TL; DR
Iqela leepakeji zePyPI liboleke igama elithi uv, umphathi wephakheji yePython esekwe kwiRust okhawulezayo nodumileyo, ozenza abancedisi be-UV. Abathumeli phantse umsebenzi wokwenyani. Endaweni yoko, into abayiphetheyo yiWindows payload eme phezulu. Iseva yeJupyterLab ecinyiweyo uqinisekiso kwaye, kwiinguqulelo zamva nje, bayipapasha kwi-intanethi kawonke-wonke nge-tunnel engasemva.
Yiyo yonke le nto ibali likwimigca enye: igama lesixhobo esithembekileyo njengelure, kunye neJupyterLab njengenjini yokuphumeza ikhowudi ekude. Iseva yeJupyter isebenzisa nayiphi na ikhowudi oyichwethezayo kwi-notebook iseli; enye eqaliswe ngethokheni engenanto kwaye ibotshelelwe kuyo yonke i-interface yenethiwekhi yitoliki evulekileyo enokuthi nabani na onokufikelela kwizibuko ayiqhube.
Silandelela iqela njenge I-FauxUVEzi phakheji zimbini zihlolwayo zezi moon-uv (0.0.1-0.0.16) kwaye my-magic-uv-helper (0.0.1), epapashwe ngumqhubi ofanayo kwaye ibukhoma kwiPyPI ngexesha lohlalutyo.
| Ecosystems | I-PyPI |
| Iipakethi | moon-uv (0.0.1-0.0.16), my-magic-uv-helper (0.0.1) |
| Iqonga elijoliswe kulo | Windows |
| Ukuziphatha okungundoqo | Iseva yeJupyterLab engaqinisekiswanga, epapashwe kwi-intanethi ngetonela engasemva |
| Izixhobo ezisemthethweni zisetyenziswa kakubi | i-uv, iJupyterLab, i-cloudflared, iPinggy |
Isihendo: igama osele ulithembile
uv yenye yezona zixhobo zePython ezifakelwe kakhulu kwiminyaka emibini edlulileyo, ngoko ke “umncedisi we uv"yiphakheji efakwa ngumphuhlisi ngaphandle kokucinga kabini. I-FauxUV ichitha ukuthembeka kwayo ngokupheleleyo kuloo gama. Iiphakheji zigubungela i ngokwenene uv umfaki-sicelo ovela kwi-Astral — ii-URL ezikwindawo yokulayisha kwi-hosts zokwenyani nezihloniphekileyo — ngoko ke ukujonga ngokukhawuleza akuboni nto ngaphandle kweereferensi ezithembekileyo. Akukho nanye kwezi package yongezayo ngokwenene uv ukusebenza; igama lilonke lifihlakele.
IJupyterLab njengenjini ye-RCE
Isixhobo esiphambili somthwalo sisiqalo esiqala iJupyterLab kunye nokususwa kwereyili nganye:
jupyter server --with jupyterlab --ip=0.0.0.0 # listen on every interface --ServerApp.token="" # no password, no token --allow_origin='*' # accept cross-origin connections --disable_check_xsrf # allow a remote browser/WebSocket to drive itIflegi nganye isusa ukhuseleko, kwaye iskripthi esithunyelweyo siyayichaza (ngesiTshayina sokuqala): ithokheni engenanto "icima igama eligqithisiweyo kunye nokuhlolwa kweethokheni - nabani na angaqhagamshela." IJupyterLab yi-IDE yesayensi yedatha esemthethweni, kodwa ayisiyoebook iseli isebenzisa ikhowudi engaqhelekanga ngoyilo. Ilungiselelwe ngale ndlela kwaye ibotshelelwe kwi 0.0.0.0, iyeka ukuba yi-IDE ize ibe yi-remote shell engaqinisekiswanga kwi-host — akukho mfuneko ye-malware binary eyenziwe ngokwezifiso, sisixhobo esiphambili esikhomba indlela engalunganga.
Iziqwenga ezibini ezixhasayo zenza ukuba kube lula ukufikeleleka nokuphindwa:
- Isiqalisi sokufaka esingathethiyo. Iinguqulelo zokuqala zisebenzisa iPowerShell -UkucaciswaPolisi yeNdlela ngqo ukusuka setup.py on pip ufake, ngasemva kukho iimpazamo ezicinezelweyo ukuze kuba ekugqibeleni ibukeka iqhelekile. Iinguqulelo zamva zihambisa le ncwadi yokuqala iye kwi i-pip-uv isixhobo somgca womyalelo — kwaye ulahle i-install-time ngokuzenzekelayo ngokupheleleyo.
- Umhubhe ongasemva kawonke-wonke. Iseva ivuliwe 0.0.0.0 isafikeleleka kuphela ziihostele ezinokuya kumatshini. Imodyuli ehlanganisiweyo ivula i-[Pinggy](https://pinggy.io/) Umjelo obuyela umva we-SSH othumela izibuko lendawo laseJupyter kwidilesi kawonkewonke, ususa loo mda. Iskripthi esithunyelweyo sikwaphethe — siphawule — enye indlela esebenzisa iCloudflare’s itshiswe ngamafu kunye a netsh i-port-proxy kwi-Linode IP, ebhala phantsi injongo efanayo ngokusebenzisa iziseko zophuhliso ezahlukeneyo.
