TL; DR
Iqoqo le amaphakheji amahlanu npm, eshicilelwe kuzo zombili izibambo ze-akhawunti, yathunyelwa postinstall i-hook efunda iziqinisekiso zamafu ezivela kumphathi bese izithumela ngaphandle kwebhokisi. Amaphakheji aphethe amagama ezipoki kanye namasela empi — coral-wraith, ecto-corsair-whisper-6f3b9, ecto-corsair-flag-x9m4, ecto-rust-read-f3a9c1, ecto-nightly-spirit — futhi bahlele noma yini abayiqoqayo ibe yi-fake ecto_module: I-YAML manifest ngaphambi kokuyithumela. Silandelela iqembu njengoba I-Ectoplasm.
Umthwalo okhokhelwayo usebenza kuphela uma uthola indawo ethile: umninikhaya ogama lakhe lingu- Intambo ye-hex enezinhlamvu ezingu-12 kanye nesiqondisi esisebenzayo ngaphansi /app/node_modules — isimo sesakhiwo esifakwe esitsheni noma isisebenzi se-CI. Lapho lelo sango lidlula, i-hook ibuza Isevisi yemethadatha yesibonelo se-AWS (IMDSv2) ukuthola iziqinisekiso zendima ye-IAM, kubalwa Umphathi Wezimfihlo we-AWS kuzo zonke izifunda ezintathu, ilahla iziguquguquko zemvelo, ifunda amafayela ngaphansi /app, bese iklwebha izintambo zokubamba ifulegi. Bese ikhipha umphumela ngezindlela ezimbili: i-beacon ku- webhook.site umqoqi kanye ne-manifest PUT endaweni yokugcina ye-raw-IP, enohlu lwe-localhost-first fallbacks.
Izincazelo zephakheji zakamuva zifundeka kanje "I-CTF payload for verdaccio supply-chain testing." Sibika lokho kuzichaza njengeqiniso elibonakalayo. Ukuziphatha ngokwako — ukuphuma bukhoma ku-IP yomphakathi, ukufunda kweziqinisekiso zangempela ze-IMDS, izingcingo ze-Real Secrets Manager — yilokho okuyikho kungakhathaliseki ukuthi ilebula liyini, futhi yisona sizathu esenza lezi zinguqulo zahlukaniswa ngokuthi zinonya.
Igama elilodwa eqenjini, coral-wraith, ayizange iphele ekukhishweni okukodwa. Yaphinde yanyatheliswa ngokushesha ngezinguqulo eziningi emahoreni ambalwa nje — 1.0.0 ukukhuphukela ku- 6.0.0 — futhi ukusetshenziswa kwangaphambilini kwegama elifanayo kwakusebenzise i-inflamed 9999.0.x izinombolo zenguqulo, isimo sakudala se- umzamo wokudideka kokuthembelaNgaleyo ndlela umthwalo okhokhelwayo ubonakala uvuthiwe: kusukela ku-beacon yokubalwa kwe-host eyodwa kuya ku-pivot ephelele ye-AWS ehlanganiswe nokuhlolwa kwemvelo okugcina kuthule ngaphandle kwenhloso yayo ehlosiwe.
| Packages | Amagama ama-5; coral-wraith eyedwa eshicilelwe kabusha kuzo zonke izinguqulo eziningi |
| Ecosystem | npm |
| Faka i-vector | postinstall iskripthi somjikelezo wokuphila |
| Inhloso eyinhloko | Iziqinisekiso zendima ye-AWS IAM + Amanani ayimfihlo oMphathi Wezimfihlo, iziguquguquko zemvelo, /app amafayela |
| I-Exfil | webhook.site i-beacon + i-raw-IP C2 PUT |
| Isango lesiqhumisi | Igama lomphathi le-12-hex + /app/node_modules i-cwd, kanye nokuhlolwa kwemvelo okucindezela umthwalo okhokhelwayo ngaphandle kwalowo mongo |
| Ubunzima | high — iziqinisekiso zamafu kanye nokudalulwa okuyimfihlo okuphethwe kusuka izindawo zokwakha ezifakwe ezitsheni kanye nesikhathi sokusebenza |
Ukwakheka komzimba kokuhlasela
Iphakheji ngayinye eqenjini yakhiwe ngendlela efanayo: cishe ayinalutho index.js (i-module.exports = {}), umugqa owodwa iphakethe.json iskripthi — “ukufaka ngemuva”: “i-node postinstall.js” - kanye nomthwalo okhokhelwayo ku i-postinstall.jsUkufaka iphakheji kwanele ukusebenzisa i-hook; akukho ukungenisa noma ukushayela okudingekayo.
