gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-01 18:44:56 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/README.md', 'src/banners/hacktricks-training.md', 'src/

Browse Source
This commit is contained in:
Translator
2024-12-31 20:11:38 +00:00
parent ea97a1362c
commit 427eda5e4b
245 changed files with 10192 additions and 12906 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/pentesting-cloud-methodology.md
+90 -130
View File
@@ -1,48 +1,47 @@
# Pentesting Cloud Methodology
# Metodologia de Pentesting em Nuvem
{{#include ../banners/hacktricks-training.md}}
<figure><img src="../images/CLOUD-logo-letters.svg" alt=""><figcaption></figcaption></figure>
## Basic Methodology
## Metodologia Básica
Each cloud has its own peculiarities but in general there are a few **common things a pentester should check** when testing a cloud environment:
Cada nuvem tem suas peculiaridades, mas, em geral, há algumas **coisas comuns que um pentester deve verificar** ao testar um ambiente em nuvem:
- **Benchmark checks**
- This will help you **understand the size** of the environment and **services used**
- It will allow you also to find some **quick misconfigurations** as you can perform most of this tests with **automated tools**
- **Services Enumeration**
- You probably won't find much more misconfigurations here if you performed correctly the benchmark tests, but you might find some that weren't being looked for in the benchmark test.
- This will allow you to know **what is exactly being used** in the cloud env
- This will help a lot in the next steps
- **Check exposed assets**
- This can be done during the previous section, you need to **find out everything that is potentially exposed** to the Internet somehow and how can it be accessed.
- Here I'm taking **manually exposed infrastructure** like instances with web pages or other ports being exposed, and also about other **cloud managed services that can be configured** to be exposed (such as DBs or buckets)
- Then you should check **if that resource can be exposed or not** (confidential information? vulnerabilities? misconfigurations in the exposed service?)
- **Check permissions**
- Here you should **find out all the permissions of each role/user** inside the cloud and how are they used
- Too **many highly privileged** (control everything) accounts? Generated keys not used?... Most of these check should have been done in the benchmark tests already
- If the client is using OpenID or SAML or other **federation** you might need to ask them for further **information** about **how is being each role assigned** (it's not the same that the admin role is assigned to 1 user or to 100)
- It's **not enough to find** which users has **admin** permissions "\*:\*". There are a lot of **other permissions** that depending on the services used can be very **sensitive**.
- Moreover, there are **potential privesc** ways to follow abusing permissions. All this things should be taken into account and **as much privesc paths as possible** should be reported.
- **Check Integrations**
- It's highly probably that **integrations with other clouds or SaaS** are being used inside the cloud env.
- For **integrations of the cloud you are auditing** with other platform you should notify **who has access to (ab)use that integration** and you should ask **how sensitive** is the action being performed.\
For example, who can write in an AWS bucket where GCP is getting data from (ask how sensitive is the action in GCP treating that data).
- For **integrations inside the cloud you are auditing** from external platforms, you should ask **who has access externally to (ab)use that integration** and check how is that data being used.\
For example, if a service is using a Docker image hosted in GCR, you should ask who has access to modify that and which sensitive info and access will get that image when executed inside an AWS cloud.
- **Verificações de Benchmark**
- Isso ajudará você a **entender o tamanho** do ambiente e **serviços utilizados**
- Também permitirá que você encontre algumas **configurações incorretas rápidas**, pois você pode realizar a maioria desses testes com **ferramentas automatizadas**
- **Enumeração de Serviços**
- Você provavelmente não encontrará muitas mais configurações incorretas aqui se tiver realizado corretamente os testes de benchmark, mas pode encontrar algumas que não estavam sendo procuradas no teste de benchmark.
- Isso permitirá que você saiba **o que está exatamente sendo usado** no ambiente em nuvem
- Isso ajudará muito nos próximos passos
- **Verifique ativos expostos**
- Isso pode ser feito durante a seção anterior, você precisa **descobrir tudo que está potencialmente exposto** à Internet de alguma forma e como pode ser acessado.
