# AWS - S3 Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

## S3 Openbare Buckets

A bucket word as beskou as **“openbaar”** indien **enige gebruiker die inhoud kan lys** van die bucket, en **“privaat”** indien die inhoud van die bucket **slegs deur sekere gebruikers gelys of geskryf** kan word.

Maatskappye kan buckets-permissies verkeerd gekonfigureer hê wat toegang gee óf tot alles óf tot enigiemand geauthentiseer in AWS in enige rekening (dus aan enigiemand). Neem kennis dat selfs met sulke miskonfigurasies sommige aksies dalk nie uitgevoer kan word nie aangesien buckets hul eie access control lists (ACLs) kan hê.

**Leer oor AWS-S3 misconfigurasie hier:** [**http://flaws.cloud**](http://flaws.cloud/) **and** [**http://flaws2.cloud/**](http://flaws2.cloud)

### AWS Buckets opspoor

Verskillende metodes om te vind wanneer 'n webblad AWS gebruik om sekere resources te stoor:

#### Enumeration & OSINT:

- Gebruik die **wappalyzer** browser-plugin
- Gebruik burp (**spidering** the web) of deur handmatig deur die bladsy te navigeer — alle **resources** wat **geladen** word sal in die History gestoor word.
- **Kyk na resources** in domeine soos:

```
http://s3.amazonaws.com/[bucket_name]/
http://[bucket_name].s3.amazonaws.com/
```

- Kyk vir **CNAMES** aangesien `resources.domain.com` moontlik die CNAME `bucket.s3.amazonaws.com` het
- **[s3dns](https://github.com/olizimmermann/s3dns)** – 'n liggewig DNS-bediener wat passief cloud storage buckets (S3, GCP, Azure) identifiseer deur DNS-verkeer te ontleed. Dit ontdek CNAMEs, volg resolusiekettinge en identifiseer bucket-patrone, en bied 'n stil alternatief vir brute-force of API-gebaseerde ontdekking. Perfek vir recon en OSINT-werkvloeie.
- Kyk by [https://buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/), 'n webwerf met reeds **ontdekte oop buckets**.
- Die **bucket name** en die **bucket domain name** moet **dieselfde** wees.
- **flaws.cloud** is op **IP** 52.92.181.107 en as jy daarheen gaan herlei dit jou na [https://aws.amazon.com/s3/](https://aws.amazon.com/s3/). Ook, `dig -x 52.92.181.107` gee `s3-website-us-west-2.amazonaws.com`.
- Om te verifieer dat dit 'n bucket is kan jy ook **besoek** [https://flaws.cloud.s3.amazonaws.com/](https://flaws.cloud.s3.amazonaws.com/).

#### Brute-Force

Jy kan buckets vind deur **brute-forcing name**s verwant aan die maatskappy wat jy pentesting:

- [https://github.com/sa7mon/S3Scanner](https://github.com/sa7mon/S3Scanner)
- [https://github.com/clario-tech/s3-inspector](https://github.com/clario-tech/s3-inspector)
- [https://github.com/jordanpotti/AWSBucketDump](https://github.com/jordanpotti/AWSBucketDump) (Contains a list with potential bucket names)
- [https://github.com/fellchase/flumberboozle/tree/master/flumberbuckets](https://github.com/fellchase/flumberboozle/tree/master/flumberbuckets)
- [https://github.com/smaranchand/bucky](https://github.com/smaranchand/bucky)
- [https://github.com/tomdev/teh_s3_bucketeers](https://github.com/tomdev/teh_s3_bucketeers)
- [https://github.com/RhinoSecurityLabs/Security-Research/tree/master/tools/aws-pentest-tools/s3](https://github.com/RhinoSecurityLabs/Security-Research/tree/master/tools/aws-pentest-tools/s3)
- [https://github.com/Eilonh/s3crets_scanner](https://github.com/Eilonh/s3crets_scanner)
- [https://github.com/belane/CloudHunter](https://github.com/belane/CloudHunter)