Isango lokukhomba. Ngaphambi kokwenza noma yini, umthwalo we-ecto-family uhlola indawo ezungezile:
function isAppWorker(): host = os.hostname() if host does NOT match /^[0-9a-f]{12}$/ -> exit if cwd does NOT contain "/app/node_modules" -> exit if cwd contains "/tmp/npm-safe" -> exit otherwise -> proceedIgama lomphathi le-12-hex liyisimo esizenzakalelayo i-Docker esinika isitsha, futhi /app/node_modules kuyindlela evamile yokufaka ngaphakathi kwesitsha. Isigaba sesithathu siyaphuma uma indlela ibukeka njengesiqondisi sokukhipha i-sandboxed. Umphumela oyinhloko ukuthi umthwalo okhokhelwayo uhlala ungasebenzi kukhompyutha ephathekayo yonjiniyela noma ku-sandbox yokuhlaziya futhi usebenza kuphela ngaphakathi kwesakhiwo esifakwe esitsheni noma isisebenzi sesikhathi sokusebenza - uhlobo lwendawo okungenzeka kakhulu ukuthi ithwale iziqinisekiso zamafu abukhoma. Iphakheji yokuqala kakhulu eqenjini, i-coral-wraith, ayinalo isango elinjalo futhi isebenzisa iqoqo layo (elilula) ngaphandle kwemibandela.
CollectionLapho isango lidlula, amagobolondo ezingwegwe aphuma i-execFileSync(“/bin/sh”, [“-c”, …]) futhi isebenzisa umyalo owodwa ohlanganisiwe, ngokulandelana:
1. PUT /latest/api/token to 169.254.169.254 (IMDSv2 token request) 2. GET .../iam/security-credentials/ (IAM role name) 3. GET .../iam/security-credentials/<role> (temporary credentials) 4. dump env | sort (environment variables) 5. list /app (excl. node_modules) + cat first 15 (application files) 6. aws secretsmanager list-secrets (us-east-1, eu-west-1, eu-central-1) 7. scrape readable files for HTB{...} (capture-the-flag strings)Izinyathelo 1–3 ziyincwadi yokubuyisa i-IMDSv2: cela ithokheni yeseshini, bese uyinamathisela njenge Ithokheni ye-metadata ye-X-aws-ec2 Isihloko sokudonsa indima ye-IAM yesibonelo kanye nezinkinobho zokufinyelela zesikhashana zaleyo ndima. Ukukhetha ukusebenzisa i-IMDSv2 kune-IMDSv1 elula engaqinisekisiwe Thola kubalulekile ukuqaphela — kusho ukuthi umthwalo okhokhelwayo usebenza ngisho nasezimweni ezilungiselelwe ukudinga ukufinyelela kwe-metadata okusekelwe kumathokheni, okuyi-hardening enconyiwe yi-AWS. Iziqinisekiso ezibuyiswa ngesinyathelo sesi-3 zihlala isikhathi esifushane I-AccessKeyId/I-SecretAccessKey/I-Token ama-triple abheke indima yesibonelo; noma ngabe leyo ndima ingenzani, umnikazi walezo zikhiye angenza impilo yonke yesitifiketi.
Izinyathelo 4–6 zandisa indlela yokuthathwa. env i-dump ibamba noma yini inqubo yokwakha noma yesikhathi sokusebenza esizuzwe njengefa — empeleni yilapho amathokheni okubhalisa, izintambo zokuxhumeka kwedatha, kanye nezinkinobho ze-API zivame ukuhlala khona. /uhlelo lokusebenza ukuhamba kwefayela kufunda amafayela esicelo afinyelela kwayishumi nanhlanu ngaphandle ama-node_modules, okungase kulungiselelwe ubuso, .inv amafayela, noma umthombo. Izingcingo zesinyathelo 6 uhlu lwezimfihlo ze-aws ezifundeni ezintathu; iziqinisekiso ezidonswe ezinyathelweni 1-3 yizona kanye eziqinisekisa lezo zingcingo, ngakho-ke i-IMDS ifunda kanye nochungechunge lokubalwa kwe-Secrets Manager ndawonye kube yi-escalation eyodwa: indima yesibonelo → i-managed-secret inventory. Isinyathelo 7 siwuphawu lokufakwa kwe-capture-the-flag — lapho I-HTB{…} ifulegi litholakala lithunyelwa lodwa, ngaphandle kwalokho i-blob eluhlaza eqoqwe iyahlukaniswa ibe yizicucu ezine bese ithunyelwa.
