Enumerating Ansible
Now that we’ve covered Ansible’s intended use cases, let’s shift our perspective
to that of an attacker.
The first thing we need to do is determine whether or not
Ansible is in use on our target system.
The quickest way to do this is to run the ansible command.
Other indicators include the existence of an /etc/ansible filepath,
which contains Ansible configuration files,
or the presence of “ansible” related usernames in /etc/passwd.
These items are often present on an Ansible controller system.
We may also be able to identify Ansible nodes.
First, we could examine the list of users in /etc/passwd
for Ansible-related usernames.
We might also check for the list of home folders,
which may give away whether a user account exists
for performing Ansible actions.
Finally, it may also be possible to detect
Ansible-related log messages in the system’s syslog file.
Now that we know Ansible is installed on the target,
let’s explore a few different attack vectors.