zita rakaramba richikwira manera aro pamusoro pehwindo rimwe chete.
Zviratidzo zvekubvumirana
Zviratidzo zvese zviri pazasi zvakatorwa kubva panowanikwa pa package pa disk. Zviratidzo zve network zvakabviswa.
Network
Maitiro/faira
Mafaira hashes (sha256, akabatwa panguva yekuongorora)
Hunhu uye maitiro akaonekwa
Mazita mashanu emapakeji akabudiswa pasi pema "npm account handles" maviri, asi anogovana zvivakwa zvakakwana kuti aatore se "cluster" imwe chete: zvakafanana ecto_module schema ye manifest, zvakafanana ECT-472839 chiratidzo chekutanga chesinki, chimwe chete webhook.site ID yemuunganidzi, uye mapoinzi ekupedzisira eC2 mune imwe chete 154.57.164.0/24` bhuroko. Pakeji yembeu (`coral-wraith, zviri nyore uye zvisina gated) uye mhuri ye ecto-family yakavharirwa saka inoverengwa sekudzokorora pane imwe toolkit pane kuedza kwakazvimirira.
Mapakeji anotsanangura iwo, mune mamwe mavhezheni anotevera, se "Mutoro weCTF wekuyedzwa kweVerdaccio Supply-chain." Tinoratidza kuti chiratidzo ichocho chiri pachena uye hatichidzokorore sechinoonekwa nezvechinangwa. Zvinoitwa nekodhi iyi hazvina mubvunzo uye hazvienderane nekuti yakanyorwa sei: inoverenga humbowo hwebasa reIAM kubva ku instance metadata service, inoverenga zvakavanzika zvakachengetwa munzvimbo nhatu dzeAWS, uye inotumira mhedzisiro yacho ku public IP uye kune webhook collector wechitatu. Test harness ye loopback-only haidi runyorwa rwe public-IP fallback, IMDS credential reads, kana cross-region Secrets Manager calls. Nekuti kubuda uye kusvika kwehumbowo ndezvechokwadi, mavhezheni akavharirwa akaiswa muchikamu che malware.
Gedhi rekushandisa macontainer chete ndiro rinonyanya kuzivikanwa pakushanda. Inzira yekunzvenga - kuramba wakanyarara pamakombiyuta uye mumasandbox ekuongorora - uye nzira yekunanga, kupfura chete kana paine basa reIAM chairo nezvakavanzika zviripo. Vaongorori vanomhanyisa mapakeji aya mubhokisi resandbox rakajairika havangaoni chinhu; maitiro aya anongoonekwa chete pasi peDocker-style hostname uye nzira yekuisa mucontainer.
Mhedzisiro, mafambiro, uye gwara rekudzivirira
Kuratidzwa pano i cloud-credential uye kuburitswa pachena kwemukati memidziyo yekuvaka neyekushanda. Chitupa chebasa reIAM chakatorwa kubva kuIMDS chine chero mvumo iyo basa racho rine; maneja wezvakavanzika:ListSecrets (uye chero zvinotevera ToraValue yeChakavanzika) inowedzera izvozvo kune zvakavanzika zvemapurogiramu akachengetwa. Madumps anoshanduka-shanduka enzvimbo anowanzo takura ma tokens ekunyoresa, ma URL edatabase, uye makiyi eAPI. Mumamiriro ezvinhu eCI kana container - chaizvo izvo gate rinosarudzira - kuisa kamwe chete kweimwe yemapakeji aya kwakakwana kuburitsa zvinhu izvozvo.
Ectoplasm inoenderana nemaitiro atinoramba tichiona: mitoro yenguva yekuisa inosvika kune metadata yegore uye zvakavanzika zvinotarisirwa kwete mafaira emuno, uye inozvipinza mumoto chete munzvimbo dzinodhura zvakanyanya. Zvinotevera zvinotevera maonero maviri ekudzivirira.
- Chimiro chacho chinoonekwa. Chinongedzo che npm/PyPI chine girafu yekufona inosvika kuAPI yezvakavanzika zvegore (maneja wezvakavanzika zveAWS, zvakavanzika zve gcloud, keyvault ye az) kana kero yeIMDS uye sink yekubuda kwenetwork inzira yakamanikana, ine masaini akawanda - haimbofi yakaitika muchinyorwa chehupenyu hwese. Kuongorora kuyerera kwemvura kwakasimba inogona kuiratidza pasina kuvimba nechero domain kana IP chaiyo.
- Kuomesa nharaunda kunoita kuti ishaye simba. Kusimbisa IMDSv2 nemuganhu we1 we hop kunodzivirira mabasa emumakontena kusvika pa metadata yemuenzaniso; kuongorora mabasa eIAM kune ropafadzo shoma kunoganhurira kuputika kwenzvimbo yechero chitupa chinobuda; uye kushandisa ma installs ne -Rega-zvinyorwa muCI inobvisa vheta yekuisa-hook zvachose pamapakeji asingaidi.
Kune vadziviriri, matanho anoshanda ndeaya: chenjedzo pamusoro pekubatanidza mawebhusaiti kubva kumakontena ekuvaka/CI kuenda kuma IP eruzhinji asina kubvumidzwa panguva yekushandiswa kwemakombiyuta. npm install; tarisa mukana weIMDS unobva kuma script ehupenyu hwepakeji; uye tarisa chero chinhu chinoisa chinoburitsa kuCloud CLI sechinhu chinofungirwa kusvika zvaratidzwa kuti zvakasiyana.
Mamwe mashoko maviri akanangana neboka iri. Chekutanga, nekuti activation yakavharirwa kunzvimbo dzine makontena, pasuru inoita seisina kushanda kana yaongororwa pa workstation inogona kuramba ichigadzirwa — kuongorora kunofanirwa kuburitsa zita remubati wekontena nemamiriro enzira, kana kuverenga kwakabva zvakananga, pane kuvimba nekuti "Ndakaiisa asi hapana chakaitika." Chechipiri, kushandiswa kwebasa rekuongorora zvikumbiro zveveruzhinji semuunganidzi wemabhakoni zvinoreva kuti mamwe edata rakaburitswa anogona kudzoserwa kuti agadzirise zviitiko: sangano rinowana rimwe remapakeji aya mumuti waro wekuvimba rinogona kufunga nezvezvaizove nebhakoni rakabudirira kubva muhurongwa hwekuunganidza mari, uye rinofanira kutenderedza chero humbowo hwebasa reIAM, marejista emabharani, uye zvakavanzika zvinotarisirwa zvaivepo kubva kunzvimbo yakakanganiswa yekuvaka kana yekumhanya. Kutenderera kwezvitupa, kwete kubviswa kwepakeji, ndiko kugadzirisa kwekushanda kana kuiswa kwatanga.