Izinguqulo zakamuva eqenjini ziqhubekisela phambili ukwanda. Esikhundleni sokuma endaweni yokugcina impahla, zihlaziya impendulo ye-IMDS, zithumele okhiye besikhashana njenge AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / I-AWS_SESSION_TOKEN izinguquko zemvelo, qinisekisa ukuthi ungubani i-aws sts ithola i-caller-identity, bese uphinda ubheke yonke imfihlo ebuyiselwe ngu izimfihlo zohlu ukushaya i-aws secretsmanager i-get-secret-value kumuntu ngamunye — ukuthola okuqukethwe okuyimfihlo, hhayi amagama abo kuphela. Izinguqulo ezifanayo zifunde nama-binary amafulegi afakwe esikhundleni senqubo (/ifulegi lokufunda nabangani) bese uzama ukushaja run ngokumelene nanoma yimuphi umsebenzi we-Rust otholakala ngaphansi /uhlelo lokusebenza, ukwandisa isivuno ngale kweziqinisekiso zamafu kunoma yini evezwa yindawo yokwakha.
Lezi zinguqulo zakamuva nazo zizifaka engozini enkulu. Ngaphezu kwegama le-hostname elingu-12-hex kanye negama le-hostname elingu-12-hex. /app/node_modules Uma ihlola, umthwalo wokukhokha uhlola ukucushwa kwe-active package-registry kanye nendlela ye-working-directory bese uphuma buthule lapho ubonisa ukuhlaziywa noma umongo wesibuko kunokuba kube yithagethi ebukhoma. Umphumela ohlanganisiwe umthwalo wokukhokha ongenzi lutho olubonakalayo ezindaweni eziningi zokuhlola futhi uqhuba iqoqo lawo eliphelele kuphela lapho uzibheka njengosesimeni sangempela esinamakhonteyina.
ExfiltrationIdatha eqoqwe ishiya i-host kumashaneli amabili. Okokuqala, i-beacon I-POST kuya endaweni ehleliwe webhook.site umqoqi, ophethe igama lomphathi, i-UID yezinombolo, isiqondisi esisebenzayo, kanye nedatha eqoqwe efika ku-120 KB. Okwesibili, idatha igoqwa ibe yi-"module manifest" ye-YAML mbumbulu futhi PUT kuya /api/amamojula/ kuseva eqondiwe:
ecto_module: name: "<flag-or-chunk-0>" version: "1.0.0" power_level: "<chunk-1>" ship_deck: "<chunk-2>" cargo_hold: "<chunk-3>"Amagama enkambu ye-manifest (izinga_lamandla, idekhi_lomkhumbi, ukubamba_impahla) ziwumhlobiso — idatha eyebiwe ihamba ngaphakathi kwamanani entambo, yingakho i-network monitor ibona lokho okubukeka njengokulayishwa kwe-manifest yephakheji-registry engabonakali kunokuba kube ukulahlwa kwedatha okusobala. Isiteshi se-beacon siphethe okwengeziwe: i I-POST umzimba webhook.site ifaka igama lomphathi, i-UID yezinombolo, isiqondisi esisebenzayo, kanye nosayizi ofika ku-120 KB we-blob eqoqwe, ngakho-ke ngisho ne-beacon eyodwa ephumelelayo inikeza umbono ophelele. webhook.site kuyisevisi yokuhlola isicelo yamahhala; ukuyisebenzisa njengomqoqi kusho ukuthi umqhubi akakaze adinge ukuthola ingqalasizinda yakhe yaleso siteshi, futhi izicelo ezirekhodiwe zihlala emgqonyeni wesevisi.
I-manifest PUT uhamba uhlu lokubuyela emuva oluqala ngezinhlobo eziningana 127.0.0.1/localhost amachweba bese ewela emakhelini omphakathi amathathu ku-`154.57.164.0/24` ububanzi, buma endaweni yokuqala ephendula ngesimo se-2xx. Uku-oda kwe-localhost-first kuhambisana nencazelo yakho "yokuhlola i-verdaccio" (irejista yendawo ku-loopback), kodwa ama-fallback e-public-IP asho ukuthi idatha ishiya i-host noma nini lapho i-loopback ingalaleli — okusho ukuthi, kunoma yimuphi umshini ongeyona i-test rig yombhali.