- Aqui estou considerando **infraestrutura exposta manualmente**, como instâncias com páginas da web ou outras portas sendo expostas, e também sobre outros **serviços gerenciados em nuvem que podem ser configurados** para serem expostos (como DBs ou buckets)
- Então você deve verificar **se esse recurso pode ser exposto ou não** (informações confidenciais? vulnerabilidades? configurações incorretas no serviço exposto?)
- **Verifique permissões**
- Aqui você deve **descobrir todas as permissões de cada função/usuário** dentro da nuvem e como elas são usadas
- Muitas contas **altamente privilegiadas** (controlam tudo)? Chaves geradas não utilizadas?... A maioria dessas verificações já deveria ter sido feita nos testes de benchmark
- Se o cliente estiver usando OpenID ou SAML ou outra **federação**, você pode precisar pedir mais **informações** sobre **como cada função está sendo atribuída** (não é a mesma coisa que a função de admin ser atribuída a 1 usuário ou a 100)
- Não é **suficiente encontrar** quais usuários têm permissões **admin** "\*:\*". Existem muitas **outras permissões** que, dependendo dos serviços utilizados, podem ser muito **sensíveis**.
- Além disso, existem **potenciais caminhos de privesc** a seguir abusando de permissões. Todas essas coisas devem ser levadas em conta e **o maior número possível de caminhos de privesc** deve ser relatado.
- **Verifique Integrações**
- É altamente provável que **integrações com outras nuvens ou SaaS** estejam sendo usadas dentro do ambiente em nuvem.
- Para **integrações da nuvem que você está auditando** com outra plataforma, você deve notificar **quem tem acesso para (ab)usar essa integração** e deve perguntar **quão sensível** é a ação sendo realizada.\
Por exemplo, quem pode escrever em um bucket AWS de onde o GCP está obtendo dados (pergunte quão sensível é a ação no GCP tratando esses dados).
- Para **integrações dentro da nuvem que você está auditando** de plataformas externas, você deve perguntar **quem tem acesso externamente para (ab)usar essa integração** e verificar como esses dados estão sendo usados.\
Por exemplo, se um serviço estiver usando uma imagem Docker hospedada no GCR, você deve perguntar quem tem acesso para modificar isso e quais informações sensíveis e acessos essa imagem terá quando executada dentro de uma nuvem AWS.
## Multi-Cloud tools
## Ferramentas Multi-Nuvem
There are several tools that can be used to test different cloud environments. The installation steps and links are going to be indicated in this section.
Existem várias ferramentas que podem ser usadas para testar diferentes ambientes em nuvem. Os passos de instalação e links serão indicados nesta seção.
