Ad-hoc Commands
Node actions can be initiated from an Ansible controller in two primary ways.
The first is through ad-hoc commands,
and the second involves the use of playbooks.
Let’s begin with ad-hoc commands.
Ad-hoc commands are simple shell commands to be run on all,
or a subset, of machines in the Ansible inventory.
They’re called “ad-hoc” because they’re not part of a playbook
which scripts actions to be repeated.
Typically, ad-hoc commands would be for one-off situations
where we would want to run a command on multiple servers.
To find out how a command behaves outside of an attack scenario,
let’s run an ad-hoc command on our linuxvictim machine
as ansibleadm on the controller.
Our ad-hoc command ran "whoami"
on all members of the victims group,
which, in our case, is limited to only the linuxvictim machine.
The command returned the result, which is “ansibleadm”.
If we wanted to run a command as root
or some other user, we can use the --become parameter.
Without a value, this defaults to root,
but we could specify a user if we want.
According to the output, our command ran as root on the victim machine.
The potential of this attack is devastating.
If we can gain privileges to run ad-hoc commands from the Ansible controller,
we have backdoor root access
to run commands on any of the hosts in the inventory file,
under most common configurations.