esibekelwe
Iqoqo libonisa ukukhula kwamandla okuqhubekayo kunokwehla okukodwa. Sihlela lokhu ngokuziphatha okubonwe, hhayi ngokushicilela iwashi lodonga:
Isici esichazayo seqembu yi-cadence yalo yokushicilela: esikhundleni sephakheji eyodwa nenguqulo eyodwa, igama elifanayo liphinde lishicilelwe ngokuphindaphindiwe ngokushesha, ngalinye likhipha inguqulo encane kokugcina, kanye nedlanzana labafowabo nodadewabo abaqanjwe ngendlela ehlukile abaphethe umthwalo ofanayo. kuhleba umndeni ikhodi ihlukaniswe yaba izigxivizo zeminwe ezimbili eziseduze — isethi eyodwa ikhubeka ekutholakaleni okubili okubalulekile, ezinye ezintathu (isinki eyengeziwe yokufunda amafayela) — kodwa zombili zixazulula umthwalo ofanayo; umehluko ukuzulazula kwekhodi, hhayi ifoloko lokuziphatha. kuhleba ngale kobubanzi obuhlaziyiwe (kufika okungenani ku-1.0.25 ngesikhathi sokubhala) kubonwe bukhoma kurejista, kanye i-coral-wraith Igama laqhubeka nokukhuphuka ileli lalo eliyinguqulo phezu kwefasitela elifanayo.
Izinkomba zokuvumelana
Zonke izinkomba ezingezansi zikhishwe emthonjeni wephakheji kudiski. Izinkomba zenethiwekhi zishintshiwe.
Network
Ifayela lokuziphatha/lokuziphatha
Ama-hashe efayela (sha256, athathwe ngesikhathi sokuhlaziya)
Ukuchazwa kanye nokuziphatha okubonwe
Amagama amaphakheji amahlanu ashicilelwe ngaphansi kwezibambo ezimbili ze-akhawunti ye-npm, kodwa abelana ngengqalasizinda eyanele yokuwaphatha njengeqembu elilodwa: okufanayo i-ecto_module i-manifest schema, okufanayo I-ECT-472839 uphawu lwesinki oluyinhloko, okufanayo webhook.site i-ID yomqoqi, kanye nama-endpoints e-C2 ngokufanayo Ibhulokhi engu-154.57.164.0/24`. Iphakheji yembewu (`coral-wraith, elula futhi engavaliwe) futhi umndeni we-ecto-gated ngaleyo ndlela ufundwa njengeziphindaphindo kuthuluzi elilodwa kunemizamo ezimele.
Amaphakheji azichaza ngokwawo, ezinguqulweni zakamuva, ngokuthi "Umthwalo we-CTF wokuhlolwa kwe-verdaccio supply-chain." Siveza lelo lebula njengeqiniso elibonakalayo futhi asiliphindi njengokutholakele ngenhloso. Lokho okwenziwa yikhodi akucaci futhi akuxhomekile ekutheni ibhalwe kanjani: ifunda iziqinisekiso zendima ye-IAM ezivela kusevisi ye-instance metadata, ibala izimfihlo eziphethwe kuzo zonke izifunda ezintathu ze-AWS, futhi idlulisela imiphumela ku-IP yomphakathi kanye nomqoqi we-webhook wesithathu. I-harness yokuhlola ye-loopback-kuphela ngempela ngeke idinge uhlu lwe-fallback lomphakathi-IP, i-IMDS credential ifunda, noma izingcingo ze-cross-region Secrets Manager. Ngenxa yokuthi ukuphuma kanye nokufinyelela kweziqinisekiso kungokoqobo, izinguqulo ezivikelwe zahlukaniswa njengezinonya.
Isango lesitsha kuphela yilona eliphawuleka kakhulu ekusebenzeni. Kuyindlela yokubalekela — ukuhlala uthule kuma-laptop kanye nama-sandbox okuhlaziya — kanye nendlela yokukhomba, ukudubula kuphela lapho indima yangempela ye-IAM kanye nezimfihlo ezibukhoma kungenzeka khona. Abahlaziyi abasebenzisa la maphakheji ku-sandbox ejwayelekile ngeke babone lutho; ukuziphatha kubonakala kuphela ngaphansi kwegama lomethuleli lesitayela se-Docker kanye nendlela yokufaka esitsheni.
