TL; DR
Boka remapakeji ePyPI rakatora zita re uv, iyo inokurumidza uye inozivikanwa zvikuru Rust-based Python package manager, yekuzviita sevabatsiri veUV. Havatumire mashandiro chaiwo. Chavanotakura iWindows payload inomira Seva yeJupyterLab ine authentication yakadzimwa uye, mune dzimwe shanduro dzichangoburwa, vanoiburitsa pa internet yeruzhinji kuburikidza ne reverse tunnel.
Ndiyo nyaya yese iri mumutsara mumwe chete: zita rechishandiso chakavimbika sechinokwezva, uye JupyterLab seinjini yekubvisa kodhi iri kure. Seva yeJupyter inoshandisa chero kodhi yaunonyora mu "not"ebook sero; imwe yakatangwa ne token isina chinhu uye yakasungirirwa kune yega network interface imuturikiri akavhurika uyo chero ani zvake anogona kusvika pachiteshi anogona kudhiraivha.
Tinotevedzera boka remapoka se FauxUVMapakeji maviri akaongororwa ndeaya moon-uv (0.0.1-0.0.16) uye my-magic-uv-helper (0.0.1), yakabudiswa nemushandi mumwe chete uye iri mhenyu paPyPI panguva yekuongorora.
| Ecosystem | P&PI |
| Mabhokisi | moon-uv (0.0.1-0.0.16), my-magic-uv-helper (0.0.1) |
| Chikuva chakatarisana | Windows |
| Maitiro epakati | Seva yeJupyterLab isina kusimbiswa, yakaburitswa paindaneti kuburikidza nereverse tunnel |
| Zvishandiso zvepamutemo zvakashandiswa zvisina kunaka | uv, JupyterLab, cloudflared, Pinggy |
Chido: zita raunotovimba naro
uv ndeimwe yezvishandiso zvePython zvakaiswa zvakanyanya mumakore maviri apfuura, saka "mubatsiri we uv"Ipakeji inoiswa nemugadziri wepakeji pasina kufunga kaviri. FauxUV inoshandisa kuvimbika kwayo pazita iroro chete. Mapakeji acho anoputira zvechokwadi uv mugadziri weAstral — maURL ari panzvimbo yekurodha zvinhu pamakambani chaiwo ane mukurumbira — saka kuona nekukurumidza hakuna chimwe chinhu kunze kwezvinyorwa zvinovimbika. Hapana kana chimwe chezvipakeji chinowedzera uv mashandiro; zita racho ndiro chifukidziro chose.
JupyterLab seinjini yeRCE
Chinhu chikuru chemubhadharo itangi rinotanga JupyterLab nerubatsiro rwese rwekudzivirira rwabviswa:
jupyter server --with jupyterlab --ip=0.0.0.0 # listen on every interface --ServerApp.token="" # no password, no token --allow_origin='*' # accept cross-origin connections --disable_check_xsrf # allow a remote browser/WebSocket to drive itMureza wega wega unobvisa dziviriro, uye chinyorwa chinotumirwa chinotozvinyora (mumutauro wepakutanga wechiChinese): chiratidzo chisina chinhu "inodzima password uye token checks — chero munhu anogona kubatana." jupyter lab iIDE yesainzi yedata iri pamutemo, asi kweteebook sero rinoshandisa kodhi isina kurongeka nekugadzira. Rakagadzirirwa nenzira iyi uye rakabatana ku 0.0.0.0, inorega kuva IDE uye inova shell isina kusimbiswa pahost — hapana malware binary inodiwa, kungoti chishandiso chikuru chinonongedzera nzira isiriyo.
Zvidimbu zviviri zvinotsigira zvinoita kuti zvikwanisike uye zvidzokororwe:
- Chinhu chinokonzeresa kuisa chinyararire. Shanduro dzekutanga dzinoshandisa PowerShell ne -ExecutionPolicy Bypass yakananga kubva setup.py on pip kuisa, kumashure nezvikanganiso zvakadzimwa saka Pip zvinoita sezvakanaka. Shanduro dzakazotevera dzinoisa shanduro imwecheteyo yekare mu pip-uv chishandiso chemutsetse wemirairo — uye bvisa nguva yekuisa otomatiki zvachose.
- Mugero weveruzhinji unodzokera shure. Sevha iri pa 0.0.0.0 ichiri kusvikika chete nemahost anogona kuenda kumuchina. Module yakaunganidzwa inovhura [Pinggy](https://pinggy.io/) Mugero weSSH unodzosera kumashure unoendesa chiteshi cheJupyter chemuno kune kero yeruzhinji, zvichibvisa muganho iwoyo. Chinyorwa chakatumirwa chinewo — chakatsanangura — imwe nzira inoshandisa Cloudflare's yakapiswa nemakore uye neth port-proxy kune Linode IP, ichinyora chinangwa chimwe chete kuburikidza nezvivakwa zvakasiyana.