### [PurplePanda](https://github.com/carlospolop/purplepanda)
A tool to **identify bad configurations and privesc path in clouds and across clouds/SaaS.**
Uma ferramenta para **identificar configurações ruins e caminhos de privesc em nuvens e entre nuvens/SaaS.**
{{#tabs }}
{{#tab name="Install" }}
{{#tab name="Instalar" }}
```bash
# You need to install and run neo4j also
git clone https://github.com/carlospolop/PurplePanda
@@ -54,29 +53,25 @@ export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help
```
{{#endtab }}
{{#tab name="GCP" }}
```bash
export GOOGLE_DISCOVERY=$(echo 'google:
- file_path: ""
- file_path: ""
service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64)
service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64)
python3 main.py -a -p google #Get basic info of the account to check it's correctly configured
python3 main.py -e -p google #Enumerate the env
```
{{#endtab }}
{{#endtabs }}
### [Prowler](https://github.com/prowler-cloud/prowler)
It supports **AWS, GCP & Azure**. Check how to configure each provider in [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
Ele suporta **AWS, GCP e Azure**. Verifique como configurar cada provedor em [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
```bash
# Install
pip install prowler
@@ -91,14 +86,12 @@ prowler aws --profile custom-profile [-M csv json json-asff html]
prowler <provider> --list-checks
prowler <provider> --list-services
```
### [CloudSploit](https://github.com/aquasecurity/cloudsploit)
AWS, Azure, Github, Google, Oracle, Alibaba
{{#tabs }}
{{#tab name="Install" }}
{{#tab name="Instalação" }}
```bash
# Install
git clone https://github.com/aquasecurity/cloudsploit.git
@@ -107,16 +100,13 @@ npm install
./index.js -h
## Docker instructions in github
```
{{#endtab }}
{{#tab name="GCP" }}
```bash
## You need to have creds for a service account and set them in config.js file
./index.js --cloud google --config </abs/path/to/config.js>
```
{{#endtab }}
{{#endtabs }}
@@ -125,8 +115,7 @@ npm install
AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud Infrastructure
{{#tabs }}
{{#tab name="Install" }}
{{#tab name="Instalar" }}
```bash
mkdir scout; cd scout
virtualenv -p python3 venv
@@ -135,42 +124,36 @@ pip install scoutsuite
scout --help
## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image
```
{{#endtab }}
{{#tab name="GCP" }}
```bash
scout gcp --report-dir /tmp/gcp --user-account --all-projects
## use "--service-account KEY_FILE" instead of "--user-account" to use a service account
SCOUT_FOLDER_REPORT="/tmp"
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "================================================"
echo "Checking $pid"
mkdir "$SCOUT_FOLDER_REPORT/$pid"
scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
echo "================================================"
echo "Checking $pid"
mkdir "$SCOUT_FOLDER_REPORT/$pid"
scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
done
```
{{#endtab }}
{{#endtabs }}
### [Steampipe](https://github.com/turbot)
{{#tabs }}
{{#tab name="Install" }}
Download and install Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Or use Brew:
{{#tab name="Instalação" }}
Baixe e instale o Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Ou use o Brew:
```
brew tap turbot/tap
brew install steampipe
```
{{#endtab }}
{{#tab name="GCP" }}
```bash
# Install gcp plugin
steampipe plugin install gcp
@@ -183,13 +166,11 @@ steampipe dashboard
# To run all the checks from rhe cli
steampipe check all
```
<details>
<summary>Check all Projects</summary>
In order to check all the projects you need to generate the `gcp.spc` file indicating all the projects to test. You can just follow the indications from the following script
<summary>Verificar todos os Projetos</summary>
Para verificar todos os projetos, você precisa gerar o arquivo `gcp.spc` indicando todos os projetos a serem testados. Você pode apenas seguir as indicações do seguinte script.
```bash
FILEPATH="/tmp/gcp.spc"
rm -rf "$FILEPATH" 2>/dev/null
@@ -197,32 +178,30 @@ rm -rf "$FILEPATH" 2>/dev/null
# Generate a json like object for each project
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "connection \"gcp_$(echo -n $pid | tr "-" "_" )\" {
plugin = \"gcp\"
project = \"$pid\"
plugin = \"gcp\"
project = \"$pid\"
}" >> "$FILEPATH"
done
# Generate the aggragator to call
echo 'connection "gcp_all" {
plugin = "gcp"
type = "aggregator"
connections = ["gcp_*"]
plugin = "gcp"
type = "aggregator"
connections = ["gcp_*"]
}' >> "$FILEPATH"
echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated"
```
</details>
To check **other GCP insights** (useful for enumerating services) use: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
Para verificar **outros insights do GCP** (útil para enumerar serviços) use: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
To check Terraform GCP code: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)
Para verificar o código Terraform do GCP: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)
More GCP plugins of Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
Mais plugins do GCP do Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
{{#endtab }}
{{#tab name="AWS" }}
```bash
# Install aws plugin
steampipe plugin install aws
@@ -246,29 +225,27 @@ cd steampipe-mod-aws-compliance
steampipe dashboard # To see results in browser
steampipe check all --export=/tmp/output4.json
```
Para verificar o código Terraform AWS: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
To check Terraform AWS code: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
More AWS plugins of Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
Mais plugins AWS do Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
{{#endtab }}
{{#endtabs }}
### [~~cs-suite~~](https://github.com/SecurityFTW/cs-suite)
AWS, GCP, Azure, DigitalOcean.\
It requires python2.7 and looks unmaintained.
