This portion of the project is focused on auditing a CI/CD system and is the default name space when the "rake" command is invoked in this project.
Here's the list of audit checks it does right now:
Is the root user is being to build projects?
Can malicious code steal your RubyGems API key?
Could malicious code pivot to private networks?
Can malicous code authenticate using your GitHub creds?
Could malicious code receive instructions from a remote party or exfiltrate data from your CI?
Can malicious code access other projects being built on the same server?
Can malicious code steal SSH private keys?
RottenApple::Attack
Conversely, this is the portion of the project that enables you to actively attack a CI/CD. To change to "attack mode", open the Rakefile and change the default to "attack".
Here's the list of attacks it does right now:
Steal the RubyGems API key
Flush IP Tables (aka: drop firewall rules)
Install Software to aid in the attack process
Make an unauthorized commit to master
Perform an NMAP scan of a desired set to targets
Throw/Shovel a reverse shell to get command-line access to the CI/CD
Steal SSH private keys
Contributing
If you are interested in contributing to this project, please see CONTRIBUTING.md
请发表评论