Gadzira pamwe chete: isa pasuru, uye muchengeti weWindows anozopedzisira ashandisa JupyterLab isina password uye oiburitsa pa internet yakavhurika.
Mafambiro akaita FauxUV
Mashanduro eFauxUV akatumirwa nekukurumidza, uye nzvimbo yekuburitsa zvinhu yakafamba pamusoro pavo - chiyeuchidzo chekuti shanduro imwe chete ine mucherechedzo haiwanzo taura nyaya yese yemutsetse wepakeji.
Zvinonyanya kukosha kuti nguva yekuisa yaiitwa otomatiki yakabviswa mune mamwe mavhezheni ekupedzisira, ane hunyanzvi - saka scanner yaingoshanda chete pahupenyu hwese hooks zvaizopa marekodhi matsva se zvishoma zvine njodzi, zvichidzokera shure chaizvo.
Zviratidzo zvekubvumirana
Zvakasimbiswa nekuverenga kwakabva papakeji; mapoinzi ekupedzisira akanyorwa Akadaro dziripo mumafaira asi hadzina kuitwa neshanduro yakaongororwa. Zviratidzo zve network zvakabviswa.
Zviratidzo zvemaitiro zvakakodzera kunyeverwa, zvisinei netambo idzi chaidzo: a pip kuisa izvo zvinobereka powershell -ExecutionPolicy Bypasschero chipi zvacho jupyter kutanga kusanganisa chiratidzo =”” ne –ip=0.0.0.0uye kubuda kweSSH kuenda ku *.pinggy.io kubva kumugadziri wezvigadzirwa kana muchina weCI.
Maitiro akaonekwa uye kwakabva
Mapakeji maviri aya ane munyori uye nzira imwe chete: zita rechishandiso chakavimbika, Windows-only gating, error-depressed background execution, uye kuvimba nezvishandiso zvine mukurumbira saka nekukurumidza unongoona ma URL ane mukurumbira chete. Sosi yacho ine mashoko emutauro wechiChinese anotsanangura zvakajeka mireza ine chekuita nekuchengetedzwa; tinoshuma izvozvo semashoko anoonekwa mufaira, kwete sekutaura nezvechinangwa. bvumira_kwakabva kukosha uye colab.bat filename inodzokorora maitiro asina kurongeka ekuti "share my local runtime" anotenderera kuGoogle Colab. Chero kwakabva chii, mhedzisiro yacho yakafanana.
Mhedzisiro nenhungamiro kune vadziviriri
Ndiani ari kusangana neFauxUV. Vagadziri veWindows uye vatyairi veCI avo pip kuisa rimwe remapakeji aya. JupyterLab isina password iri pa 0.0.0.0 ibasa rekushandisa kodhi iri kure kune chero munhu anogona kusvika pachiteshi; mugero unobvisa muganho wekuti "ndiani anogona kusvika pairi". Sevha inoshanda semushandisi anoisa, ichigara nhaka mafaira emushandisi iyeye, ma token, uye cloud credentials.
Sei zviri nyore kupotsa. Tambo yega yega yetiweki inonongedzera kune host ine mukurumbira - Astral, JupyterLab, yakapiswa nemakore, Pingggy, Colab. Hapana malware binary ku hash uye hapana obfuscated blob yekubvisa. Kuskena kwakavakirwa pazita remukurumbira uye signature-based zvese zvinoderedza kukosha kweizvi, ndosaka mubvunzo wemaitiro — Chii chinoita kuti kuisa package iyi kuite muchina uyu? — ndiye anoibata.
Nhungamiro:
- Bata chero nguva yekuisa powershell -ExecutionPolicy Bypass sechiratidzo chinoputsa kuvaka, chero URL yainotora.
- Yambiro yakabatidzwa jupyter yakatangwa nechiratidzo chisina chinhu uye –ip=0.0.0.0; musanganiswa iwoyo haufanirwe kumboonekwa panzvimbo yebasa kana pamuchina wekushandisa.
- Tarisa kune vanopa SSH vanobuda kuenda kune tunnel (*.pinggy.io, *.trycloudflare.com) kubva kunzvimbo dzevagadziri uye CI.
- gadza uv kubva [kubva kwayo kwepamutemo](https://docs.astral.sh/uv/) uye usava nechokwadi nemapakeji e "helper" evamwe anoputira chishandiso chidiki diki chekuisa.
- Pin woongororazve zvinoenderana nekuvandudzwa kweshanduro — mutsetse wepakeji unogona kuwedzera kugona kweshanduro itsva pamusoro peshanduro.
