MOSE: Using Configuration Management for Evil
summary
MOSE is an open-source Go binary that translates a single command or script into Puppet/Chef/Ansible/Salt payloads, automating discovery of where to place backdoors, secrets harvesting, and deployment across agents. A demo compromises a compromised Chef workstation, uploads a payload, and gains reverse shells and a web shell, reintroducing SSH keys via agent runs every ~20 minutes; earlier engagements escalate from one Jenkins key to ~15 hosts then a puppet master to hundreds of servers. Test labs (Docker/Vagrant) exist and the tool works as shown.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:25What are CM tools
- 3:57Abusing CM servers
- 5:26Introducing MOSE
- 9:22Why MOSE helps attackers
- 11:10MOSE workflow explained
- 13:24Live demo overview
- 19:42Testing and resources
- 21:50Q&A and closing
related talks
30mTales of Red Teaming
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
17mOSINT to Compromise
31mUnleash the Infection Monkey: A Modern Alternative to Pen-Tests
40mDevOoops (Increase awareness around DevOps infra security)
34mKomrade: an Open-Source Security Chaos Engineering (SCE) Tool for...
59mDSCOMPROMISED: A Windows DSC Attack Framework
51mFirmware Cartography: Charting the Course for Modern Server Compromise