<pre class="language-bash"><code class="lang-bash"># Generate a wordlist to create permutations
curl -s https://raw.githubusercontent.com/cujanovic/goaltdns/master/words.txt > /tmp/words-s3.txt.temp
curl -s https://raw.githubusercontent.com/jordanpotti/AWSBucketDump/master/BucketNames.txt >>/tmp/words-s3.txt.temp
cat /tmp/words-s3.txt.temp | sort -u > /tmp/words-s3.txt

# Generate a wordlist based on the domains and subdomains to test
## Write those domains and subdomains in subdomains.txt
cat subdomains.txt > /tmp/words-hosts-s3.txt
cat subdomains.txt | tr "." "-" >> /tmp/words-hosts-s3.txt
cat subdomains.txt | tr "." "\n" | sort -u >> /tmp/words-hosts-s3.txt

# Create permutations based in a list with the domains and subdomains to attack
goaltdns -l /tmp/words-hosts-s3.txt -w /tmp/words-s3.txt -o /tmp/final-words-s3.txt.temp
## The previous tool is specialized increating permutations for subdomains, lets filter that list
<strong>### Remove lines ending with "."
</strong>cat /tmp/final-words-s3.txt.temp | grep -Ev "\.$" > /tmp/final-words-s3.txt.temp2
### Create list without TLD
cat /tmp/final-words-s3.txt.temp2 | sed -E 's/\.[a-zA-Z0-9]+$//' > /tmp/final-words-s3.txt.temp3
### Create list without dots
cat /tmp/final-words-s3.txt.temp3 | tr -d "." > /tmp/final-words-s3.txt.temp4http://phantom.s3.amazonaws.com/
### Create list without hyphens
cat /tmp/final-words-s3.txt.temp3 | tr "." "-" > /tmp/final-words-s3.txt.temp5

## Generate the final wordlist
cat /tmp/final-words-s3.txt.temp2 /tmp/final-words-s3.txt.temp3 /tmp/final-words-s3.txt.temp4 /tmp/final-words-s3.txt.temp5 | grep -v -- "-\." | awk '{print tolower($0)}' | sort -u > /tmp/final-words-s3.txt

## Call s3scanner
s3scanner --threads 100 scan --buckets-file /tmp/final-words-s3.txt  | grep bucket_exists
</code></pre>

#### Loot S3 Buckets

Gegewe S3 oop buckets kan [**BucketLoot**](https://github.com/redhuntlabs/BucketLoot) outomaties **soek na interessante inligting**.

### Vind die Regio

Jy kan al die deur AWS ondersteunde regio's vind by [**https://docs.aws.amazon.com/general/latest/gr/s3.html**](https://docs.aws.amazon.com/general/latest/gr/s3.html)

#### By DNS

Jy kan die regio van 'n bucket kry met 'n **`dig`** en **`nslookup`** deur 'n **DNS-versoek op die ontdekte IP** uit te voer:
```bash
dig flaws.cloud
;; ANSWER SECTION:
flaws.cloud.    5    IN    A    52.218.192.11

nslookup 52.218.192.11
Non-authoritative answer:
11.192.218.52.in-addr.arpa name = s3-website-us-west-2.amazonaws.com.
```
Kontroleer dat die opgeloste domeinnaam die woord "website" bevat.
Jy kan die statiese website besoek by: `flaws.cloud.s3-website-us-west-2.amazonaws.com`
of jy kan die bucket besoek by: `flaws.cloud.s3-us-west-2.amazonaws.com`



#### Deur te probeer

As jy probeer om toegang tot 'n bucket te kry, maar in die **domeinnaam 'n ander streek spesifiseer** (byvoorbeeld die bucket is in `bucket.s3.amazonaws.com` maar jy probeer toegang kry via `bucket.s3-website-us-west-2.amazonaws.com`), sal jy na die **korrekte ligging aangedui** word:

![](<../../../images/image (106).png>)

### Enumerering van die bucket

Om die openheid van die bucket te toets kan 'n gebruiker net die URL in hul webblaaier invoer. 'n Private bucket sal reageer met "Access Denied". 'n Publieke bucket sal die eerste 1,000 objekke wat gestoor is lys.