Requer python2.7 e parece não estar mantido.
### Nessus
Nessus has an _**Audit Cloud Infrastructure**_ scan supporting: AWS, Azure, Office 365, Rackspace, Salesforce. Some extra configurations in **Azure** are needed to obtain a **Client Id**.
Nessus tem uma varredura _**Audit Cloud Infrastructure**_ que suporta: AWS, Azure, Office 365, Rackspace, Salesforce. Algumas configurações extras em **Azure** são necessárias para obter um **Client Id**.
### [**cloudlist**](https://github.com/projectdiscovery/cloudlist)
Cloudlist is a **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) from Cloud Providers.
Cloudlist é uma **ferramenta multi-cloud para obter Ativos** (Nomes de Host, Endereços IP) de Provedores de Nuvem.
{{#tabs }}
{{#tab name="Cloudlist" }}
```bash
cd /tmp
wget https://github.com/projectdiscovery/cloudlist/releases/latest/download/cloudlist_1.0.1_macOS_arm64.zip
@@ -276,46 +253,40 @@ unzip cloudlist_1.0.1_macOS_arm64.zip
chmod +x cloudlist
sudo mv cloudlist /usr/local/bin
```
{{#endtab }}
{{#tab name="Second Tab" }}
{{#tab name="Segunda Aba" }}
```bash
## For GCP it requires service account JSON credentials
cloudlist -config </path/to/config>
```
{{#endtab }}
{{#endtabs }}
### [**cartography**](https://github.com/lyft/cartography)
Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database.
Cartography é uma ferramenta Python que consolida ativos de infraestrutura e os relacionamentos entre eles em uma visualização gráfica intuitiva alimentada por um banco de dados Neo4j.
{{#tabs }}
{{#tab name="Install" }}
```bash
# Installation
docker image pull ghcr.io/lyft/cartography
docker run --platform linux/amd64 ghcr.io/lyft/cartography cartography --help
## Install a Neo4j DB version 3.5.*
```
{{#endtab }}
{{#tab name="GCP" }}
```bash
docker run --platform linux/amd64 \
--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
-e NEO4j_PASSWORD="s3cr3t" \
ghcr.io/lyft/cartography \
--neo4j-uri bolt://host.docker.internal:7687 \
--neo4j-password-env-var NEO4j_PASSWORD \
--neo4j-user neo4j
--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
-e NEO4j_PASSWORD="s3cr3t" \
ghcr.io/lyft/cartography \
--neo4j-uri bolt://host.docker.internal:7687 \
--neo4j-password-env-var NEO4j_PASSWORD \
--neo4j-user neo4j
# It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html)
@@ -326,17 +297,15 @@ docker run --platform linux/amd64 \
## Google Kubernetes Engine
### If you can run starbase or purplepanda you will get more info
```
{{#endtab }}
{{#endtabs }}
### [**starbase**](https://github.com/JupiterOne/starbase)
Starbase collects assets and relationships from services and systems including cloud infrastructure, SaaS applications, security controls, and more into an intuitive graph view backed by the Neo4j database.
Starbase coleta ativos e relacionamentos de serviços e sistemas, incluindo infraestrutura de nuvem, aplicações SaaS, controles de segurança e mais, em uma visualização gráfica intuitiva suportada pelo banco de dados Neo4j.
