Introduction to Ansible
Ansible is an infrastructure configuration engine
that enables IT personnel to dynamically
and automatically configure IT infrastructure
and computing resources.
It works through a “push” model
where the Ansible controller connects to registered “nodes”
and runs “modules” on them.
Ansible modules are specialized Python scripts
that are transported to the nodes by Ansible
and then run
to perform certain actions.
This actions can include anything from gathering data to configuring settings
or running commands and applications.
After the scripts are run, artifacts from running the scripts are deleted
and any data gathered by the script is returned to the controller.
In order for a machine to be set up as a node for an Ansible controller,
it needs to be part of the Ansible inventory
on the controller server.
Servers in the inventory can be grouped
so that certain actions can be performed on some groups but not others.
For actions to be performed on the node,
either the password for a user on the node needs to be stored on the controller,
or the controller’s Ansible account
needs to be configured on the node
using SSH keys.
This allows the controller to connect to the node via SSH
or other means
and run the desired modules.
Because the Ansible server needs elevated
privileges to perform certain tasks on the end node,
the user configured by Ansible
typically has root
or sudo-level permissions.
This mean that compromising the Ansible server
or otherwise getting the private key for an Ansible configuration account
could allow complete compromise of any nodes
in the Ansible controller’s inventory.
Before we learn how to exploit Ansible,
let’s spend a little time learning about its intended use.
In the lab, we’ll use the controller
and linuxvictim machines to demonstrate these concepts.
They will perform the roles of the Ansible controller
and node respectively.
The ansibleadm user on the controller issues commands.
The same account exists on the victim node.
This account on the victim machine
has the public key for the ontroller’s ansibleadm user set
in its authorized_keys file
to allow access.
This user has sudo rights on the node to be able to perform privileged actions.
Inspecting the host inventory on the controller,
we find that it consists of only one host,
the linuxvictim machine
as part of a group called “victims”.