Oop vir almal:

![](<../../../images/image (201).png>)

Privaat:

![](<../../../images/image (83).png>)

Jy kan dit ook met die cli nagaan:
```bash
#Use --no-sign-request for check Everyones permissions
#Use --profile <PROFILE_NAME> to indicate the AWS profile(keys) that youwant to use: Check for "Any Authenticated AWS User" permissions
#--recursive if you want list recursivelyls
#Opcionally you can select the region if you now it
aws s3 ls s3://flaws.cloud/ [--no-sign-request] [--profile <PROFILE_NAME>] [ --recursive] [--region us-west-2]
```
As die bucket nie 'n domeinnaam het nie, wanneer jy dit probeer enumerate, **voer slegs die bucket name in** en nie die hele AWSs3-domein nie. Voorbeeld: `s3://<BUCKETNAME>`

### Publieke URL-sjabloon
```
https://{user_provided}.s3.amazonaws.com
```
### Kry Account ID van openbare Bucket

Dit is moontlik om 'n AWS-account te bepaal deur voordeel te trek uit die nuwe **`S3:ResourceAccount`** **Policy Condition Key**. Hierdie voorwaarde **beperk toegang gebaseer op die S3 bucket** waarin 'n account is (ander account-gebaseerde beleidsreëls beperk toegang gebaseer op die account waarin die requesting principal is).\
En omdat die policy **wildcards** kan bevat, is dit moontlik om die accountnommer **net een syfer op 'n slag** te vind.

Hierdie tool outomatiseer die proses:
```bash
# Installation
pipx install s3-account-search
pip install s3-account-search
# With a bucket
s3-account-search arn:aws:iam::123456789012:role/s3_read s3://my-bucket
# With an object
s3-account-search arn:aws:iam::123456789012:role/s3_read s3://my-bucket/path/to/object.ext
```
Hierdie tegniek werk ook met API Gateway URLs, Lambda URLs, Data Exchange data sets en selfs om die waarde van tags te kry (as jy die tag-sleutel ken). Jy kan meer inligting vind in die [**original research**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) en die tool [**conditional-love**](https://github.com/plerionhq/conditional-love/) om hierdie uitbuiting te outomatiseer.

### Bevestig dat 'n bucket aan 'n AWS-account behoort

Soos verduidelik in [**this blog post**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/)**, as jy toestemming het om 'n bucket te lys**, is dit moontlik om 'n accountID te bevestig waaraan die bucket behoort deur 'n versoek te stuur soos:
```bash
curl -X GET "[bucketname].amazonaws.com/" \
-H "x-amz-expected-bucket-owner: [correct-account-id]"

<?xml version="1.0" encoding="UTF-8"?>
<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">...</ListBucketResult>
```
As die fout “Access Denied” is, beteken dit dat die account ID verkeerd was.

### Gebruik e-posadresse as root account enumeration

Soos verduidelik in [**this blog post**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/), is dit moontlik om te kontroleer of 'n e-posadres aan enige AWS account verwant is deur **te probeer om 'n e-pos toestemming te verleen** oor 'n S3 bucket via ACLs. As dit nie 'n fout veroorsaak nie, beteken dit dat die e-pos 'n root user van 'n AWS account is:
```python
s3_client.put_bucket_acl(
Bucket=bucket_name,
AccessControlPolicy={
'Grants': [
{
'Grantee': {
'EmailAddress': 'some@emailtotest.com',
'Type': 'AmazonCustomerByEmail',
},
'Permission': 'READ'
},
],
'Owner': {
'DisplayName': 'Whatever',
'ID': 'c3d78ab5093a9ab8a5184de715d409c2ab5a0e2da66f08c2f6cc5c0bdeadbeef'
}
}
)
```
## Verwysings

- [https://www.youtube.com/watch?v=8ZXRw4Ry3mQ](https://www.youtube.com/watch?v=8ZXRw4Ry3mQ)
- [https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/](https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/)

{{#include ../../../../banners/hacktricks-training.md}}