Hlanganisa: faka iphakheji, kwaye umphathi weWindows ugqibela esebenzisa iJupyterLab engenagama aze ayipapashe kwi-intanethi evulekileyo.
Indlela iFauxUV eyavela ngayo
Iinguqulelo zeFauxUV zithunyelwe ngokulandelelana ngokukhawuleza, kwaye indawo yokuqala yomthwalo yadlula kuzo — isikhumbuzo sokuba uhlobo olunye oluphawulweyo alufane lubalise lonke ibali lomgca wephakheji.
Okuphawulekayo kukuba, ixesha lokufaka liqhutywa ngokuzenzekelayo zisuswe kwiinguqulelo zamva nje, ezinobuchule ngakumbi — ngoko ke iskena sisebenza kuphela kumjikelo wobomi hooks iza kufumana amanqaku okukhululwa okutsha njenge Ngaphantsi umngcipheko, ubuyela umva ngqo.
Iimpawu zokuvumelana
Iqinisekisiwe ngokufunda umthombo wephakheji; iindawo zokugqibela ziphawulwe Waphendula zikhona kwiifayile kodwa azisetyenziswa yinguqulelo ehlalutyiweyo. Izikhombisi zenethiwekhi zitshintshiwe.
Iimpawu zokuziphatha ezifanele ukulumkiswa ngazo, ngaphandle kwezi ntambo zichanekileyo: a pip ufake oko kuvela i-powershell -ExecutionPolicy Bypassnaluphi na ijupyter ukuqalisa ukudibanisa uphawu =”” kunye –ip=0.0.0.0kunye ne-SSH ephumayo ukuya kwi *.pinggy.io evela kumphuhlisi okanye kumatshini we-CI.
Ukuziphatha okujongiweyo kunye nemvelaphi
Ezi paki zimbini zabelana ngombhali kunye nendlela: igama lesixhobo esithembekileyo, i-Windows-only gating, ukuphunyezwa kwemvelaphi ecinezelweyo, kunye nokuxhomekeka kwizixhobo ezithembekileyo ngoko ke ukujonga ngokukhawuleza kubona kuphela ii-URL ezithembekileyo. Umthombo uphethe izimvo zolwimi lwesiTshayina ezichaza ngokucacileyo iiflegi ezinxulumene nokhuseleko; sizixela njengeengxelo ezibonakalayo kwifayile, kungekhona njengebango malunga nesizathu. vumela_imvelaphi ixabiso kunye colab.bat Igama lefayile liphinda-phinda imisebenzi yokusebenza engekho mthethweni ethi “share my local runtime” ejikeleza kwiGoogle Colab. Nokuba imvelaphi ithini, iziphumo ezipakishiweyo ziyafana.
Impembelelo kunye nesikhokelo sabakhuseli
Ngubani ochaphazeleka yiFauxUV. Abaphuhlisi beWindows kunye nabagijimi beCI abasebenzisa iWindows pip ufake enye yezi phakheji. I-JupyterLab engenagama lokugqitha ivuliwe 0.0.0.0 kukusetyenziswa kwekhowudi ekude kuye nabani na onokufikelela kwizibuko; umjelo ususa umda othi “ngubani onokufikelela kulo”. Iseva isebenza njengomsebenzisi ofakelayo, ifumana iifayile zaloo msebenzisi, iithokheni, kunye neziqinisekiso zelifu.
Kutheni kulula ukuphoswa. Yonke intambo yenethiwekhi ikhomba kwi-host ethembekileyo - i-Astral, i-JupyterLab, itshiswe ngamafu, Pingggy, Colab. Akukho malware binary kwi hash kwaye akukho blob engaqondakaliyo yokuyichaza. Ukuskena okusekelwe kudumo kunye nesiginesha zombini azinamsebenzi konke oku, yiyo loo nto umbuzo wokuziphatha — Yintoni eyenza umatshini wenze oku ukufaka le phakheji? — ngulowo uyibambayo.
Isikhokelo:
- Phatha naliphi na ixesha lokufaka i-powershell -ExecutionPolicy Bypass njengomqondiso oqhekezayo, nokuba yeyiphi na i-URL eyifumanayo.
- Isilumkiso pa ijupyter iqaliswe ngethokheni engenanto kwaye –ip=0.0.0.0loo ndibaniselwano akufuneki ivele kwindawo yokusebenza okanye kwi-runner.
- Jonga ababoneleli be-SSH abaphumayo ukuya kwi-tunnel (*.pinggy.io, *.trycloudflare.com) ezivela kwiindawo zomphuhlisi kunye ne-CI.
- Faka uv evela [kumthombo wayo osemthethweni](https://docs.astral.sh/uv/) kwaye ungathandabuzi ngeepakethe "zomncedisi" zomntu wesithathu ezisonga isixhobo esilula ukuyifaka.
- Phina kwaye uphinde uhlole ukuxhomekeka ekuphuculeni — umgca wephakheji unokukhulisa amandla amatsha enguqulelo-ngaphezulu-kwenguqulelo.