{{#tabs }}
{{#tab name="Install" }}
{{#tab name="Instalar" }}
```bash
# You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/
npm install --global yarn
@@ -359,44 +328,40 @@ docker build --no-cache -t starbase:latest .
docker-compose run starbase setup
docker-compose run starbase run
```
{{#endtab }}
{{#tab name="GCP" }}
```yaml
## Config for GCP
### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md
### It requires service account credentials
integrations:
- name: graph-google-cloud
instanceId: testInstanceId
directory: ./.integrations/graph-google-cloud
gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
config:
SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}"
PROJECT_ID: ""
FOLDER_ID: ""
ORGANIZATION_ID: ""
CONFIGURE_ORGANIZATION_PROJECTS: false
- name: graph-google-cloud
instanceId: testInstanceId
directory: ./.integrations/graph-google-cloud
gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
config:
SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}"
PROJECT_ID: ""
FOLDER_ID: ""
ORGANIZATION_ID: ""
CONFIGURE_ORGANIZATION_PROJECTS: false
storage:
engine: neo4j
config:
username: neo4j
password: s3cr3t
uri: bolt://localhost:7687
#Consider using host.docker.internal if from docker
engine: neo4j
config:
username: neo4j
password: s3cr3t
uri: bolt://localhost:7687
#Consider using host.docker.internal if from docker
```
{{#endtab }}
{{#endtabs }}
### [**SkyArk**](https://github.com/cyberark/SkyArk)
Discover the most privileged users in the scanned AWS or Azure environment, including the AWS Shadow Admins. It uses powershell.
Descubra os usuários mais privilegiados no ambiente AWS ou Azure escaneado, incluindo os AWS Shadow Admins. Ele usa powershell.
```powershell
Import-Module .\SkyArk.ps1 -force
Start-AzureStealth
@@ -405,18 +370,17 @@ Start-AzureStealth
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')
Scan-AzureAdmins
```
### [Cloud Brute](https://github.com/0xsha/CloudBrute)
A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
Uma ferramenta para encontrar a infraestrutura, arquivos e aplicativos de uma empresa (alvo) nos principais provedores de nuvem (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
### [CloudFox](https://github.com/BishopFox/cloudfox)
- CloudFox is a tool to find exploitable attack paths in cloud infrastructure (currently only AWS & Azure supported with GCP upcoming).
- It is an enumeration tool which is intended to compliment manual pentesting.
- It doesn't create or modify any data within the cloud environment.
- CloudFox é uma ferramenta para encontrar caminhos de ataque exploráveis na infraestrutura de nuvem (atualmente apenas AWS e Azure suportados, com GCP a caminho).
- É uma ferramenta de enumeração que visa complementar o pentesting manual.
- Não cria nem modifica nenhum dado dentro do ambiente de nuvem.
### More lists of cloud security tools
### Mais listas de ferramentas de segurança em nuvem
- [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec)
@@ -448,14 +412,10 @@ azure-security/
### Attack Graph
[**Stormspotter** ](https://github.com/Azure/Stormspotter)creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work.
[**Stormspotter** ](https://github.com/Azure/Stormspotter) cria um “gráfico de ataque” dos recursos em uma assinatura Azure. Ele permite que equipes vermelhas e pentesters visualizem a superfície de ataque e oportunidades de pivô dentro de um inquilino, e potencializa seus defensores para rapidamente se orientar e priorizar o trabalho de resposta a incidentes.
### Office365
You need **Global Admin** or at least **Global Admin Reader** (but note that Global Admin Reader is a little bit limited). However, those limitations appear in some PS modules and can be bypassed accessing the features **via the web application**.
Você precisa de **Admin Global** ou pelo menos **Leitor de Admin Global** (mas note que o Leitor de Admin Global é um pouco limitado). No entanto, essas limitações aparecem em alguns módulos PS e podem ser contornadas acessando os recursos **via a aplicação web**.
{{#include ../banners/hacktricks-training.md}}