Umthelela, izitayela kanye nesiqondiso sabavikeli
Ukuvezwa lapha ubufakazi befu kanye nokudalulwa okuyimfihlo ngaphakathi kweziqukathi zokwakha kanye nesikhathi sokusebenza. Ubufakazi bendima ye-IAM obukhishwe ku-IMDS buphethe noma yiziphi izimvume eziphethwe yindima; umphathi wezimfihlo:UhluIzimfihlo (kanye nanoma yikuphi okulandelayo TholaInani Eliyimfihlo) kwandisa lokho kube yizimfihlo zezinhlelo zokusebenza ezigciniwe. Ama-dump aguquguqukayo endawo avame ukuthwala amathokheni okubhalisa, ama-URL edathabheyisi, kanye nezinkinobho ze-API. Kumongo we-CI noma wesikhongozeli - yilokho kanye isango elikukhethayo - ukufakwa okukodwa okuguqukayo kwelinye lala maphakheji kwanele ukuvuza leyo nto.
I-Ectoplasm ifanela iphethini esiqhubeka nokuyibona: imithwalo yesikhathi sokufaka efinyelela ku-metadata yamafu kanye nezimfihlo eziphethwe kunamafayela endawo, futhi ezizibeka ekudubuleni kuphela ezindaweni ezinenani eliphezulu. Kulandela ukubonwa okubili kokuzivikela.
- Isimo siyabonakala. I-hook yokufaka ye-npm/PyPI enegrafu yayo yokushaya efinyelela kokubili ku-API yezimfihlo zamafu (umphathi wezimfihlo ze-aws, izimfihlo ze-gcloud, i-az keyvault) noma ikheli le-IMDS kanye nesinki yokuphuma kwenethiwekhi kuyiphethini encane, enesignali ephezulu — cishe ayikaze yenzeke kusikripthi somjikelezo wokuphila esisemthethweni. Ukuhlaziywa kokugeleza okumile ingayimaka ngaphandle kokuncika kunoma yisiphi isizinda noma i-IP ethile.
- Ukuqina kwemvelo kuyayithuntubeza. Ukuphoqelela i-IMDSv2 ngomkhawulo we-hop ongu-1 kuvimbela umthwalo wemisebenzi yesitsha ukuthi ungafinyeleli imethadatha yesibonelo; ukukala izindima ze-IAM kumalungelo aphansi kunciphisa i-radius yokuqhuma kwanoma iyiphi i-criteria evuzayo; kanye nokusebenzisa ukufakwa nge –Ziba-imibhalo ku-CI kususa i-vector ye-install-hook ngokuphelele kumaphakheji angawadingi.
Kwabavikeli, ukuhlolwa okusebenzayo yile: ukuxwayisa ngokuxhumeka okuphumayo kusuka ezitsheni zokwakha/ze-CI kuya kuma-IP omphakathi angavunyelwe ngesikhathi ukufaka i-npm; qaphela ukufinyelela kwe-IMDS okuvela ezikriphthini zomjikelezo wokuphila kwephakheji; futhi uphathe noma iyiphi i-hook yokufaka ehlasela i-CLI yamafu njengokusolisayo kuze kube yilapho kufakazelwa ngenye indlela.
Amanye amanothi amabili aqondene naleli qembu. Okokuqala, ngoba ukusebenza kugadwe ezindaweni ezifakwe izitsha, iphakheji ebonakala ingasasebenzi uma ihlolwe endaweni yokusebenza isengasebenza ekukhiqizweni - ukuhlola kudinga ukuphinda kukhiqizwe igama lesizinda kanye nezimo zendlela yesitsha, noma kufundwe umthombo ngqo, kunokuthembela kokuthi "Ngiyifakile futhi akwenzekanga lutho." Okwesibili, ukusetshenziswa kwensizakalo yokuhlola isicelo somphakathi njengomqoqi webhekoni kusho ukuthi eminye yedatha ekhishwe ingatholakala ukuze kuphendulwe ngengozi: inhlangano ethola enye yalezi ziphakheji esihlahleni sayo sokuthembela ingacabanga ngalokho ibhekoni eliphumelelayo elalizoqukatha kusukela ku-logic yokuqoqwa komthwalo, futhi kufanele ijikeleze noma yiziphi iziqinisekiso zendima ye-IAM, amathokheni okubhalisa, kanye nezimfihlo eziphethwe ezazingatholakala kusukela endaweni yokwakha noma yokusebenza ethintekile. Ukujikeleza kweziqinisekiso, hhayi ukususwa kwephakheji, kuyindlela yokulungisa esebenzayo uma ukufakwa sekuqalile.
